A routine gem update ended up creating $73k worth of subscriptions • Hacker News Board

Re: A routine gem update ended up creating $73k worth of subscriptions

#161

Post by lordgroff » Sat, Jan 08, 2022, 4:53 AM UTC

sofixa wrote: post #150

lordgroff wrote: post #116

Earlier quoted context omitted.

Yeah, semver is great, except nobody follows it. The amount of times I have updated minor or even patch releases of packages with things breaking--I have pretty much determined everything in a project stays the same unless there's some pressing need. The worst part is that breakage is often far from obvious, and spending good time wondering why everything breaks when it shouldn't is really really infuriating and make…

> I have pretty much determined everything in a project stays the same unless there's some pressing need Unless you have a way to stay up to date with the security of each and every dependency you have, that seems dangerous. There are static security scanners out there which can parse your dependency tree and alert you, but often they have a high noise ratio ( e.g. npm audit), so that only helps so much.

Application is airgapped, so it's not as dangerous as it sounds.

Re: A routine gem update ended up creating $73k worth of subscriptions

#162

Post by lordgroff » Sat, Jan 08, 2022, 4:59 AM UTC

lamontcg wrote: post #121

lordgroff wrote: post #116

Earlier quoted context omitted.

Yeah, semver is great, except nobody follows it. The amount of times I have updated minor or even patch releases of packages with things breaking--I have pretty much determined everything in a project stays the same unless there's some pressing need. The worst part is that breakage is often far from obvious, and spending good time wondering why everything breaks when it shouldn't is really really infuriating and make…

A big part of the problem with SemVer is that "breaking changes" is subjective and there's always the xkcd spacebar heating problem. The flip side of most breaking changes that are released is some software developer who either wasn't experienced enough to imagine that the change would break someone or else they're dealing with a very hard problem that they're trying to solve and the break change was collateral damag…

Here's a recent example from sqlalchemy. I'm using a type annotation.

Update to new minor version. BAM, annotation no longer works, the classes have moved around and I'm staring at an ugly exception. To be clear: these were not private modules, methods, what have you. So we're not talking about the space bar issue here, it wasn't some undocumented or buggy behavior, things just stopped working as the API got shuffled around. At that point this was literally the third semver breakage in the same month, and yeah, this is unusual, but dependencies have stayed fixed since then, it's a headache and it makes me feel like everything is just built on a pile of shifting sand.

Re: A routine gem update ended up creating $73k worth of subscriptions

#163

Post by emptysea » Sat, Jan 08, 2022, 4:59 AM UTC

mchusma wrote: post #95

Stripe also bears some responsibility here, as they don't support production testing, so it's impossible to have a test suite checking for charge related behaviors in production. If you use stripe, please contact them and request this long overdue feature. (I do not think that is the primary issue, but it does not help)

Why doesn’t test mode work for testing?

Re: A routine gem update ended up creating $73k worth of subscriptions

#164

Post by JimDabell » Sat, Jan 08, 2022, 5:05 AM UTC

thaumasiotes wrote: post #79

munificent wrote: post #32

Earlier quoted context omitted.

I'm guessing the sentence they wrote is just a consequence of English not being the author's primary language. I frequently see ESL speakers get adjective and adverb positions wrong in ways that unintentially change the meaning. Even skilled English speakers make mistakes here because English is both very permissive about word order, but also tends to give different shades of meaning to each other. "Only" is a pernic…

> When I got my last book copyedited, fixing the location of "only" was one of the most common changes. I remember a puzzle which presented a (fairly long) sentence and asked "provide a word that can be correctly inserted at any point in this sentence". The answer was "only". (Of course the meaning would change according to where the "only" was placed, but still... you'd have a hard time inserting "experience" at eve…

In case anybody is wondering, the sentence normally given as an example of this is “She told him that she loved him”. You can put the word “only” anywhere in that sentence and each position makes the sentence mean something different.

Re: A routine gem update ended up creating $73k worth of subscriptions

#165

Post by eknkc » Sat, Jan 08, 2022, 5:12 AM UTC

denotational wrote: post #28

> Our app for some reasons was creating new subscriptions from old accounts that was canceled or disabled a long time ago. If I cancel or disable my account for a service I don't expect them to be able to charge me money in the first place! Are they keeping card authorisations (or direct debit mandates, or whatever other mechanism) for customers that don't even have an account with them any more? That sounds like an.…

If I delete an account yes but if I simply unsubscribe from a paid service I actually expect them to store any billing info in case I want to resubscribe. Should be a single click operation.

Re: A routine gem update ended up creating $73k worth of subscriptions

#166

Post by tdiff » Sat, Jan 08, 2022, 5:13 AM UTC

Without trying to defend authors of Mongoid for a breaking change, if you have deployed into prod something you obviously have not tested, you are the only one to blame.

To me this post is more about lack of due process in Serpapi itself.

Re: A routine gem update ended up creating $73k worth of subscriptions

#167

Post by JimDabell » Sat, Jan 08, 2022, 5:19 AM UTC

easrng wrote: post #75

mushufasa wrote: post #18

Of note -- their company services seem to be that you pay them to return you Google search results via API. Isn't that against the Google search Terms of Service??? If google wanted there to be a paid search api, I'm pretty sure they would just provide one. Also, I'm pretty sure I've seen these types of startups before, and then they vanish quickly thereafter....

> If google wanted there to be a paid search api, I'm pretty sure they would just provide one. They do[0]. It's not as complete though. [0]: https://developers.google.com/custom-search/v1/introduction

That’s not really the same thing. It’s intended to search a manually-specified site or collection of sites, not the whole web. It’s basically a Google Site Search API, not a Google Search API.

Re: A routine gem update ended up creating $73k worth of subscriptions

#168

Post by csours » Sat, Jan 08, 2022, 5:24 AM UTC

Code this tightly coupled makes me itchy.

Re: A routine gem update ended up creating $73k worth of subscriptions

#169

Post by kevin_thibedeau » Sat, Jan 08, 2022, 5:29 AM UTC

booleanbetrayal wrote: post #83

cirrus3 wrote: post #65

Earlier quoted context omitted.

It is... but it is also a result of a library changing the meaning of "or". This is next-level breaking change that is beyond what I'd even call a "change".

It was fully documented and ActiveRecord has done similar things in the past. See also: https://til.hashrocket.com/posts/3zyftipjiu-rails-will-chang...

... on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying "Beware of the Leopard".

Re: A routine gem update ended up creating $73k worth of subscriptions

#170

Post by dudeinjapan » Sat, Jan 08, 2022, 5:31 AM UTC

Wow, it's funny. I'm a regular contributor to Mongoid, and just I was thinking what a bad/unnecessary change this "or" thing was. And then I saw this article!