19 ms·
Null
- liquidify 6y agoSomebody should write a book like the original "Programming Pearls" for weird hacks and anecdotes like the author's. Pretty fun stuff.
- bombcar 6y agoReminds me of https://www.wired.com/2015/11/null/ https://www.wired.com/2015/11/null/ Numerous cases of encoding out of band data as a special case of in-band data.
- deathanatos 6y agoMy browser is set to not accept cookies from sites I don't have a relationship with, because … well, frankly, I don't know why the rest of y'all still let shady people on the Internet use your hard disk for their ad tracking. So, that link (like so many), just plain doesn't work. It just loads a white screen. There are many sites like this on the Internet. Twitter waffles between working and "Ooops! something went wrong!". I've sent patches to Rust's documentation to fix it to work with cookies disabled. (But it won't persist any settings you change, of course, which is what it uses the cookies for.) That link has the double the fun: not only is the page completely white, it's logging errors to the JS console as fast as it can.
- DarkWiiPlayer 6y agoYou convinced me. I just disabled cookies globally so I have to allow them individually for every website.
- masklinn 6y ago> But it won't persist any settings you change, of course, which is what it uses the cookies for. Seems dumb not to use local storage (possibly with a cookies fallback though I wouldn’t even bother). You can also disable LS, but I don’t know that that’s possible on a per-site basis so it’s an unlikely configuration (and you can fallback same as if cookies were disabled, probably).
- deathanatos 6y agoSorry, I was generalizing a bit for simplicity. I believe the Rust docs do use localStorage. The "cookies" settings in Chrome/Firefox control all the browser's various forms of storage: FF calls it "Cookies and site data". If you disable it, the site can't set cookies or localStorage. (As being able to set localStorage would defeat the point of what the setting is really attempting to control.) > but I don’t know that that’s possible on a per-site basis so it’s an unlikely configuration Yeah, if you were using the "Block" settings in "Cookies and site data", for example, that would disable LS on a per-site basis. (I essentially block-by-default, and have an exception of allowed sites in that FF setting.) (I also have an extension that I wrote to produce a fake, good-for-this-page-load-only localStorage, with two settings: hold the values in RAM, or just /dev/null them. Most sites do not handle localStorage denying access, and essentially crash, so it's handy there, as that works around the poor programming on those sites.)
- tsujp 6y agoDeclarative programming is something that helps deal with weird edge cases like this right? I'm learning Elixir currently and the subtle semantics around the 'traditional' assignment operator (=) are quite cool. It means you can ditch most if blocks and provide a list of pattern-matchable functions (matched on their arity) to define logic which helps deal with edge cases a little better. I'm curious how such a declarative paradigm _may_ help with the wacky usage of software old mate Mr. Null endeavours in. No one paradigm solves all problems I feel but perhaps some allow us to harvest some low hanging fruit for free?
- throwaway894345 6y agoI don’t see how a string “null” would break anything besides a very stupidly written program (e.g., one which tries to eval() the input) or an ordinary program written in a very stupid language (e.g., one which tries to coerce strings to other types—PHP, is that you?). I’m a big fan of pattern matching (especially statically verified pattern matching so sorry elixir), but I don’t see how it would help here.
- rgj 6y agoEven PHP finds null==“null” to be false.
- hunter2_ 6y agoAnd at least you get to strongly compare by adding an extra = (e.g., ===, !==). I just wish the extra character (i.e., the not-as-default versions) weakened instead, like a tilde. But yes, all strings are truthy. Except an empty string! And maybe some little-used nullish characters? Doubtful, but...
- zerocrates 6y ago> But yes, all strings are truthy. Except an empty string! And maybe some little-used nullish characters? Doubtful, but... Or "0"
- pixl97 6y ago>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"
- josephg 6y agoMine too. I write a lot of javascript and the string "null" is pretty harmless in most code. But there's all sorts of fun bugs (and often security vulnerabilities) you can find if you make an identifier "__proto__". (If code ever uses that as the key in an object, you're off to the races!)
