181–190 of 517 posts
"developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made."
Ta-da, Klarna.
I m sure it s not random but somehow systematic
Does Klarna still do the IQ test as part of their hiring process?
tangential thought, but related: I am, in general, a proponent of nuclear energy as a green alternative to whatever the hell we are doing today. But when I see such stories that humans manage to fuck up simple payment processing apps, still make errors while maintaining bridges, still manage to do hugely negligent screw-ups (most likely corrupt) in *cable cars maintenance*, I immediately think that it is imminent, th…
His assumption is surely, "Relax, what's going to happen, the cable won't break!".
I'm imagining it was a case of an SQL-based password check where "TRUE OR" got added to the WHERE clause, and the code takes the first result instead of expecting only 0 or 1 row.
Are there other easy ways to do this?
Junior dev was facing a dilemma. Before pushing to production please finish this code and choose the id you want to use: "select * from users where id = ?" > user_id > profile_id > user_profile_id > profile_user_id > id > rand()
I don't think it's nice to make fun of beginners in our industry.
Does Klarna still do the IQ test as part of their hiring process?
What are the ways you can implement "log in as anyone accidentally"? I'm imagining it was a case of an SQL-based password check where "TRUE OR" got added to the WHERE clause, and the code takes the first result instead of expecting only 0 or 1 row. Are there other easy ways to do this?
This points in the direction of this being a caching bug; you request your homepage, and get the homepage of whichever user was placed in the cache last.
Most of the time in these situations it's not an application-code issue (per-se), as much as a "shared global state" issue.
Earlier quoted context omitted.
I once got a credit card statement that told me I would be able to pay off my credit card in 100,000 years. It was discouraging.
Once a colleague made an accounting error and it showed that we're in debt something like 100 million.... I told him to stay calm and relax, we don't have that kind of money so why worry :)
Interesting that all the screenshots have a (typically) female name, and the reporter seems female. Could be chance of course, but a quite low likelihood if the sampling is truly random... Can’t help thinking what kind of bug could cause that. :)
If you're assuming their user base is 50/50 male/female, which for many apps is not a valid assumption.
If I remember how to do math correctly, 50/50 gives 5 random users all being female ~4%. And 80/20 split is closer to 40%.