All the code I wrote.
Ask HN: What horrifying and/or terrible things have you seen in production code?
11–20 of 20 posts
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#12A function that consisted of a giant switch statement, with each case consisting of another switch statement. Half of the sub-cases contained GOTO statements back to the top of the function.
Even worse... I wrote the code. It was 2am, I had been working for 18 hours straight to get everything ready for a demo the next morning.
Even worse than that... the code worked so management wouldn't let me change it. I tried my best to find an edge case it wouldn't handle but never could. So the code shipped.
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#13In a video game company, something like (it was in Action Script, I don't remember the exact syntax of that language):
public class ScoreManager {
//some statements
public void updateScore(Action action) {
int n = action.entityDestroyed;
if n EDIT: typos
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#14A function that consisted of a giant switch statement, with each case consisting of another switch statement. Half of the sub-cases contained GOTO statements back to the top of the function. Even worse... I wrote the code. It was 2am, I had been working for 18 hours straight to get everything ready for a demo the next morning. Even worse than that... the code worked so management wouldn't let me change it. I tried my…
If that's the worst, that's not too bad - I mean, it's ugly, but apparently it works well. ;-)
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#15It was 2005, I had to execute an Oracle function from c#. The PL/SQL programmer that created the package/function told me that the function will return a single string.
The returned string had the info a customer concatenated, like this:
Pete McDonald 5519500303
The indexes from 0 to 9 will contain the name (please trim the trailing spaces)
The indexes from 10 to 19 will contain the last name (same, please trim)
20 to 21 will contain the age of the customer
the rest of the string contains the customer's birthday
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#16I used to do quite a bit of troubleshooting/rescuing half finished projects, or live things that had no developer involved for one reason or another. Not that many years ago I was still seeing people storing credit card numbers in plain text files on servers, and sending them unencrypted via email.
> Not that many years ago I was still seeing people storing
> credit card numbers in plain text files on servers, and
> sending them unencrypted via email.
I've seen it in the last week. I work for an ESP, and have to continually tell customers "just because you can store CCs (or SSNs, or private account #s, etc) in our database, there's never a good reason why you should" and "PCI? Heard of it?".
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#17* Horrible duplicate code. * Functions with more than 200 lines. * Functions with about 16 parameters. * A deploy process that consisted of copy and pasting using FTP. * No source code control. Not even regular file backups, the 'code' was just on production and everybody worked against that. * If else cases in the double digits.
Ugh.
> Functions with about 16 parameters.
I am reminded of a talk by Kevlin Henney [1]. He mentions this quote from Alan Perlis: "If you have a procedure with ten parameters, you probably missed some." [2]. Kevlin goes on to give anecdotes about code he has encountered or heard stories about while consulting / teaching - the record was a function with around 370 parameters, and that function was still growing.
I'd prefer to see a function with a dozen arguments than a "function" that takes no arguments, returns void, and secretly communicates using global state. Explicit horror beats surprise horror.
[1] http://www.infoq.com/presentations/architecture-uncertainty-... [2] http://www.cs.yale.edu/homes/perlis-alan/quotes.html
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#18I've seen many things in my 10+ years of coding, Here are some favourites: * No authentication check on any page after login page. (You could type in any URL in browser address bar and gain access). * GET request updating home page related content in database. (A few of these GET request was picked up by Alexa bot and we hard our home page content change randomly for many days. We had a real hard time troubleshooting…
> Unit testing applied to a highly monolithic code
Do you (or indeed anyone else reading) have suggestions for getting other forms of testing in place around legacy monolithic code?
Perhaps this is a fairly ill-posed question without more context.
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#19I've seen many things in my 10+ years of coding, Here are some favourites: * No authentication check on any page after login page. (You could type in any URL in browser address bar and gain access). * GET request updating home page related content in database. (A few of these GET request was picked up by Alexa bot and we hard our home page content change randomly for many days. We had a real hard time troubleshooting…
> Unit testing applied to a highly monolithic code Do you (or indeed anyone else reading) have suggestions for getting other forms of testing in place around legacy monolithic code? Perhaps this is a fairly ill-posed question without more context.
You can still do Integration Testing with the system as a whole, although it is supposed to be done after Unit Testing. The disadvantage due to absence of Unit Testing will be that it will be difficult it isolate bugs found during Integration Testing. For websites, we use Selenium all the time.
Re: Ask HN: What horrifying and/or terrible things have you seen in production code?
#20I've seen many things in my 10+ years of coding, Here are some favourites: * No authentication check on any page after login page. (You could type in any URL in browser address bar and gain access). * GET request updating home page related content in database. (A few of these GET request was picked up by Alexa bot and we hard our home page content change randomly for many days. We had a real hard time troubleshooting…
I have seen some similar code. After authentication, a parameter was passed into the URL. Basically, if you had that token, you were logged in. Some user posted a link to their page on some site and included that token.
Later, the user complained about all of their photos constantly being deleted.
Photo deletes were GET-based and did not have no-follow. Google eventually indexed their logged-in link and was happily deleting all of their photos daily.
Fun times tracking that one down. (It was a code base that I inherited.)