- steinuil 6y agoNice, I never thought of testing with "__proto__"! "constructor" is also a fun one.
- bhrgunatha 6y agoA favourite technique of one of my colleague's was just to mash the keyboard randomly to see if the app breaks. It's very crude and not at all foolproof. For the lack of sophistication it's shockingly effective at highlighting a huge amount of assumptions we make about how software is / can be used.
- jsrcout 6y agoOne of my professors back in college loved to do that. "Shockingly effective" is exactly the right term. Learned a lot from that little exercise.
- jannes 6y agoThis makes me wonder if there's a tool that can auto-generate random inputs and send them to the application. (maybe excluding Alt-Tab to avoid switching away from the application) Fuzzing is a pretty popular testing technique for libraries, but GUI software has not seen the same attention.
- deathanatos 6y agoI worked on an API that regularly got requests from the mobile app for GET /users/(null). I think that's Swift, or Obj-C's way of to-string'ing a null? I have a generational suffix on my name. I often include it, and quite often as the proper Unicode character, e.g., "Ⅲ". (Assuming HN displays it after I post this, try to select it; that's one character.) That wreaks a fair bit of havoc. When I was in high-school, I took physics. I was assigned to room, say, 309, to a teacher whose name I didn't recognize. But I knew the teacher in room 309, and she even taught physics. So, I approached her, and asked, "I've been assigned 'Ms. Stewart', but it lists her as being in your room. Do you know what the correct room number is, Ms. Cook?" Right room; it was her maiden name, of course. In my company's HR system, we have to note some contacts, for things like life insurance payouts. My fiancée is one. Then we transitioned to a new system, and the data from the old system was migrated over. Now she's my "fiancée". (And in a separate system, she's a he, because there was no option for "fiancée", only "fiancé".) Similarly (and a long time ago) I had to fix a contact/directory system when it escaped a '. E.g., it would emit "Marie O\'Conner". PHP magic quotes… shudders (Character encodings and anything outside of ASCII, in particular, are an unending fountain of bugs.) Just today, Azure's support system can't handle (among many things) the outlandish characters of "<" or ">". Which is great fun, since it's not like anyone would file a highly-technical support request with Azure… right? The missing hour in the DST spring-forward and the duplicate one on the fall-back are great hunting grounds for bugs, too. E.g., Google Calendar has issues with them. We have a git branch prefix at work that triggers a special CI action. Let's call it "branchprefix/". Every now and then a dev will make a branch with "BranchPrefix/" and the OS X machines all start having issues since OS X's file hierarchy isn't case sensitive. (We've also had issues w/ two files, same name different case. git supports it, but OS X can't cope.) (All the names in this post are changed from their originals, of course. But you get the idea.)
- saagarjha 6y agoThat’s how C usually prints it. Swift will print “nil”.
- deathanatos 6y agoHuh. I feel like I distinctly remember it being both one of our mobile clients, and it being the string "(null)". Java, perhaps? (That was our Android app, of course.) Although we did have a desktop app (weirdly) and that was in C++.
- xyst 6y agoPeople like that is the reason why this list was created https://github.com/minimaxir/big-list-of-naughty-strings/blob/master/blns.json https://github.com/minimaxir/big-list-of-naughty-strings/blo... My personal favorite is this one though "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",
- deleted 6y ago[deleted]
- Buildstarted 6y agoMost of the things in this list I can see what they're testing for but your favorite stumps me. Can you give me a hint? Thanks.
- lyrrad 6y agoI assume it's a joke to test if reality is a simulation or a dream.
- Buildstarted 6y agoThat makes complete sense and it went right over my head. Thanks
- m463 6y agoWhen Elon Musk was talking about reality vs simulation, I couldn't help but think he's onto something If you were going to play a simulation game, you would not be a normal participant. You would not play a normal person, you would play the successful guy at the top launching spaceships and making money. So - the chances of Elon Musk being in a simulation are very high compared to normal people.
