Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why was "goto fail;" added without any other change to that part of the code?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: Why was "goto fail;" added without any other change to that part of the code?

#31

Post by 0x006A »

cjbprime wrote: post #2

It's not true that there was no other change in the code -- there was a change eight lines earlier. It could be a mismerge of the latest upstream code. There was refactoring nearby, and people can make stupid mistakes while refactoring. I disagree that there's no "reasonable explanation", and so do most other people who've looked at it. That doesn't mean it wasn't malicious, but it means that it has reasonably plausi…

mismerge looks like a possible explanation, do you know what the upstream project/codebase for this is? Would be interesting to look at that.

Re: Why was "goto fail;" added without any other change to that part of the code?

#32

Post by matthewmacleod »

pessimizer wrote: post #30
matthewmacleod wrote: post #24

Stop this nonsense. There are plainly dozens of reasons that this could have happened accidentally. Literally every single developer has made similar stupid mistake, and literally every organisation has released stupidly broken code. Yes, there should have been code review, static analysis, and testing in place to prevent that. That'll probably start happening, and you can bet that there will be serious discussions i…

>it's hard to imagine a situation where such an action would be worthwhile, given the resources at the disposal of any such actor. This needs more defense. I find it hard to imagine a situation where such a minimal and deniable action with such a massive effect wouldn't be worthwhile.

This needs more defense. I find it hard to imagine a situation where such a minimal and deniable action with such a massive effect wouldn't be worthwhile.

Because the goal of any such agency is not "let's render a minority of computing devices insecure for a short period under certain circumstances." That entire argument hinges on the idea that taking this action would have achieved some kind of desirable goal, when it simply would not have.

In fact, the whole thing is a massive distraction. There are myriad easier ways to conduct individual surveillance if that was the goal, and I would be much more concerned about the fact that these same agents already apparently have legal carte blanche to intercept traffic in other ways.

Re: Why was "goto fail;" added without any other change to that part of the code?

#33

Post by wreegab »

matthewmacleod wrote: post #24

Stop this nonsense. There are plainly dozens of reasons that this could have happened accidentally. Literally every single developer has made similar stupid mistake, and literally every organisation has released stupidly broken code. Yes, there should have been code review, static analysis, and testing in place to prevent that. That'll probably start happening, and you can bet that there will be serious discussions i…

> If this was the action of a malicious government agency, then it was horribly hamfisted execution

If this was the action of a malicious government agency, you're the proof it was an awesome move, given your "Stop this nonsense".

Re: Why was "goto fail;" added without any other change to that part of the code?

#35

Post by wreegab »

gcb0 wrote: post #17

I'm 100% convinced it's malicious... But otherwise, it could be explained by the coder adding another check If(err==my_dev_string) goto fail; Then before committing, sending the diff to a colleague who emails back "you forgot a debug there, besides that ship it" He removes only one line of two and ships. And of course i always try to attribute those things to incompetent other than malice, but since in this case ther…

> but since in this case there was probably money and bribes involved

The cognitive process above is really sad: "I speculate this is what happened as a natural outcome of my other speculation"

Re: Why was "goto fail;" added without any other change to that part of the code?

#36

Post by beachstartup »

stcredzero wrote: post #22
beachstartup wrote: post #12

i do this all the time in vim. all it takes is one extra keystroke 'p' to do this. if i were to take a guess, the programmer first typed out all the if conditional expressions, then went in and pasted 'goto fail' out of a buffer after each one, and accidentally did it twice there.

Do you understand diff format?

do YOU understand how diff works? it tracks changes between two points in time, it doesn't track how you got there or what you did in between.

he could have easily yanked a goto line 'yy' for use elsewhere or by accident and pasted it by accident with 'p' right after he yanked it.

i see two very similar lines, 49 and 53, which were probably copy/pasted and edited. it is completely reasonable to assume he accidentally did it with another line further down the file.

he could have refactored this code multiple times before re-committing this file, moving blocks around or editing lines. there's plenty of opportunity to introduce errors.

do you understand how editing works?

Re: Why was "goto fail;" added without any other change to that part of the code?

#37

Post by landypro »

laureny wrote: post #21
homakov wrote: post #7

More importantly, why Apple doesn't run test suites, basic checks? Test driven development must be everywhere

TDD might be useful for unit tests (even that I'm not convinced of) but not for integration tests. The bug happens very deep inside the handshake protocol and it's extremely hard to test it automatically.

That's hardly an excuse given the significance of this code.

Re: Why was "goto fail;" added without any other change to that part of the code?

#39

Post by beachstartup »

jeremyjh wrote: post #20
beachstartup wrote: post #12

i do this all the time in vim. all it takes is one extra keystroke 'p' to do this. if i were to take a guess, the programmer first typed out all the if conditional expressions, then went in and pasted 'goto fail' out of a buffer after each one, and accidentally did it twice there.

That didn't happen - look at the diff in the OP.

that's bullshit. you don't know that it didn't happen - there's no telling what he did with the code in the time between commits. he could moved things around 20 times, finally ending up in the same place, with the exception of the accidentally pasted a line.

plese use some imagination before jumping to conclusions. a diff tracks changes at points in time, not an editing session.

Post reply on HN