4 ms·

Ask HN: What horrifying and/or terrible things have you seen in production code?

14 points by jackweirdy 12y ago

Interested in hearing the worst things you've seen that somehow went into production somewhere.

mschuster91 12y ago
Passwordless sudo for www-data and a shellcode injection attack give a pretty nice exploit vendor.
BenMorganIO 12y ago
XUL code and I had to install Firefox 16.2. Was not happy.
sergiotapia 12y ago
* Horrible duplicate code. * Functions with more than 200 lines. * Functions with about 16 parameters. * A deploy process that consisted of copy and pasting using FTP. * No source code control. Not even regular file backups, the 'code' was just on production and everybody worked against that. * If else cases in the double digits.
- shoo 12y ago
  Ugh. > Functions with about 16 parameters. I am reminded of a talk by Kevlin Henney [1]. He mentions this quote from Alan Perlis: "If you have a procedure with ten parameters, you probably missed some." [2]. Kevlin goes on to give anecdotes about code he has encountered or heard stories about while consulting / teaching - the record was a function with around 370 parameters, and that function was still growing. I'd prefer to see a function with a dozen arguments than a "function" that takes no arguments, returns void, and secretly communicates using global state. Explicit horror beats surprise horror. [1] http://www.infoq.com/presentations/architecture-uncertainty-nordevcon-2014 http://www.infoq.com/presentations/architecture-uncertainty-... [2] http://www.cs.yale.edu/homes/perlis-alan/quotes.html http://www.cs.yale.edu/homes/perlis-alan/quotes.html
GnarfGnarf 12y ago
Jumping (GOTO) out of a subroutine directly back to a label in the main code. RPG. Sorting months by alpha name.
twunde 12y ago
Upon login, an application that created a new database for the user and then imported ALL the data from the api before allowing the user to continue to the next screen. The database would be dropped upon logout. Login times were in the hours if it was successful at all. And now think about the security and data integrity problems that implies.
vijayaggarwal 12y ago
I've seen many things in my 10+ years of coding, Here are some favourites: * No authentication check on any page after login page. (You could type in any URL in browser address bar and gain access). * GET request updating home page related content in database. (A few of these GET request was picked up by Alexa bot and we hard our home page content change randomly for many days. We had a real hard time troubleshooting this one). * Use of mysql_query() in PHP. (Deprecated mote than 10 years ago. Opens doors for SQL injection). * Use of loop variables i,j,k,l,m for 5-level nested loop. (Too error prone and difficult to read). * Unit testing applied to a highly monolithic code. (The hacks for isolating code units produced more garbage than the code itself). It was a legacy code and the management blindly ordered writing of unit tests when a few bugs were caught in production.
- shoo 12y ago
  > Unit testing applied to a highly monolithic code Do you (or indeed anyone else reading) have suggestions for getting other forms of testing in place around legacy monolithic code? Perhaps this is a fairly ill-posed question without more context.
  - vijayaggarwal 12y ago
    You can still do Integration Testing with the system as a whole, although it is supposed to be done after Unit Testing. The disadvantage due to absence of Unit Testing will be that it will be difficult it isolate bugs found during Integration Testing. For websites, we use Selenium all the time.
- robflynn 12y ago
  I have seen some similar code. After authentication, a parameter was passed into the URL. Basically, if you had that token, you were logged in. Some user posted a link to their page on some site and included that token. Later, the user complained about all of their photos constantly being deleted. Photo deletes were GET-based and did not have no-follow. Google eventually indexed their logged-in link and was happily deleting all of their photos daily. Fun times tracking that one down. (It was a code base that I inherited.)
scdna 12y ago
- no index on the db with even more reads than writes - duplicating full data set to handle offline sync of data between a client and a server - over 1000 lines of java per source file Edit: formatting
rachelandrew 12y ago
I used to do quite a bit of troubleshooting/rescuing half finished projects, or live things that had no developer involved for one reason or another. Not that many years ago I was still seeing people storing credit card numbers in plain text files on servers, and sending them unencrypted via email.
- kjs3 12y ago
  > Not that many years ago I was still seeing people storing > credit card numbers in plain text files on servers, and > sending them unencrypted via email. I've seen it in the last week. I work for an ESP, and have to continually tell customers "just because you can store CCs (or SSNs, or private account #s, etc) in our database, there's never a good reason why you should" and "PCI? Heard of it?".
dwarman 12y ago
A company for which I used to work decided to buy rather than invent some new technology. In this one case, after the principles had taken their money and run, I was asked to look at the IP that money purchased. This came in the form of 8 8" floppy disks (dating me:). At the time I was in a metrics MSc class, so I decided to write a comment stats program, and ran these disks through it. With a alarming result - precisely 1 comment. And when I searched it out, it was this: "I don't know why this works" Oops. After that they put me at the front end due diligence instead of the back end.
andrewstuart 12y ago
All the code I wrote.
thejteam 12y ago
A function that consisted of a giant switch statement, with each case consisting of another switch statement. Half of the sub-cases contained GOTO statements back to the top of the function. Even worse... I wrote the code. It was 2am, I had been working for 18 hours straight to get everything ready for a demo the next morning. Even worse than that... the code worked so management wouldn't let me change it. I tried my best to find an edge case it wouldn't handle but never could. So the code shipped.
- JoachimSchipper 12y ago
  If that's the worst, that's not too bad - I mean, it's ugly, but apparently it works well. ;-)
S4M 12y ago
In a video game company, something like (it was in Action Script, I don't remember the exact syntax of that language): public class ScoreManager { //some statements public void updateScore(Action action) { int n = action.entityDestroyed; if n < n1 { playSound1(); score += 100*n; } else { playSound2(); score += 200*n; } } } I had to deal with that piece of code for something, and asked the developer to move the functions playing the sound out of the ScoreManager class so I could reuse it, and he categorically refused without giving me any explanation. EDIT: typos
adolfoabegg 12y ago
It was 2005, I had to execute an Oracle function from c#. The PL/SQL programmer that created the package/function told me that the function will return a single string. The returned string had the info a customer concatenated, like this: Pete McDonald 5519500303 The instructions - to extract the data - were: The indexes from 0 to 9 will contain the name (please trim the trailing spaces) The indexes from 10 to 19 will contain the last name (same, please trim) 20 to 21 will contain the age of the customer the rest of the string contains the customer's birthday EDIT: formatting