- pyhtel 6y agoI would assume most simulations would be more academic/business related, like how we have tools that simulate a wind tunnel, rather than for entertainment purposes
- deleted 6y ago[deleted]
- Tepix 6y agoPerl 5 has a taint mode built into the language. If enabled, it forces the developer to untaint every bit of user-controllable data (by running it through a pattern match) before doing anything dangerous with it. I can't believe that this isn't a standard feature in all languages.
- masklinn 6y agoThat’s because it’s both more annoying than warranted and completely insufficient, even ignoring that “running through pattern match” is not great (see: parse, don’t validate). * “untainting” is highly context-specific, that something was cleaned up for HTML does nothing for SQL * which also means that the boundary is incorrect, just because you’re getting something out of storage does not mean it’s safe for anything (not even storing it back)
- Tepix 6y agoYou are right, the programmer still has to think. But with builtin taint it's harder to overlook something because it forces you to consider everything. I have a friend who is a long time C++ developer. Every time we discuss C++ he tells me that memory errors can be easily avoided in C++ if you have a certain level of competency. Someone still developed Rust because of this issue and it is popular.
- staticassertion 6y agoYou can do this with any language with a type system by wrapping reads with a 'Tainted' type. ie: fn safe_read(path: str) -> Tainted<IO> { Tainted(unsafe_read(path)) } And then you can apply functions to Tainted<IO> or whatever type that convert it into something structured / validated. So long as your functions only take in those validated types (ie: you do not write functions that take str) you can ensure that new reads will fail to typcheck without first parsing. To be honest this is how most programs I see work anyways, at least in typed languages. Few work directly on strings. But they do it naturally, without enforcement - so like, a function might take a 'str', but the 'str' passed in was parsed into a wrapping structure already.
- farisjarrah 6y agoPopey, I think I see you around these parts from time to time. If you're reading this: You and Martin Wimpress are constant sources of inspiration for me and many others, who want to keep on discovering the world of FOSS software. Thanks for the many hours of entertainment in your podcasts and the help you provide to people on the forums and mailing lists. Excellent work!
- popey 6y agoThank you. That's very kind of you to say.
- tomcam 6y ago> A year or so ago, at a company sprint I gave a lightning talk in which I wanted to make the tiniest possible snap What is a snap in this context?
- unwind 6y agoI would assume it's a Snap package [1], the new (?) packaging system that was somewhat controversial when included in Ubuntu 20. [1] https://snapcraft.io/ https://snapcraft.io/
- darkwater 6y agoA mean of software distribution, created by Canonical https://snapcraft.io/ https://snapcraft.io/
- popey 6y agoThanks for identifying this missing info. I've added a link to explain in the article.
- lukeitup 6y agoWeird hacks, love it!
- jack_riminton 6y agoI know finding bugs is undeniably a good thing but I can't help but feel someone as obviously bright as this should be making more things It's like the people who spent a lot of their time finding ever more pedantic inaccuracies and continuity errors in films. The mute LED on your thinkpad sometimes goes out of sync? fascinating
- raziel2p 6y agoWhat gives you the impression the author doesn't also make things?
- jack_riminton 6y agoI know they do But it just reminds me of this: https://youtu.be/2Z8pgV74_Hw?t=148 https://youtu.be/2Z8pgV74_Hw?t=148
- jerrre 6y agoNot everyone feels it's their moral right to be as productive/effective as possible.
- deleted 6y ago[deleted]
- jenoer 6y agoThis could allow a malicious party to trick the user into thinking it's microphone is not recording while it actually is. If this action can be performed using the hardware button it is likely that it can also be performed software-wise, it would be a nice addition for malicious software such as malware.
