Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful of the examples you use. They stick

blog.thinkst.com

Post reply on HN
Print view View original

71–80 of 129 posts

Re: Be careful of the examples you use. They stick

#71

Post by Qwertious »

jmondi wrote: post #39
teddyh wrote: post #5

Oh, absolutely. If you give people an example (and you should), the overwhelming majority will copy the example exactly and then only change what they are forced to change when it doesn’t work otherwise . Therefore, prepare your examples accordingly.

About 5 years ago I made a blog post detailing how to use Traefik/LE with PHP. For about one day, I realized I had my personal email in the template for the warning email for when the Lets Encrypt cert is expiring. I still get emails warning random people that their domain is going to expire. Prepare your examples accordingly.

This sounds like a great way of getting some petty revenge while writing documentation.

Re: Be careful of the examples you use. They stick

#72

Post by catchnear4321 »

chasd00 wrote: post #67
ThalesX wrote: post #48

Earlier quoted context omitted.

I did a similar thing as part of a "lunch and learn". NodeJS + Express was super fresh and I did a small example app. When returning the user profile, I just queried the database and returned the entry displaying some properties on the frontend. The team lead was like "show us the request in the console", and I opened it up and there was the non-encrypted password, createdAt date and basically all the not-needed prop…

hah what i did involved a db too, a string based query without sanitization introducing a possible sql injection. The input never came from a user and was sourced from a config file but i still should have known better. I learned that if you put it in a slide, no matter scope/purpose, it better be production quality because people are just going to copy/paste.

copy/paste/“improve”

the only thing scarier than seeing your personal “not for prod” code running in prod by someone else’s hand. the “improvements.”

Re: Be careful of the examples you use. They stick

#73

Post by eschneider »

recursivetech wrote: post #59

A few years back, I recall reading about some automotive manufacturers who had just copied an example "airbag arming authorization" code/value that appeared in a shared spec document (IIRC) for their vehicles. There was a Metasploit module created (for the Hardware Bridge) that would send CAN bus messages to just check/verify if a particular vehicle uses this insecure arming code. For vehicles using this known code,…

I've done some commercial software SDKs and this strikes me as the least surprising thing in the world. MOST programmers will copy and paste example code into production applications without really thinking about how well it fits into what they're doing.

The takeaway is similar to the article: think very, VERY hard about your examples and sample code. It doesn't just have to be correct and demonstrate the features, it also needs to be fairly robust so that customers don't hurt themselves with it.

Re: Be careful of the examples you use. They stick

#74

Post by JohnMakin »

Reminds me of a large company I worked at, I had some documents for developers how to set up some local environment thing they had to do exactly 1 time and never again. It was just a handful of terminal commands, all starting with the traditional shell notation like:

$ (some command)

Over the course of a year I got periodic complaints that it "wasn't working" and I tried to find issues on my end and couldn't. One particularly vocal dev came to me directly and insisted it was broken, so I went on a shared session with him, it turns out they were pasting the "$" into the terminal causing it to say: "$: command not found."

That was the source of all the complaints, once I removed it, they stopped.

Re: Be careful of the examples you use. They stick

#75

Post by Karunamon »

Cyykratahk wrote: post #53
azeemba wrote: post #43

Earlier quoted context omitted.

example.com is officially reserved in the spec for this use case. Is the .example TLD reserved as well?

Yes, here are the reserved TLDs [0]: test example invalid localhost local localdomain domain lan home host corp 0. https://www.ietf.org/archive/id/draft-chapin-rfc2606bis-00.h...

Be careful, that is a decade plus old expired draft of a proposed update to RFC 2606. The current version of the standard, including 6761 which updates it, does not reserve most of those.

https://datatracker.ietf.org/doc/html/rfc2606#page-2 https://datatracker.ietf.org/doc/html/rfc6761

You are probably safe using names like .lan and .corp but they are not currently protected by standard in the way example is.

Re: Be careful of the examples you use. They stick

#76

Post by hiAndrewQuinn »

JohnMakin wrote: post #74

Reminds me of a large company I worked at, I had some documents for developers how to set up some local environment thing they had to do exactly 1 time and never again. It was just a handful of terminal commands, all starting with the traditional shell notation like: $ (some command) Over the course of a year I got periodic complaints that it "wasn't working" and I tried to find issues on my end and couldn't. One par…

Is there a reason websites put that $ in front of commands you are fully expected to mindlessly copy and paste? I've seen it happen more and more and it simply baffles me.

Re: Be careful of the examples you use. They stick

#77

Post by teddyh »

bawolff wrote: post #47

40% !! I could kind of tell where this article was going from the first paragraph, but i never thought "some-prefix" would be used by 40%. That is such a high number.

On the contrary, for those of us who have experienced The Public it seems rather low.

Re: Be careful of the examples you use. They stick

#79

Post by JohnMakin »

hiAndrewQuinn wrote: post #76
JohnMakin wrote: post #74

Reminds me of a large company I worked at, I had some documents for developers how to set up some local environment thing they had to do exactly 1 time and never again. It was just a handful of terminal commands, all starting with the traditional shell notation like: $ (some command) Over the course of a year I got periodic complaints that it "wasn't working" and I tried to find issues on my end and couldn't. One par…

Is there a reason websites put that $ in front of commands you are fully expected to mindlessly copy and paste? I've seen it happen more and more and it simply baffles me.

I think it is to separate command line input from output -

$ echo "Hello!"

Hello!

The $ denotes that this is a terminal command, and anything that is not preceded by $ will usually be some kind of output. That's certainly how/why I was using it.

Re: Be careful of the examples you use. They stick

#80

Post by bsilvereagle »

hiAndrewQuinn wrote: post #76
JohnMakin wrote: post #74

Reminds me of a large company I worked at, I had some documents for developers how to set up some local environment thing they had to do exactly 1 time and never again. It was just a handful of terminal commands, all starting with the traditional shell notation like: $ (some command) Over the course of a year I got periodic complaints that it "wasn't working" and I tried to find issues on my end and couldn't. One par…

Is there a reason websites put that $ in front of commands you are fully expected to mindlessly copy and paste? I've seen it happen more and more and it simply baffles me.

“$” for non-root shells and “#” for root shells instead of writing out sudo/su.
Post reply on HN