6 ms·
User-triggerable NULL pointer dereference
- Doublon 13y agoI like the style
- JonnieCache 13y agoIt perfectly captures the mindstate of someone who's been debugging for 16 hours straight only to find out it's someone else's fault. EDIT: That's not to say it's professional. It is amusing to read though.
- atesti 13y agohttp://www.fredberinger.com/images/codereview6.jpg http://www.fredberinger.com/images/codereview6.jpg (This picture is funny but very accurate: If you can review code without swear words, your soul just isn't into it)
- akanet 13y ago(I'm sure there's going to be a plethora of commenters in the near future roundly criticizing the author for his tone) I strongly agree with the author on the rampant disconnect between Mongo's actual quality and its marketed quality.
- chris_wot 13y agoAllow me to be the first. The tone is appalling.
- deleted 13y ago[deleted]
- coldtea 13y agoAnd since when do hackers care about "the tone"?
- Jare 13y agoIf you don't then you are a dumbass. :)
- coldtea 13y agoSo Linus Torvalds, widely known for his snarky retorts and offensive remarks, is a dumbass? I'm in good company then. But I'd rather think that being a dumbass is orthogonal to caring for tone.
- Semiapies 13y agoBesides the obvious point of neither you nor the bug poster being Linux Torvalds, his famous excerpts are generally taken out of context after long arguments, and they're still more socially functional than this infantile bug report.
- chris_wot 13y agoSince forever. Who are you to stereotype all hackers as uncaring, blunt, socially awkward and mean?
- adlpz 13y agoI will join the others saying as me: as someone who has been in the situation of debugging something for hours only to find out the cause is someone's else incompetence, I totally find his tone acceptable. At the same time, MongoDB is a free, OSS solution. While it's true it's marketed way above reality, you both don't have to pay for it (beyond support) and can contribute to it if something doesn't work as you wish it did.
- lucian1900 13y agoSadly, it is also terrible. When something is that bad and marketed so strongly, it being open source and free is less of a saving grace.
- exDM69 13y ago> I will join the others saying as me: as someone who has been in the situation of debugging something for hours only to find out the cause is someone's else incompetence, I totally find his tone acceptable. This tone is not acceptable in a formal bug report. It's fine to pour out your frustration in this tone to your coworkers over a pint of beer, but it is not fine to go and yell it at someones face in a formal environment. Everyone has wasted hours and hours in a frustrating debugging spree, we all know that feeling. Get over it and be a professional, report the bug, fix it and shut up.
- deleted 13y ago[deleted]
- adlpz 13y agoWell, you are right. I would have said I found his tone understandable, not really acceptable.
- antirez 13y agoI guess the tone may be disturbing, but I hope that the MongoDB team will do the right thing and thank the user for the detailed bug report, fix the issue, and don't focus too much on the noisy part of the message. After all he tried to use the system, found an issue after debugging for a long time, and contributed the finding back instead of sharing it only with his friends to crash random servers on the internet.
- coldtea 13y ago>I guess the tone may be disturbing, but I hope that the MongoDB team will do the right thing and thank the user for the detailed bug report, fix the issue, and don't focus too much on the noisy part of the message. Actually, just fixing the bugs after public outrage will no do. They should focus A LOT on the noisy part of the message. And feel shame. And then do something about it. I'm glad for the noisy part myself.
- exDM69 13y ago> They should focus A LOT on the noisy part of the message. > And feel shame. And then do something about it. No the MongoDB team should not feel ashamed, the author of this bug report should. This kind of aggressive writing is unprofessional, rude and childish. People make mistakes, even good engineers do. They should not be yelled at like this even if they screw up badly. Writing software is a team effort, and the users of open source software should be a part of that team and take the collective responsibility of finding, reporting and fixing bugs in an effective and civilized manner. The tone of this bug report does not help fixing this bug faster or better, but it does make the reporter look like an ass.
- jibberzmcgee 13y agoResisting the urge to comment, but suffice to say I disagree entirely. The level of fail on display here is indicative of a total lack of understanding of the basic principles of working in C, with the CPython API, or as a company, any regard for quality control – even still 4 years after a trivially machine-detectable bug was introduced. They don't even need Coverity, there are numerous cheaper and free static analysers that could have caught this before it left 10gen's offices. Marketing a database server that crashes with such C-101 style bugs due to the shape of the data being stored is simply beyond. I disagree that publicizing stupidity like this can do harm – the crash is clean enough that any trivial crash restart loop (e.g. just about any production web server) will catch it. In the meantime the company are much more motivated to provide a fix that I need, that I should never have needed in the first place. For all the "responsible disclosure" idiocy on this thread, in most cases the crash is not remotely exploitable unless some API directly stores JSON objects provided by a user, and even then, amounts to little more than a slow request – a crash triggering a potentially expensive restart of the failed process. Useful for a DDoS perhaps, but not an immediate national security threat. We happen to want this functionality since its one of the main "it's just JSON" selling points of Mongo to begin with, we want index visibility for the user data, and we think it's ridiculous that we should have to double-serialize the user data (and write our own indexing) in order to avoid obvious bugs.
- latch 13y agoThe l33sp3@k as well as the [attempt] at humor at 10gen's expense is fine. Anyone who thinks that publicly attacking an individual at this level is in any way acceptable should work hard at being more empathic. No long hours of working justify this.
- antihero 13y ago"Anyone who thinks that publicly attacking an individual at this level is in any way acceptable should work hard at being more empathic" YAWN. Or people could just get thicker skin so we can actually have fun? This is just banter.
- drcongo 13y ago"Banter" is a vile word for a disgusting act.