- bzbarsky 6y agoSince the mute LED is a user-facing security feature, it is in fact a pretty serious bug if users can't rely on it to be correct. Witness the wide variety of incidents over the last year where people ended up in serious trouble because they thought they were muted but weren't. I feel like of all the examples in the blog post, this was the one with by far the biggest potential for actual harm to people.
- stareatgoats 6y agoCase in point: http://sasheldon.com/blog/2017/05/07/how-i-broke-cargo-for-windows/ http://sasheldon.com/blog/2017/05/07/how-i-broke-cargo-for-w...
- bzb6 6y ago> When snaps are uploaded, there are security and sanity checks which run against the snap. My use of the (probably reserved) word null seemed to fool the backend checks script, live on stage, in front of my peers. That’s the way to end a lightning talk, I think! The backend crashes and instead of getting an error message you are forced to watch a spinner forever?
- popey 6y agoNot anymore. You're welcome! :D
- tinus_hn 6y agoIf these kinds of errors occur there might very well be an SQL injection going on.
- ChrisMarshallNY 6y agoThat’s a fun article! I’m big on Quality. Comes from 27 years, working for a corporation that is pretty much synonymous with the word. “Abuse testing” is very important, and almost impossible to automate. A good monkey tester will have a “sense” of where to go, as this chap indicates. I worked with an enormous team of people like this, and they would regularly find things like sync bugs (he talks about one). Those take a lot of work (and RSI risk) to find.
- typhonius 6y agoI found something like this when managed to accidentally break the Drupal.org git parser by adding emojis to a commit message. It wasn't on purpose, I was just on a 2015 emoji kick. That said, it did uncover a bug that obviously hadn't been tested for which gave the infra team more impetus to solve utf8mb4 support for the database. https://www.drupal.org/project/infrastructure/issues/2531884 https://www.drupal.org/project/infrastructure/issues/2531884 https://github.com/govCMS/govCMS7/commit/ab5da5fd0cb3d7e1d338f9a1067dd29a7026f21f https://github.com/govCMS/govCMS7/commit/ab5da5fd0cb3d7e1d33...
- kristaps 6y agoBreaking things is far easier than making things. While this type of poking around might feel fun, it will mostly result in low value work to fix something very few (if any) actual users would experience.
- metabagel 6y agoUnless they have cats.
- gfxgirl 6y agoYou should try using the direction changing unicode code points like 0x202E in your name. That will probably break many things.
- pvorb 6y agoI experienced the Thunderbird bug mentioned in the article first-hand and freaked out for a moment. "Where does that damn turtle come from?" And had to search quite a bit until I recognized that it was part of the subject. Unfortunately, I no longer have a screenshot of it.
- dpmdpm 6y agoReminds me of the first time my DnD group tried out roll20.net. The chat box allows players to type things like "/roll 1d6" or "/roll 2d12" to simulate rolling dice (in these cases 1 6-sided die and 2 12-sided dice). I quickly tried "/roll 1dNaN", crashed the chat, and we went back to physical dice for the rest of the session.
- kevincox 6y agoAlso fun is `/roll 9999999999d2` which IIRC Roll20 blocks but many virtual tabletops just hang on.
- sethammons 6y agoReminds me of a QA buddy. One day at the crosswalk, he decided to, I believe, hold the button. For the whole wait. He apparently broke the entire intersection’s lights and a repair crew came out. He was unable to reproduce it after.
- mleonhard 6y agoMaybe it was working as intended? If a crosswalk button becomes stuck, it's reasonable to switch the intersection to "safety mode" so people can still cross the street.
- pfdietz 6y agoI understand Gary Null has had some experiences.
- geoduck14 6y agoFun story: At work, we were learning how to use a new browser tool that was put together at the last minute. Plenty of people were having trouble logging in, so the instructor had one of the people share their screen so he could help. The user's profile showed: "name: null", which prompted someone to observe "I see your name is null, too". I interrupted with "yes, it is a family name". Good laughs were had.
