Can the link be updated to the one below? The link above goes directly to the comments section and collapses the article, ?comments=1 is the culprit. https://arstechnica.com/gadgets/2021/07/google-pushed-a-one-...
Fixed now. Thanks!
Google broke a conditional statement that verifies passwords on Chrome OS
11–20 of 276 posts
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#12Wait so are the devices bricked or not? The title says bricked but as far as I can tell people just can't log in temporarily until the fix is rolled out.
Ok, we've done our bit to counter brick dilution in the title above.
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#13If you've been in tech for a while, this is one of those things that makes you sigh and shake your fist at "move fast and break stuff" as a strategy.
That's more about challenging the status quo not bad project management.
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#14I bet the post-mortem for this is going to be fun. How this wasn't covered by multiple unit tests, a code review and a roll out strategy is.... impressive.
Bitwise & versus logical && is a classic, right up there with an assignment in a comparison (when an equality check is intended), = for ==. That this was missed is pretty surprising, given that it's Google and the stakes involved in the encryption/key management code in a secure platform device. I wonder if we'll even get a postmortem, as this simply cannot happen unless several someones all Seriously Fucked Up simul…
Straight up negligence.
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#15I bet the post-mortem for this is going to be fun. How this wasn't covered by multiple unit tests, a code review and a roll out strategy is.... impressive.
Bitwise & versus logical && is a classic, right up there with an assignment in a comparison (when an equality check is intended), = for ==. That this was missed is pretty surprising, given that it's Google and the stakes involved in the encryption/key management code in a secure platform device. I wonder if we'll even get a postmortem, as this simply cannot happen unless several someones all Seriously Fucked Up simul…
Especially since it's so easy to lint for. This isn't some cross-file memory mishandling bug, it's a single token that's being used where it shouldn't be
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#16Couldn't this be caused by a bad merge?
Not sure how Google manages their merging and release process but there are conceivably several stages where a bad merge can occur and go unnoticed - possibly at a stage close to release and after testing.
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#17From the article:
> The line should read "if (key_data_.has_value() && !key_data_->label().empty()) {" but instead of "&&"—the C++ version of the "AND" operator—the bad update used a single ampersand, breaking the second half of the conditional statement.
Someone correct me if I'm wrong, but this seems like it wouldn't be possible in a language that didn't conflate boolean values with bitvectors.
Edit: I was wrong[1].
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#18I bet the post-mortem for this is going to be fun. How this wasn't covered by multiple unit tests, a code review and a roll out strategy is.... impressive.
Bitwise & versus logical && is a classic, right up there with an assignment in a comparison (when an equality check is intended), = for ==. That this was missed is pretty surprising, given that it's Google and the stakes involved in the encryption/key management code in a secure platform device. I wonder if we'll even get a postmortem, as this simply cannot happen unless several someones all Seriously Fucked Up simul…
> Heads should probably roll here,
I disagree. It's obviously a major balls up by multiple people, but at the end of the day this is an organizational failure. You don't fire people for this, you learn from it and fix the organizational holes that caused it.
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#19The reason this happened is that it wasn't followed by "Google hit by 143 defective product lawsuits".
Re: Google broke a conditional statement that verifies passwords on Chrome OS
#20Earlier quoted context omitted.
Bitwise & versus logical && is a classic, right up there with an assignment in a comparison (when an equality check is intended), = for ==. That this was missed is pretty surprising, given that it's Google and the stakes involved in the encryption/key management code in a secure platform device. I wonder if we'll even get a postmortem, as this simply cannot happen unless several someones all Seriously Fucked Up simul…
> Heads should probably roll here, I disagree. It's obviously a major balls up by multiple people, but at the end of the day this is an organizational failure. You don't fire people for this, you learn from it and fix the organizational holes that caused it.
Someone is responsible for the organizational units and their processes.
By that logic, almost no individual failure is a firing offense. Many people in the organization are responsible for ensuring that the processes themselves overlap in ways that exclude the possibility of failures like this.
I'm talking about the meta-failure in management's oversight of the processes. There is belt person, and there is suspenders person, and there is a third person who makes sure there are both belt person and suspenders person on staff and that they don't go on vacation at the same time.
Somewhere above the team lead and below the CEO there is someone who didn't do their job.