Live data from Hacker News

A routine gem update ended up creating $73k worth of subscriptions

serpapi.com

31–40 of 336 posts

Re: A routine gem update ended up creating $73k worth of subscriptions

#32

That sounds like a major, incredibly dangerous update to the DB driver. Their 7.1, 7.2, 7.3 versions seem to all have breaking changes [1]. Yet they are in obvious violation of SemVer expectations, which they declare to follow [2]: > Mongoid follows versioning guidelines as outlined by the Semantic Versioning Specification, so you can expect only backwards incompatible changes in major versions [sic] [1] https://docs…

> Mongoid follows versioning guidelines as outlined by the Semantic Versioning Specification, so you can expect only backwards incompatible changes in major versions I will note that this reverses the direction of implications. In SemVer, you should expect breaking changes only in major versions. (All version changes with breaking changes should be major, but nonbreaking changes can occur in major or minor versions.)…

I'm guessing the sentence they wrote is just a consequence of English not being the author's primary language. I frequently see ESL speakers get adjective and adverb positions wrong in ways that unintentially change the meaning.

Even skilled English speakers make mistakes here because English is both very permissive about word order, but also tends to give different shades of meaning to each other. "Only" is a pernicious one. When I got my last book copyedited, fixing the location of "only" was one of the most common changes.

Re: A routine gem update ended up creating $73k worth of subscriptions

#33
post #7
post #6

Mongoid docs[1] seem to be pretty cool about this change: "As of Mongoid 7.1, logical operators (and, or, nor and not) have been changed to have the the same semantics as those of ActiveRecord. To obtain the semantics of or as it behaved in Mongoid 7.0 and earlier, use any_of which is described below." Is it just me or is this one of the most terrible breaking changes in a popular, official library ever? [1] https://…

The SerpAPI blog author seems cool about it, too. After such a problem, I would roll back and never ever update this dependency again.

> seems cool about it, too.

How people blog and how they feel aren't always the same thing. Professionals tend to be a lot more tactful in public communication.

Re: A routine gem update ended up creating $73k worth of subscriptions

#35
Here's how true professionals would handle this:

"We recently became aware of some erroneous subscription renewals made by our platform and traced the root cause to a major bug in downstream database technology affecting a very small number of accounts. Nonetheless, we working hard with our database provider to resolve the issue.

In the meantime, if you are affected and believe you might have an unsolicited subscription, please contact our billing department by fax at 212-345...."

Re: A routine gem update ended up creating $73k worth of subscriptions

#36

We use Mongoid. I treat every upgrade, no matter how small as its own piece of work involving going through the changelogs with a fine-tooth comb. This particular issue got flagged up when we last looked at upgrading. Currently Mongoid upgrades are stalled until we have the time to figure out the impact of some of their more egregious changes. I have a generally low trust approach to all dependency upgrades, irrespec…

I feel spoiled having most of my experience in js, react and node. They like, try really hard not to totally break shit.

Re: A routine gem update ended up creating $73k worth of subscriptions

#37
post #6

Mongoid docs[1] seem to be pretty cool about this change: "As of Mongoid 7.1, logical operators (and, or, nor and not) have been changed to have the the same semantics as those of ActiveRecord. To obtain the semantics of or as it behaved in Mongoid 7.0 and earlier, use any_of which is described below." Is it just me or is this one of the most terrible breaking changes in a popular, official library ever? [1] https://…

The changelog for 7.1 (https://github.com/mongodb/mongoid/blob/master/docs/release-...) even explicitly call this out as a breaking change:

Breaking change: In Mongoid 7.1, when condition methods are invoked on a Criteria object, they always add new conditions to the existing conditions in the Criteria object. Previously new conditions could have replaced existing conditions in some circumstances.

Ironically they also have a breaking change in 7.1.1, so they just don't give a fuck at all.

Re: A routine gem update ended up creating $73k worth of subscriptions

#38
post #35

Here's how true professionals would handle this: "We recently became aware of some erroneous subscription renewals made by our platform and traced the root cause to a major bug in downstream database technology affecting a very small number of accounts. Nonetheless, we working hard with our database provider to resolve the issue. In the meantime, if you are affected and believe you might have an unsolicited subscript…

I thought you were being serious until I got to this bit: "please contact our billing department by fax"

Re: A routine gem update ended up creating $73k worth of subscriptions

#39
> SerpAPI: Scrape Google and other search engines from our fast, easy, and complete API.

Does anyone know how this works behind the scenes at scale? How do they get around Google trying to stop their scraping attempts? Just lots of proxies and some way around captcha challenges?

Re: A routine gem update ended up creating $73k worth of subscriptions

#40
post #7

Earlier quoted context omitted.

The SerpAPI blog author seems cool about it, too. After such a problem, I would roll back and never ever update this dependency again.

> seems cool about it, too. How people blog and how they feel aren't always the same thing. Professionals tend to be a lot more tactful in public communication.

I would be fuming if I were an engineer depending on that, but obviously in a public communication like that, where you are explaining to clients why you charged them erroneously, just pointing a finger and acting mad makes you look like you don't have control of your own software.
Post reply on HN