Live data from Hacker News

I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

kalzumeus.com

71–80 of 80 posts

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#71
post #66

Earlier quoted context omitted.

As a physicist, I really want to argue with that statement. In particular, computer hardware operates (by design) as far as possible from any regimes where the laws of physics are well and truly complicated. A tokamak fusion reactor, by contrast, although it breaks down into orders of magnitude fewer logical parts, contains a big blob of monolithic, continuous complexity, namely the plasma itself and all its associat…

Is this actually the case though? Isn't the physics of CPU design (quantum tunneling etc) just as complicated as that of a fusion reactor (or arguably more so?) If you meant that the behavior of the plasma itself is complex from the mathematical point of view.. yes, that is true. But it _is_ modeled (along with nuclear explosions) on one of those computer thing you physics type sell short. :P

Oh, solid state physics is plenty complicated. But in the regime where computers operate, you can successfully model the chip as a bunch of discrete signals and NAND gates and shit (ignorance showing through here).

And, yes, I swept computational physics under the rug. Ironic, really, because that's my niche.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#72
post #56

And that's why you should always have great analytics. Monitoring is what found a similarly subtle bug at my past job once. In the later afternoon a marketing guy on the traffic team came over and told me there was a problem with our trial signups. They'd dropped ~7% today for no apparently reason. We looked at the charts and today, for most of the day, compared to many other days and the past week there was indeed a…

You shouldn't redirect for assets that dont exist, even if you do for pages...

You're correct. The immediate fix was to just upload the font but the long-term fix was as you pointed out.

At first we would only treat urls with certain file types (jpg, png, mp4, etc) as files when found on the server, the rest as pages and we switched from a whitelist of file types to anything that had an asset directory path in the url. Our original htaccess rules were definitely deficient. The idea was that we wanted tracking pixels and the like to be able to run code.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#73
post #56

And that's why you should always have great analytics. Monitoring is what found a similarly subtle bug at my past job once. In the later afternoon a marketing guy on the traffic team came over and told me there was a problem with our trial signups. They'd dropped ~7% today for no apparently reason. We looked at the charts and today, for most of the day, compared to many other days and the past week there was indeed a…

You shouldn't redirect for assets that dont exist, even if you do for pages...

you shouldn't redirect for pages either, 404s exist for a reason....

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#74
post #62

Wow. Had a very similar CSRF problem once. Customer complained they were getting page expired errors constantly. But only one customer and only with Safari, not Firefox. Turned out they were using an RSS reader on OS X that shared the system cookie jar with Safari. Every ten minutes it would log in with a password and get a new session cookie. Safari would then use the new session cookie which didn't match the CSRF f…

How did you resolve the problem?

I'd probably check to see if they had a valid login already and not update the cookie. Not sure if that opens up other holes though.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#75
post #35
post #32

"If my users are inconvenienced, it is my fault, always." Good quote. I had a customer become irate with me before over untracked sales in my digital delivery product. I knew that the error stemmed from their web designer using their own button code and not our specially crafted button code, and I tried to help them fix it but only upset them more. Its hard to take responsibility for things seemingly outside your con…

Perhaps you should have constructed an API, and tell them "This is what your code should abide to", instead of just giving them code for the button. That is: abstract the spec away from the actual code. If closer inspection shows that their code isn't following the spec, you've earned the right for some serious fingerpointing.

This is a good point. In my case, it was as simple as a PayPal button with an extra variable to track a product ID... pretty mundane. However, a feature to "check" (scrape) their button and ensure it is proper is probably in order.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#77

Earlier quoted context omitted.

You shouldn't redirect for assets that dont exist, even if you do for pages...

you shouldn't redirect for pages either, 404s exist for a reason....

Sigh, I know, but non-technical product managers can be very adamant about certain things. =(

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#78
post #44
post #37

Earlier quoted context omitted.

This is very much not the cultural norm over in these parts. I'd be curious to hear your reason as to why you think that. (Genuinely curious, not passive-aggressive "curious.") Particularly with specific regards to engineering, even things which are theoretically not within our control (e.g. the server going down because a technician tripped over the cable) are often inside our ability to affect (by picking a better…

I can respond to his comment from my own perspective. With my own customers, I have a policy of accepting blame for everything and always working to fix pretty much anything. This, semi-regularly, results in customers who notice this policy and take advantage of it. You end up in a situation where you either have to piss off a customer or do mountains of work that have nothing to do with the scope of your product sim…

GBScripts?

Now we know where to go to get more then we pay for!

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#79
post #62

Wow. Had a very similar CSRF problem once. Customer complained they were getting page expired errors constantly. But only one customer and only with Safari, not Firefox. Turned out they were using an RSS reader on OS X that shared the system cookie jar with Safari. Every ten minutes it would log in with a password and get a new session cookie. Safari would then use the new session cookie which didn't match the CSRF f…

How did you resolve the problem?

We made the CSRF depend only on the user ID, which doesn't change, instead of the session ID.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#80
post #44

Earlier quoted context omitted.

I can respond to his comment from my own perspective. With my own customers, I have a policy of accepting blame for everything and always working to fix pretty much anything. This, semi-regularly, results in customers who notice this policy and take advantage of it. You end up in a situation where you either have to piss off a customer or do mountains of work that have nothing to do with the scope of your product sim…

GBScripts? Now we know where to go to get more then we pay for!

No, that isn't the business I was referring to. Those are usually pretty open and shut projects -- and I don't do many of them anymore. Thanks for the Internet sleuthing though.
Post reply on HN