4 ms·

Wow, just wow. I can't wonder how common such securing coding slip ups are these days.

by intrasight 3y ago

3-cheese-sundae 3y ago
This doesn't strike me as a slip-up, it strikes me as complete apathy on behalf of the developer(s).
- throwaway4233 3y ago
  On inspecting the page where they list restaurants, I can see a several versions of jQuery code like this, for each cuisine. $('#Fish & Chips').on('change', function () { if ($('#Fish & Chips').is(':checked')) { $('.Fish & Chips').css('background-color', '#3a606e;'); $('.Fish & Chips').css('color', '#fff;'); } else { $('.Fish & Chips').css('background-color', '#fff'); $('.Fish & Chips').css('color', '#3a606e;'); } }); I have a good feeling this is more of copy-pasta code from either Copilot or ChatGPT or StackOverflow. That also explains why they handled encryption the way described in the article. Dev: "Hey LLM, how do I pass data around in a secure way ?" Bot: "You can encrypt the data before you send it, so that only users who have the relevant keys can read them" Dev: "Hey LLM, it is not possible to access the data I have encrypted on the frontend" Bot: "Here is the javascript code to decrypt the data you have passed then"
  - lcnPylGDnU4H9OF 3y ago
    "This is what you mean by CSS-in-JS, right?" But seriously, those selectors are making me cringe. Does it even work with the spaces? $('[id="Fish & Chips"]') $('[class="Fish & Chips"]')
    - throwaway4233 3y ago
      with attribute selectors like what you have mentioned it would work. But `$('#Fish & Chips')` most certainly will not, since jQuery would throw a syntax error.
      - lcnPylGDnU4H9OF 3y ago
        It makes sense to throw a syntax error but I wasn't sure what the actual behavior would be. Made me wonder if jquery did some magic to understand what is being queried.
        DaiPlusPlus 3y ago
        jQuery first came-out long before browsers had querySelector: it used a 100% JS reimplementation of a CSS selector parser and evaluator, which was eventually spun-off into its own library: Sizzle.js: https://github.com/jquery/sizzle https://github.com/jquery/sizzle - Surprisingly, jQuery didn't fully remove Sizzle until 2019 ( https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ ) - if that seems surprisingly recent, don't forget that querySelector wasn't added to the DOM API until 2013 - with only IE11 supporting it: some places were still using even IE6 well past then, so it makes sense for jQuery to support it for so long. So using newer CSS selector features, like attribute value selectors, will work fine in post-Sizzle jQuery versions.
  - hk__2 3y ago
    This kind of code is very common among folks who learned JS using jQuery ten years ago and never tried to learn anything else since that time.
  - OkayPhysicist 3y ago
    I don't think this site was the work of an LLM. I think it was the result of somebody who just learned frontend JavaScript trying to hack together a website and business, with next to no practical knowledge. There's all sorts of weird stuff, and it definitely looks like the kind of thing you'd see a beginner copy-pasting code and trying things out would create. The site sets a cookie containing the key-value pair "key":"value", for example.
    - lcnPylGDnU4H9OF 3y ago
      > key-value pair "key":"value" This reminds me of when I first started programming professionally. I’d write loops in PHP like foreach($orders_by_id as $key => $value) { $id = $key; $order = $value; # ... } This was at a small logistics company you’ve never heard of (read: not the best development practices) so the habit was eventually caught in a code review and corrected. I must have written a dozen or so of those prior to that.
gorkish 3y ago
This isn't a 'coding slip up.' The original issue, as egregious and terrible as it is, could have been a a mistake. However, whoever implemented 'the fix' is someone acting acting with unforgivable malice and deceit. Anyway its on HN now. FAFO
cced 3y ago
This is not a slip up-it’s basically malpractice.
- heattemp99 3y ago
  Is it really malpractice if there are zero education requirements, going as far as purposely not calling it software engineering since there is zero standards for the 'engineering' being done.
  - alexeldeib 3y ago
    Perhaps not, but negligence and malpractice are different. Average joe can be negligent and legally liable (driving for example). No idea what the legal precedent for negligent software engineering would be…
    - heattemp99 3y ago
      You can be negligent because there are rules of the road you sign up for, and get a license for. But if it's just a job you take with zero qualifications required, how can you be liable? The company, maybe. The programmer? Aren't called code monkeys for nothing.
      - alexeldeib 3y ago
        Oh, I see what you’re saying. I agree. Although even with driving, an unlicensed driver would still be liable. I suppose it depends what you consider agreement to social rules and how you define liability. I can certainly be held liable for damages for my actions to others which do not require me to hold any license - merely break the law. Did I agree to the “rules of the road” when I was born? Do I consent by not emigrating? (nits, picked…)
        johncalvinyoung 3y ago
        Use of payment networks and keys are protected by contractual agreements that have quite a lot to do with liability.
Kalium 3y ago
Assuming this is human-written, it only makes sense to me as something cooked up by someone who understands a bit of JS but sincerely has no clue how browsers work. A smart and ambitious, if somewhat incurious, junior engineer at work.
- deleted 3y ago
  [deleted]

Wow, just wow. I can't wonder how common such securing coding slip ups are these days.

