Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A routine gem update ended up creating $73k worth of subscriptions

serpapi.com

Post reply on HN
Print view View original

211–220 of 336 posts

Re: A routine gem update ended up creating $73k worth of subscriptions

#211

Post by jchw »

stouset wrote: post #194
emodendroket wrote: post #182

Earlier quoted context omitted.

Ultimately this is why I don't like to work in Ruby. You can just never trust any line of code between the gem updates, the unhelpful signatures, the overreliance on hashes everywhere, and a million different levels of mix-ins and indirection. Yeah, it's expressive, but how much time are you really saving once you consider all these maintenance headaches?

This exact problem could have happened in any language. Literally zero of it has to do with Ruby or the ecosystem.

Certainly it has something to do with the ecosystem, if the most popular MongoDB driver in the ecosystem is making breaking changes in minor versions.

That said, strong types can be a godsend for catching accidental breaks, even if it wouldn’t necessarily have helped here. A strongly typed language that has a more disciplined ecosystem is less likely to run into these kinds of issues.

It’s one of the tradeoffs you pick when deciding between languages. I decided the tradeoffs didn’t work well for me and left for compiled languages, for now.

Re: A routine gem update ended up creating $73k worth of subscriptions

#212

Post by dagmx »

philwelch wrote: post #181
munificent wrote: post #32

Earlier quoted context omitted.

I'm guessing the sentence they wrote is just a consequence of English not being the author's primary language. I frequently see ESL speakers get adjective and adverb positions wrong in ways that unintentially change the meaning. Even skilled English speakers make mistakes here because English is both very permissive about word order, but also tends to give different shades of meaning to each other. "Only" is a pernic…

It’s kind of like the saying, “all that glitters is not gold”. Gold doesn’t glitter? That makes no sense. English syntax is not mathematical logic. The song, “I Can’t Get No Satisfaction” is not a song about someone who is forced to receive satisfaction.

Somewhat related to your points of music...

There's an episode of "This is Pop!" on Netflix that explores why the Swedes write so many pop hits.

One of the arguments presented is that they speak English well as a second/third language so they're less focused on the lyrics making sense and being grammatically correct, and are free to make lyrics that sound like they work but are non-sensical on reflection. It's just the right amount of separation from the language.

Ever since I saw that, I've been listening closer to a lot of the top pop songs over the last decade, and it's fascinating how English is so breakable while sounding right to our mind, but falls apart under scrutiny. (Obviously this is not unique to the swedish writers, even people who only speak English do it as well)

Re: A routine gem update ended up creating $73k worth of subscriptions

#213

Post by vmception »

That’s an emergency

To me this is basically a malicious hack of a dependency under the excuse of conforming it to activerecord

I would investigate contributors to this version and the code review and discussion

This could be actually malicious as someone could know or suspect that an app is vulnerable to this fundamental change

Re: A routine gem update ended up creating $73k worth of subscriptions

#214

Post by dagmx »

gedy wrote: post #203
stouset wrote: post #194

Earlier quoted context omitted.

This exact problem could have happened in any language. Literally zero of it has to do with Ruby or the ecosystem.

No, this is particularly bad in Ruby. Many languages, esp. compiled do not have the same issues.

What language would avoid the problem?

Re: A routine gem update ended up creating $73k worth of subscriptions

#215

Post by [deleted] »

stouset wrote: post #194
emodendroket wrote: post #182

Earlier quoted context omitted.

Ultimately this is why I don't like to work in Ruby. You can just never trust any line of code between the gem updates, the unhelpful signatures, the overreliance on hashes everywhere, and a million different levels of mix-ins and indirection. Yeah, it's expressive, but how much time are you really saving once you consider all these maintenance headaches?

This exact problem could have happened in any language. Literally zero of it has to do with Ruby or the ecosystem.

[deleted]

Re: A routine gem update ended up creating $73k worth of subscriptions

#216

Post by zestyping »

kurtbuilds wrote: post #138

Three easy lessons: 1. Don't use MongoDB. 2. Don't use high level ORMs. Stay (reasonably) close to SQL. And yes, it should be SQL. Almost certainly Postgres. 3. Especially don't use Mongoid.

And another:

4. Don't design an API that mixes fluent style (methods are like infix operators) with conventional style (methods are like prefix operators).

Fluent methods should never take multiple operands. It's a terrible, horrible, no-good, very bad idea.

Re: A routine gem update ended up creating $73k worth of subscriptions

#217

Post by Gigachad »

gedy wrote: post #203
stouset wrote: post #194

Earlier quoted context omitted.

This exact problem could have happened in any language. Literally zero of it has to do with Ruby or the ecosystem.

No, this is particularly bad in Ruby. Many languages, esp. compiled do not have the same issues.

That’s often the case but for this particular issue, it could have happened in any language because it’s still returning the exact same type. Its an array of the same record type in both instances.

Re: A routine gem update ended up creating $73k worth of subscriptions

#218

Post by [deleted] »

fouc wrote: post #129
nefitty wrote: post #36

Earlier quoted context omitted.

I feel spoiled having most of my experience in js, react and node. They like, try really hard not to totally break shit.

You would feel spoiled if you were a ruby developer too. This type of library API breaking change on a minor version update basically never happens. And if it can happen in ruby land, it can happen in JS land too.

[deleted]

Re: A routine gem update ended up creating $73k worth of subscriptions

#219

Post by montblanc »

henry700 wrote: post #134
montblanc wrote: post #133

Earlier quoted context omitted.

I think tests should have caught that one but I agree.

Not if you follow the One True Way of Unit Testing (tm) where the Mongoid lib would have been mocked away, and the test would pass :) Integration tests might've done the job here.

You dont mock the db layer, i dont do that at least, hell no. Let the db be hit, check that the records it returns make sense. Thats how I roll at least.

Re: A routine gem update ended up creating $73k worth of subscriptions

#220

Post by seanwilson »

forgot_old_user wrote: post #91
gruez wrote: post #62

Earlier quoted context omitted.

probably a combination of realistic-seeming desktop browsers (eg. headless chrome with stealth patches) and residential IP providers (eg. luminati)

Their website says >In addition, each API request runs in a full browser, and we'll even solve all CAPTCHAs. Mimicking completely what a human will do. Wow how would they do that?

Is this not against Google's terms of service? Could they not make legal threats? And ban the company from using all Google products like Gmail and ads?

I know there's companies doing similar things and I'm not saying they should get in trouble, but it feels so risky basing a business around it, unless I'm missing something. Lots of companies seem to do similar scraping to get SEO data for example that Google probably has an interest in preventing.

Post reply on HN