- untothebreach 13y agoRidiculing others is fun? I know that was true in high school, but I thought we were adults now.
- coldtea 13y ago>Ridiculing others is fun? I know that was true in high school, but I thought we were adults now. Yes, ridiculing others has been fun for adults for several millennia. And ridiculing others that deserve it has also been a kind of justice.
- SamReidHughes 13y agoEverybody, quick! Let's rain down condemnation on somebody!
- aktau 13y agoI personally don't fault the author too much for his tone, because I understand his situation (been there, done that). Something like this is on the verge (and probably over) of being unacceptable. In inherited a project with MongoDB as well and even though I haven't run in to many problems except for MongoDB 2.0.x (debian wheezy) removing the journal file somewhere during a shutdown but only removing the lock file later, which can and does lead to a race condition and a database that refuses to start up unless removing the lockfile manually)... I sincerely hold my heart I don't run into things like this. Luckily Mongo is only used for some kind of persistent object storage for a PHP webapp. (the db is all of 10MB...).
- MichaelAza 13y agoBefore I even get to the tone of this bug report, I'd like to ask the guy who made it - are you aware you just put many many users in risk here? Besides making their services unavailable, this might lead to further exploits. There is a way to disclose this sort of stuff. This is not it. Now, about the tone - be a human first, programmer second. Even though it seems 10gen screwed up big time, everyone makes mistakes. You could inform them of what seems to be a major issue privately and politely, not ridicule them in public. I wouldn't want it done to me and I'm sure neither would you. As said by Chazal (old timey Jewish scholars): "Proper behavior precedes the Torah ... and whoever humiliates another, it is as though he killed him" EDIT: I'd just like to add that among the companies affected by this disclosure and which are now totally open to attack are Craiglist, Firebase, MTV, SourceForge, Codecademy and others. Here's the full list - http://www.mongodb.org/about/production-deployments/ http://www.mongodb.org/about/production-deployments/
- tokenizerrr 13y agoHe found a bug, and posted to the bug tracker. Would you have preferred he just shared this with his buddies to crash servers, or attempt to sell it?
- MichaelAza 13y agoWhen you find a bug which amounts to a security vulnerability, you should inform them privately and then make it public after a reasonable amount of time has passed and preferably after it's been fixed. By making it public right from the get-go, anyone who sees this bug report can now attack any system that uses MongoDB. Do you think that's OK?
- CJefferson 13y agoIs it the height of professionalism? No. However, I've written similarly irate messages at 4 or 5am, particularly after spending months working on a product. And this level of coding quality is unacceptable in any product which wants to be large-scale deployed on the internet.
- lttlrck 13y agoStep 0. Assume free open source project with publicly accessible bug tracking system with non-zero open issues is bug-free.
- alcuadrado 13y agoThey are profiting out of mongodb, they are getting people to invest lots of time, trust, and money in their product. The author has a strong point that quality of the development process for mongodb must not be good if a bug like this one gets into production, when it could be avoided using automated tools. This won't be such a fault for a random open source project, but if you are making a business out of it, and you are encouraging others to base use it as a key part of their business it do is a great problem.
- OldSchool 13y agoAgreed. This is one of the unintended results of giving out free stuff in general; no good deed goes unpunished. There are enough bugs in commercial APIs and products that hitting one in something you got for free should be no surprise at all. I always describe programming as incredibly easy, except for the part when things don't work as they're supposed to work. Very often you eventually find this is outside of your control. You have to be more calm and patient than the bug. He's not going to win any friends or help acting like a pompous ass who's never made a mistake in his life. Maybe he hasn't because this is his first real project.
- viraptor 13y agoCould someone explain what's actually so critical here? The way I understand it is that if you can inject custom json contents into the mongodb data, you can cause the pymongo library to crash. This should not be allowed to begin with though - why would you allow anyone to store custom object without any checks? I would compare it to a null reference on a badly formatted SQL query - sure, it's a bug, but why did you allow the user to submit unescaped string to begin with. Or am I missing something important?
- tetha 13y agoAs other comments pointed out, it's not that critical per se. It crashes, restarts and then that's it. Beyond that, it's an undefined pointer dereference - who knows what this could be use for in certain combinations and systems. Use a "not so critical" bug in that subsystem, a "not so critical" mistake over there, another "somewhat severe" error over there and you got a root shell going. It's simply disconcerning and annoying if you consider that static checkers could have caught it.
- viraptor 13y agoIt's a NULL pointer dereference, not undefined pointer from what I can see. Unless someone was able to mmap that memory, it should simply cause an instant crash. PyDict_GetItemString() is guaranteed to return NULL for missing fields.
- acc01 13y agoIs this a new kind of viral adverts for Coverity?
- kmasters 13y agoBefore getting religiously high and mighty it might be instructive to run a security scan on the whole of the Internet and see how many SQL injection vulnerabilities exist on the websites of major US companies and small time startups. The fact that MongoDB has in itself a vulnerability to unchecked input is not great. But consider that if you are dealing with client side browser or server side software, the entire stack is rife with security vulnerabilities because the components themselves right down to TCP/IP are inherently insecure. Be careful out there, and write nicer bug reports. Use the process. If you were on the other end of that bug report, you would feel differently.
- kyllo 13y agoBefore getting religiously high and mighty it might be instructive to run a security scan on the whole of the Internet and see how many SQL injection vulnerabilities exist on the websites of major US companies and small time startups. Doing that will almost certainly get you thrown behind bars.
- kmasters 13y agolol I didnt say to actually DO THAT. It was to make a point that we all adopt things that bite us, many things. "Nobody expects the Inquisition"
- deleted 13y ago[deleted]