@patio11, minor editorial note I thought I should point out: the link to the Rails 2.3.10 source is broken (it links to back to the blog post itself).
I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
41–50 of 80 posts
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#42While reading this article, it reminded me of an odd bug I encountered working with the Nitrogen Web Framework. I was finding that, similar to Patrick, it was losing sessions (though much more consistently), but only in Chrome and only with Yaws as the webserver. Switching to the Mochiweb server or Firefox caused the problem to go away. Firebug and Chrome's dev tools both reliably stated that the cookie header was in…
Also (unrelated), My favorite quote from the article: "Race conditions are why sane programmers don’t program with threads or, if they do, they use shared-nothing architecture and pass all communication between the threads through a message queue written by someone who knows what they are doing (if you have to ask, it isn’t you — seriously, multithreaded programming is hard)." Sounds like an advertisement for Erlang…
Or Go. Though unlike Erlang processes, Go doesn't make mutating shared memory in multiple threads impossible. Go just makes it really easy to never do it.
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#43While reading this article, it reminded me of an odd bug I encountered working with the Nitrogen Web Framework. I was finding that, similar to Patrick, it was losing sessions (though much more consistently), but only in Chrome and only with Yaws as the webserver. Switching to the Mochiweb server or Firefox caused the problem to go away. Firebug and Chrome's dev tools both reliably stated that the cookie header was in…
Also (unrelated), My favorite quote from the article: "Race conditions are why sane programmers don’t program with threads or, if they do, they use shared-nothing architecture and pass all communication between the threads through a message queue written by someone who knows what they are doing (if you have to ask, it isn’t you — seriously, multithreaded programming is hard)." Sounds like an advertisement for Erlang…
You can absolutely have race conditions in Erlang, along with deadlocks too.
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#44Earlier quoted context omitted.
Habitually taking responsibility for things outside your control is probably a bad thing though.
This is very much not the cultural norm over in these parts. I'd be curious to hear your reason as to why you think that. (Genuinely curious, not passive-aggressive "curious.") Particularly with specific regards to engineering, even things which are theoretically not within our control (e.g. the server going down because a technician tripped over the cable) are often inside our ability to affect (by picking a better…
I can respond to his comment from my own perspective. With my own customers, I have a policy of accepting blame for everything and always working to fix pretty much anything.
This, semi-regularly, results in customers who notice this policy and take advantage of it. You end up in a situation where you either have to piss off a customer or do mountains of work that have nothing to do with the scope of your product simply because the customer is convinced its your fault (or he's a dink that knows if he pretends its your fault, he'll get something out of you).
My biggest falling is that. And unfortunately, I feel that the customers who are like that, are also the ones who make the biggest noise. I'm in a relatively sensitive industry where my customers tend to be doing a lot of research before picking my product, so I can't afford to have any bad noise floating around.
Just an anecdote/personal vent very related to the discussion.
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#45Earlier quoted context omitted.
This is very much not the cultural norm over in these parts. I'd be curious to hear your reason as to why you think that. (Genuinely curious, not passive-aggressive "curious.") Particularly with specific regards to engineering, even things which are theoretically not within our control (e.g. the server going down because a technician tripped over the cable) are often inside our ability to affect (by picking a better…
The bad kinds of stress - the kinds that wear on a person and cause burnout - are often caused by people worrying about things they can't control.
"It's all personal, every bit of business. . . . If a bolt of lightning his a friend of his the old man would take it personal. . . . That's what makes him great. The Great Don. He takes everything personal. Like God. He know every feather that falls from the tail of a sparrow or however the hell it goes. Right? And you know something? Accidents don't happen to people who take accidents as a personal insult." -- Michael Corleone
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#46"Whereupon I learned that Rails 2.3.11 changed the behavior of CSRF protection: instead of throwing exceptions, it would silently just clear the session and re-run the request. For most sensitive operations (e.g. those which require a signed in user), this would force a signout and then any potentially damaging operation would be averted." Doesn't this change a CSRF attempt into a DoS? I don't understand the logic be…
It seems like it would.
The security advisory made it seem like the way they were returning an error was inadequate - perhaps there was an insecurity with cookie stuff being sent back?
But yeah, this seems like too big a hammer to fix that problem...
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#47Can somebody post the tldr?
From the first sentence: This post will not help you sell more software. If you’re not fascinated by the inner workings of complex systems, go do something more important. If you are, grab some popcorn, because this is the best bug I’ve seen in years. There's no real point in summarizing further. It's like asking someone to summarize Hamlet for you [1] because you'd rather not sit through all that acting and dialogue…
"Cesarean section results in regicide, 30 years later."
"Rebellious teenagers escape parental control."
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#48Earlier quoted context omitted.
Also (unrelated), My favorite quote from the article: "Race conditions are why sane programmers don’t program with threads or, if they do, they use shared-nothing architecture and pass all communication between the threads through a message queue written by someone who knows what they are doing (if you have to ask, it isn’t you — seriously, multithreaded programming is hard)." Sounds like an advertisement for Erlang…
Or Go. Though unlike Erlang processes, Go doesn't make mutating shared memory in multiple threads impossible. Go just makes it really easy to never do it.
Or haskell with STM.
Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone
#49Can somebody post the tldr?
tl;dr is a blight upon society