14 points by jackweirdy 12y ago

Interested in hearing the worst things you've seen that somehow went into production somewhere.

mschuster91 12y ago

Passwordless sudo for www-data and a shellcode injection attack give a pretty nice exploit vendor.

BenMorganIO 12y ago

XUL code and I had to install Firefox 16.2. Was not happy.

sergiotapia 12y ago

* Horrible duplicate code. * Functions with more than 200 lines. * Functions with about 16 parameters. * A deploy process that consisted of copy and pasting using FTP. * No source code control. Not even regular file backups, the 'code' was just on production and everybody worked against that. * If else cases in the double digits.

shoo 12y ago
Ugh. > Functions with about 16 parameters. I am reminded of a talk by Kevlin Henney [1]. He mentions this quote from Alan Perlis: "If you have a procedure with ten parameters, you probably missed some." [2]. Kevlin goes on to give anecdotes about code he has encountered or heard stories about while consulting / teaching - the record was a function with around 370 parameters, and that function was still growing. I'd prefer to see a function with a dozen arguments than a "function" that takes no arguments, returns void, and secretly communicates using global state. Explicit horror beats surprise horror. [1] http://www.infoq.com/presentations/architecture-uncertainty-nordevcon-2014 http://www.infoq.com/presentations/architecture-uncertainty-... [2] http://www.cs.yale.edu/homes/perlis-alan/quotes.html http://www.cs.yale.edu/homes/perlis-alan/quotes.html

GnarfGnarf 12y ago

Jumping (GOTO) out of a subroutine directly back to a label in the main code. RPG. Sorting months by alpha name.

twunde 12y ago

Upon login, an application that created a new database for the user and then imported ALL the data from the api before allowing the user to continue to the next screen. The database would be dropped upon logout. Login times were in the hours if it was successful at all. And now think about the security and data integrity problems that implies.