3-cheese-sundae 3y ago

This doesn't strike me as a slip-up, it strikes me as complete apathy on behalf of the developer(s).

throwaway4233 3y ago
On inspecting the page where they list restaurants, I can see a several versions of jQuery code like this, for each cuisine. $('#Fish & Chips').on('change', function () { if ($('#Fish & Chips').is(':checked')) { $('.Fish & Chips').css('background-color', '#3a606e;'); $('.Fish & Chips').css('color', '#fff;'); } else { $('.Fish & Chips').css('background-color', '#fff'); $('.Fish & Chips').css('color', '#3a606e;'); } }); I have a good feeling this is more of copy-pasta code from either Copilot or ChatGPT or StackOverflow. That also explains why they handled encryption the way described in the article. Dev: "Hey LLM, how do I pass data around in a secure way ?" Bot: "You can encrypt the data before you send it, so that only users who have the relevant keys can read them" Dev: "Hey LLM, it is not possible to access the data I have encrypted on the frontend" Bot: "Here is the javascript code to decrypt the data you have passed then"
- lcnPylGDnU4H9OF 3y ago
  "This is what you mean by CSS-in-JS, right?" But seriously, those selectors are making me cringe. Does it even work with the spaces? $('[id="Fish & Chips"]') $('[class="Fish & Chips"]')
  - throwaway4233 3y ago
    with attribute selectors like what you have mentioned it would work. But `$('#Fish & Chips')` most certainly will not, since jQuery would throw a syntax error.
    - lcnPylGDnU4H9OF 3y ago
      It makes sense to throw a syntax error but I wasn't sure what the actual behavior would be. Made me wonder if jquery did some magic to understand what is being queried.
      - DaiPlusPlus 3y ago
        jQuery first came-out long before browsers had querySelector: it used a 100% JS reimplementation of a CSS selector parser and evaluator, which was eventually spun-off into its own library: Sizzle.js: https://github.com/jquery/sizzle https://github.com/jquery/sizzle - Surprisingly, jQuery didn't fully remove Sizzle until 2019 ( https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ ) - if that seems surprisingly recent, don't forget that querySelector wasn't added to the DOM API until 2013 - with only IE11 supporting it: some places were still using even IE6 well past then, so it makes sense for jQuery to support it for so long. So using newer CSS selector features, like attribute value selectors, will work fine in post-Sizzle jQuery versions.
- hk__2 3y ago
  This kind of code is very common among folks who learned JS using jQuery ten years ago and never tried to learn anything else since that time.
- OkayPhysicist 3y ago
  I don't think this site was the work of an LLM. I think it was the result of somebody who just learned frontend JavaScript trying to hack together a website and business, with next to no practical knowledge. There's all sorts of weird stuff, and it definitely looks like the kind of thing you'd see a beginner copy-pasting code and trying things out would create. The site sets a cookie containing the key-value pair "key":"value", for example.
  - lcnPylGDnU4H9OF 3y ago
    > key-value pair "key":"value" This reminds me of when I first started programming professionally. I’d write loops in PHP like foreach($orders_by_id as $key => $value) { $id = $key; $order = $value; # ... } This was at a small logistics company you’ve never heard of (read: not the best development practices) so the habit was eventually caught in a code review and corrected. I must have written a dozen or so of those prior to that.

gorkish 3y ago

This isn't a 'coding slip up.' The original issue, as egregious and terrible as it is, could have been a a mistake. However, whoever implemented 'the fix' is someone acting acting with unforgivable malice and deceit. Anyway its on HN now. FAFO

cced 3y ago

This is not a slip up-it’s basically malpractice.

heattemp99 3y ago
Is it really malpractice if there are zero education requirements, going as far as purposely not calling it software engineering since there is zero standards for the 'engineering' being done.
- alexeldeib 3y ago
  Perhaps not, but negligence and malpractice are different. Average joe can be negligent and legally liable (driving for example). No idea what the legal precedent for negligent software engineering would be…
  - heattemp99 3y ago
    You can be negligent because there are rules of the road you sign up for, and get a license for. But if it's just a job you take with zero qualifications required, how can you be liable? The company, maybe. The programmer? Aren't called code monkeys for nothing.
    - alexeldeib 3y ago
      Oh, I see what you’re saying. I agree. Although even with driving, an unlicensed driver would still be liable. I suppose it depends what you consider agreement to social rules and how you define liability. I can certainly be held liable for damages for my actions to others which do not require me to hold any license - merely break the law. Did I agree to the “rules of the road” when I was born? Do I consent by not emigrating? (nits, picked…)
      - johncalvinyoung 3y ago
        Use of payment networks and keys are protected by contractual agreements that have quite a lot to do with liability.

Kalium 3y ago

Assuming this is human-written, it only makes sense to me as something cooked up by someone who understands a bit of JS but sincerely has no clue how browsers work. A smart and ambitious, if somewhat incurious, junior engineer at work.

deleted 3y ago
[deleted]