"shell=True"? Sloppy, mate, sloppy. Get in the habit of never doing that lest you find yourself vulnerable to a shell command injection attack one day.
I Made a Self-Quoting Tweet
111–120 of 145 posts
Re: I Made a Self-Quoting Tweet
#112Earlier quoted context omitted.
TIL: debugging via memory dumps is a Principal Engineer level skill. Anyone here actually do this? I read about it in Release It and it sounds by far like the closest thing there is to a super power when it comes to solving production incidents. I've never actually seen anyone do it though. Recently saw a video on this technique from Dotnet Conf. Piqued my curiosity again, and now this. I've really gotta learn this.
How else do you debug C/C++ programs that crash?
By having a crash harness in the program that dumps the call stack and relevant internal context. Coredumps are really an option of last resort.
Re: I Made a Self-Quoting Tweet
#113Earlier quoted context omitted.
One of the replies is an engineer at Twitter, who confirmed that someone managed to achieve this 7 years ago and it caused issues in the backend.
It’d be a simple check that anything referenced has to have a lower ID (and hence time stamp). I find this bug more interesting: > Also, it seems like Twitter doesn't actually care about the username and just resolves URLs based on the tweet ID. I'm sure lots of people already knew that but it's new to me. They’re not validating the parent directory matches the actual tweet. I wonder if that’s an actual bug or intent…
Can’t be unintentional, else they can’t keep up with users changing IDs.
Re: I Made a Self-Quoting Tweet
#114This reminds me of when we were counting collisions in tweet IDs years ago at my old job (social media agency). We used the collision rate to estimate the total volume of tweets going through the system.
We also determined ID assignment was determined by three servers in a round robin load balancer and load was distributed based on modding of a 32 bit integer, so two servers were getting more load than the other since you can’t evenly divide a 32 bit integer by 3. They fixed that bug after a couple months of observation. I forget if we let Twitter know or not.
I love stuff like this.
Re: I Made a Self-Quoting Tweet
#115I'm pretty impressed that it took less than 1000 attempts. It would still be feasible even it were several orders of magnitude harder. This twitter project I made (predicting celebrity deaths) took about 250k tweets over the course of a few months: https://twitter.com/ghastly_omens
This is great! That's not 250k tweets per death, right? Did you do the classic make a lot of predictions then delete the wrong ones? How did you select the celebrities?
Would be interesting to do something with actuarial tables here.
Re: I Made a Self-Quoting Tweet
#116Earlier quoted context omitted.
How else do you debug C/C++ programs that crash?
By having a crash harness in the program that dumps the call stack and relevant internal context. Coredumps are really an option of last resort.
WTF? If you already have the infrastructure to coredump, they are without a doubt the most convenient way to debug. A stacktrace does not even begin to compare. It is like limiting yourself to printf-debugging in the presence of gdb.
Actually, it exactly is! Now I'm not sure if you were /s or not.
Re: I Made a Self-Quoting Tweet
#117Earlier quoted context omitted.
One of the replies is an engineer at Twitter, who confirmed that someone managed to achieve this 7 years ago and it caused issues in the backend.
It’d be a simple check that anything referenced has to have a lower ID (and hence time stamp). I find this bug more interesting: > Also, it seems like Twitter doesn't actually care about the username and just resolves URLs based on the tweet ID. I'm sure lots of people already knew that but it's new to me. They’re not validating the parent directory matches the actual tweet. I wonder if that’s an actual bug or intent…
This bug actually has some security implications because you can make it seem as though an account has tweeted something when really it was another one. A casual observer might not notice the discrepancy between the name before and after the click.
Re: I Made a Self-Quoting Tweet
#118Earlier quoted context omitted.
TIL: debugging via memory dumps is a Principal Engineer level skill. Anyone here actually do this? I read about it in Release It and it sounds by far like the closest thing there is to a super power when it comes to solving production incidents. I've never actually seen anyone do it though. Recently saw a video on this technique from Dotnet Conf. Piqued my curiosity again, and now this. I've really gotta learn this.
I have done it once successfully in 10 years (.NET dev). Would recommend having any other kind of logging or instrumentation in place so you don't have to do it. It's still worth learning WinDbg and sosclr.
In my company, we used to have a plugin for our bug tracker to automatically analyze .NET core dumps with WinDbg (if they were attached to a bug) and extract some useful information. We used to do this relatively often, for a shipped product, not a live service, especially if we found memory leaks.
Re: I Made a Self-Quoting Tweet
#119I'm pretty impressed that it took less than 1000 attempts. It would still be feasible even it were several orders of magnitude harder. This twitter project I made (predicting celebrity deaths) took about 250k tweets over the course of a few months: https://twitter.com/ghastly_omens
This is great! That's not 250k tweets per death, right? Did you do the classic make a lot of predictions then delete the wrong ones? How did you select the celebrities? Would be interesting to do something with actuarial tables here.
Yes, delete the misses. 250k total. About 700 celebrities. I was predicted the day of death too, so each required 365 tweets. I did a combination of scraping IMBD + manual selection plus filling in the details. The whole process could probably be automated and I regret not doing that. It would be wild to see this in 2020...
I did consult actuarial tables mainly to decide how many of each age to include. With that few candidates, it wasn't wise to focus on people in their 20s and 30s obviously because it's very likely all of them would have survived.
A few more details here: http://jere.in/i-predicted-23-celebrity-deaths-in-2017-then-...
Re: I Made a Self-Quoting Tweet
#120Earlier quoted context omitted.
By having a crash harness in the program that dumps the call stack and relevant internal context. Coredumps are really an option of last resort.
WTF? If you already have the infrastructure to coredump, they are without a doubt the most convenient way to debug. A stacktrace does not even begin to compare. It is like limiting yourself to printf-debugging in the presence of gdb. Actually, it exactly is! Now I'm not sure if you were /s or not.
It all depends on how tangled your spaghetti are.
For the code that implements basic state and invariant checks (ie ships with asserts compiled in), crashes are usually exceedingly rare and limited to one of these checks failing. Debugging them requires a stack trace and, optionally, some context related to the check itself. If the program dumps this info on crash, the fix can typically be made in less time it takes to retrieve/receive the coredump and start looking at it. If it can't be fixed this way, then it's to the coredump we go.
On the other hand if the code is prone to segfaulting on a whim, requiring dissecting its state to trace the cause down, then, yeah, it's a coredump case too. But a code like that shouldn't be running in production to begin with.
So that's, roughly, what the F is.