vijayaggarwal 12y ago

I've seen many things in my 10+ years of coding, Here are some favourites: * No authentication check on any page after login page. (You could type in any URL in browser address bar and gain access). * GET request updating home page related content in database. (A few of these GET request was picked up by Alexa bot and we hard our home page content change randomly for many days. We had a real hard time troubleshooting this one). * Use of mysql_query() in PHP. (Deprecated mote than 10 years ago. Opens doors for SQL injection). * Use of loop variables i,j,k,l,m for 5-level nested loop. (Too error prone and difficult to read). * Unit testing applied to a highly monolithic code. (The hacks for isolating code units produced more garbage than the code itself). It was a legacy code and the management blindly ordered writing of unit tests when a few bugs were caught in production.

shoo 12y ago
> Unit testing applied to a highly monolithic code Do you (or indeed anyone else reading) have suggestions for getting other forms of testing in place around legacy monolithic code? Perhaps this is a fairly ill-posed question without more context.
- vijayaggarwal 12y ago
  You can still do Integration Testing with the system as a whole, although it is supposed to be done after Unit Testing. The disadvantage due to absence of Unit Testing will be that it will be difficult it isolate bugs found during Integration Testing. For websites, we use Selenium all the time.
robflynn 12y ago
I have seen some similar code. After authentication, a parameter was passed into the URL. Basically, if you had that token, you were logged in. Some user posted a link to their page on some site and included that token. Later, the user complained about all of their photos constantly being deleted. Photo deletes were GET-based and did not have no-follow. Google eventually indexed their logged-in link and was happily deleting all of their photos daily. Fun times tracking that one down. (It was a code base that I inherited.)

scdna 12y ago

- no index on the db with even more reads than writes - duplicating full data set to handle offline sync of data between a client and a server - over 1000 lines of java per source file Edit: formatting

rachelandrew 12y ago

I used to do quite a bit of troubleshooting/rescuing half finished projects, or live things that had no developer involved for one reason or another. Not that many years ago I was still seeing people storing credit card numbers in plain text files on servers, and sending them unencrypted via email.

kjs3 12y ago
> Not that many years ago I was still seeing people storing > credit card numbers in plain text files on servers, and > sending them unencrypted via email. I've seen it in the last week. I work for an ESP, and have to continually tell customers "just because you can store CCs (or SSNs, or private account #s, etc) in our database, there's never a good reason why you should" and "PCI? Heard of it?".

dwarman 12y ago

A company for which I used to work decided to buy rather than invent some new technology. In this one case, after the principles had taken their money and run, I was asked to look at the IP that money purchased. This came in the form of 8 8" floppy disks (dating me:). At the time I was in a metrics MSc class, so I decided to write a comment stats program, and ran these disks through it. With a alarming result - precisely 1 comment. And when I searched it out, it was this: "I don't know why this works" Oops. After that they put me at the front end due diligence instead of the back end.

andrewstuart 12y ago

All the code I wrote.

thejteam 12y ago

A function that consisted of a giant switch statement, with each case consisting of another switch statement. Half of the sub-cases contained GOTO statements back to the top of the function. Even worse... I wrote the code. It was 2am, I had been working for 18 hours straight to get everything ready for a demo the next morning. Even worse than that... the code worked so management wouldn't let me change it. I tried my best to find an edge case it wouldn't handle but never could. So the code shipped.

JoachimSchipper 12y ago
If that's the worst, that's not too bad - I mean, it's ugly, but apparently it works well. ;-)

S4M 12y ago

In a video game company, something like (it was in Action Script, I don't remember the exact syntax of that language): public class ScoreManager { //some statements public void updateScore(Action action) { int n = action.entityDestroyed; if n < n1 { playSound1(); score += 100*n; } else { playSound2(); score += 200*n; } } } I had to deal with that piece of code for something, and asked the developer to move the functions playing the sound out of the ScoreManager class so I could reuse it, and he categorically refused without giving me any explanation. EDIT: typos

adolfoabegg 12y ago

It was 2005, I had to execute an Oracle function from c#. The PL/SQL programmer that created the package/function told me that the function will return a single string. The returned string had the info a customer concatenated, like this: Pete McDonald 5519500303 The instructions - to extract the data - were: The indexes from 0 to 9 will contain the name (please trim the trailing spaces) The indexes from 10 to 19 will contain the last name (same, please trim) 20 to 21 will contain the age of the customer the rest of the string contains the customer's birthday EDIT: formatting