Live data from Hacker News

A routine gem update ended up creating $73k worth of subscriptions

serpapi.com

241–250 of 336 posts

Re: A routine gem update ended up creating $73k worth of subscriptions

#241
This is why you need a staging server and test cases. You only upgrade in the weekends after fully testing.

Also, you always need to be extra careful with payment code. We test it multiple times before deploying it.

Granted all this wouldn't had helped OP, still you need to test everything before upgrading and deploying.

Re: A routine gem update ended up creating $73k worth of subscriptions

#242

Earlier quoted context omitted.

It’s kind of like the saying, “all that glitters is not gold”. Gold doesn’t glitter? That makes no sense. English syntax is not mathematical logic. The song, “I Can’t Get No Satisfaction” is not a song about someone who is forced to receive satisfaction.

I guess Shakespeare did write it that way, but I've always heard the saying as "Not all that glitters is gold." Perhaps he took some poetic license at the expense of logical correctness.

> Shakespeare […] Perhaps he took some poetic license

That was kind of his thing, when he wasn’t just inventing words to fit rhyme/meter/mood.

He’s not who you would go to if you wanted unambiguous documentation of the guarantees you were providing downstream users, that wasn’t really his thing.

Re: A routine gem update ended up creating $73k worth of subscriptions

#243

Earlier quoted context omitted.

Tbh when you work with ruby to have to assume everything could break with any update and just unit test the shit out of everything. Of course it’s easy to miss something, but unit tests could have caught this issue. It's still just really bad work from the gem developers though. Ideally you shouldn't ever drastically change the behavior of a method. Just introduce it again with a new name and remove the old one. Yeah…

Ultimately this is why I don't like to work in Ruby. You can just never trust any line of code between the gem updates, the unhelpful signatures, the overreliance on hashes everywhere, and a million different levels of mix-ins and indirection. Yeah, it's expressive, but how much time are you really saving once you consider all these maintenance headaches?

We're just trading anecdotes at this point but I can't say I've encountered the same problems over the past decade of working with it. That's generally because of limiting dependencies, but also because it's a good idea to peek at the changelog or release notes when bumping the minor or major version.

TFA doesn't mention or acknowledge this aspect of the issue, but it did surprise me that they considered a version bump from 7.0.8 to 7.3.3 to be innocent looking.

In fact, these 'minor' releases actually appear to be quite significant and the issue in question in TFA was explicitly documented. [0][1]

I hate to say it but this was just a case of sloppy work on the startup's part. It took me less than 5 minutes to find that info.

[0] https://docs.mongodb.com/mongoid/current/tutorials/mongoid-u... [1] https://github.com/mongodb/mongoid/releases/tag/v7.1.0

Re: A routine gem update ended up creating $73k worth of subscriptions

#245
post #234

Earlier quoted context omitted.

> This type of library API breaking change on a minor version update basically never happens. Literally happens all the time with Rails. To the point they decided to call their versioning schema “shifted semver” to afford themselves API changes on minor versions: https://guides.rubyonrails.org/maintenance_policy.html Good luck if you are using Rails and ecosystem and you expect any sort of sensible versioning.

Rails committer here. First I get that people are used to SemVer, but it is unreasonable to assume all projects follow it. And yes in semver terms, you can simply assume that Rails X.Y is a major release. Then, any breaking change in Rails must first emit deprecation warnings, so unless you are jumping one version, this kind of scenario shouldn't happen with Rails itself. Also note that Ruby (MRI) itself more or less…

That’s precisely my point. With Rails and Ruby breaking APIs on every new minor release, the only realistic expectation is that every minor release of anything may have breaking changes, because that’s the example being set. And it just makes the experience of updating any Rails project even worse than it already is.

The language and framework, by your own statement, are pushing breaking changes at a yearly rate. That’s a horrible developer experience.

Re: A routine gem update ended up creating $73k worth of subscriptions

#246

Earlier quoted context omitted.

Yeah, semver is great, except nobody follows it. The amount of times I have updated minor or even patch releases of packages with things breaking--I have pretty much determined everything in a project stays the same unless there's some pressing need. The worst part is that breakage is often far from obvious, and spending good time wondering why everything breaks when it shouldn't is really really infuriating and make…

When you say “breaking” in that comment are you talking about backwards compatible API changes, or straight up bugs? It kinda sounds like you’re talking about the latter, which of course isn’t within the scope of semver.

That's actually something that is in the author's purview to decide.

(Edit: whoops, I misread you. I thought you were saying APIs are not in scope for SemVer. Now I think I realized you meant, you can have bugs that break things and that's not related to semver.)

Is the semver contract with respect to the end user activities or the API? For Flux and Helm for example, the APIs are supported with semver code (and the interfaces use Kubernetes API versioning)

In Helm, the CLI and user activities are explicitly not part of the semver contract as I understand it, only the API (at least with respect to experimental features like OCI charts for now?)

Re: A routine gem update ended up creating $73k worth of subscriptions

#248
post #6

Mongoid docs[1] seem to be pretty cool about this change: "As of Mongoid 7.1, logical operators (and, or, nor and not) have been changed to have the the same semantics as those of ActiveRecord. To obtain the semantics of or as it behaved in Mongoid 7.0 and earlier, use any_of which is described below." Is it just me or is this one of the most terrible breaking changes in a popular, official library ever? [1] https://…

[deleted]

Re: A routine gem update ended up creating $73k worth of subscriptions

#249
post #234

Earlier quoted context omitted.

Rails committer here. First I get that people are used to SemVer, but it is unreasonable to assume all projects follow it. And yes in semver terms, you can simply assume that Rails X.Y is a major release. Then, any breaking change in Rails must first emit deprecation warnings, so unless you are jumping one version, this kind of scenario shouldn't happen with Rails itself. Also note that Ruby (MRI) itself more or less…

That’s precisely my point. With Rails and Ruby breaking APIs on every new minor release, the only realistic expectation is that every minor release of anything may have breaking changes, because that’s the example being set. And it just makes the experience of updating any Rails project even worse than it already is. The language and framework, by your own statement, are pushing breaking changes at a yearly rate. Tha…

No the expectation is that users of projects stop assuming SemVer is followed by every projects.

> pushing breaking changes at a yearly rate. That’s a horrible developer experience.

That's your opinion. I much prefer these bite sized yearly changes to much bigger changes over longer periods. e.g. Ruby with this strategy never had the big divide Python 3 had with its much larger change.

Re: A routine gem update ended up creating $73k worth of subscriptions

#250

Earlier quoted context omitted.

If Postgres feels too heavy, don't worry! Just use SQLite, and swap in Postgres later once you need to.

I guess this is a Rails thing where people treat the db as a just dumb store.

I think I've used Rails seriously only once or twice in my professional life but yeah, mostly treat data-stores as just dumb stores in most projects, unless it has some special requirements.
Post reply on HN