- eloeffler 6y agoI once named a fat32 USB pendrive ЯBK This data must have corrupted some firmware section or so because the drive was gone afterwards. Couldn't format, couldn't dd, anything. Fits the category, I think. Only less funny :( Well, depends on the observer :)
- popey 6y agoI like it :)
- butz 6y agoNice to hear about issues that got actually fixed. I tend to find some edge case issues regularly too, but usually most of bug reports end up in limbo.
- anonymfus 6y agoThere was and still is a website called The Daily WTF about discussing especially funny bugs and programmer's mistakes. In 2012 I registered on it as a user "undefined" to make a comment about JavaScript oddities under one of their articles and almost forgot about its existence, then they migrated their comments and forums to Discourse and in 2015 I got a bunch of email notifications about people mentioning me as suddenly all "likes" in the forum were linked to my profile: https://what.thedailywtf.com/topic/17637/undefined-liked-this https://what.thedailywtf.com/topic/17637/undefined-liked-thi...
- munificent 6y ago> I went through a phase a while back of holding down keys to see what they did. Back when I was a gamedev at EA, one of the things QA would do is button-mash test the games. Just smash as many buttons as they could at the same time at all sorts of random points in the game. This was a constant source of bugs. It was surprisingly easy to get the game into a state where it was totally hung because of this. One of the main culprits was transitions between screens in the UI. So much of the UI code assumed that the initial state of a screen is that no buttons are currently pressed. But if you mash a bunch down in the middle of a transition, the screen can end up receiving a button up event that did not precede any button down event. If the screen's code assumed every up has a preceding down, it could get into a broken state. I never did see any clean systematic solution to this problem. I still think about it a lot when I do UI programming. In the back of my head, I'm always wondering, "what will happen if the user presses X in the middle of this animation?" Programmers are particularly prone to these bugs because we have unconsciously trained ourselves to baby our own software. We're careful to wait for transitions to complete and only send input when the app is in a known state.
- diamondo25 6y agoIf it was up to me, there were no transitions. I am happy I can disable them on Android... Everything that does or manipulates animation is terrible. Scroll hijackers, image carousels, icon transitions, they are all wasting cpu cycles to please UX/designers!
- snoshy 6y agoI'm glad there's at least one other person vocal about doing this. I use a several-year-old Android phone, and when anyone new sees me use it, the first thing they ask is what phone it is and if I just bought it. Those animations were for a time and place where phone processors were genuinely slow. That time and place is nearly a decade ago, and most of the world is stuck with lower productivity due to this vestigial cruft. Think of all of those teens that can type a billion letters a minute without batting an eye, and yet have to unwittingly endure all of these silly transitions... But of course, it breaks a whole bunch of poorly tested apps, even mainstream ones like Uber and Lyft.
- essayist 6y agoKids, a story from the Old Days, c.1981. DRI (since absorbed into McGraw Hill) had EPS, an advanced economic/financial analysis scripting language, provided via timesharing (mainframes on the East Coast of the USA). I was a customer support programmer in San Francisco the day that they rolled out a powerful arrays feature on the testing mainframe (no clients, but lots of real work going on). One could put anything as an element inside an array. So I tried: X=array(123, "abc") Y=Array(X) and it worked. You know where this is going, right? i=loop from 1 to 1000 x(i+1) = array (xi) It crashed the mainframe at i=67, if memory serves. So far, so good, excusable as "clever programmer tests the limits". And then I ran it again. Same result, plus, 2 minutes later, a call for me from my friend Kevin, who was a lead developer on EPS in DRI HQ: "Chris, what the ^&^&^!@@ are you doing?"
- z3t4 6y agoIf you want to find a bug in your software, make a live demonstration.
- fallingfrog 6y agoI laughed out loud when he said he held down the print screen key until it started repeating. That’s exactly the kind of thing a user would do but a developer would never think of!