The Daily WTF

CodeSOD: Accounting for Complexity

Alex Papadimoulis — Wed, 01 Sep 2010 13:00:00 GMT

"I was recently assigned to work on a team that maintains a fairly large product," writes Aaron, "at first, I was a bit overwhelmed by the complexity of the architecture. There were countless layers of abstraction, thousands and thousands of classes, and design patterns galore. Since it was such a large project – and my first large project – I figured that the architectural complexity was simply par for the course."

“Then I started looking at the code a little more closely. If I had two words to describe it, they’d be ‘unnecessary complexity.’ And if I had one snippet to describe it, it would be this.”

private void SetAccount(RequisitionData.RequisitionItem requisitionItem, 
                        AccountData.Account account, bool automation)
{
    bool allowSetAccount = false;

    if(account != null)
    {
        // if the account entry is being set by automation, ensure that 
	// the user hasn't already set a value
        if (automation)
        {
            if (!requisitionItem.IsAccountCodeNull())
            {
                if (requisitionItem.AccountCode == string.Empty)
                    allowSetAccount = true;
                else
                    allowSetAccount = true;
            }
            else
                allowSetAccount = true;
        }
        else
            allowSetAccount = true;

        if (allowSetAccount)
        {
            requisitionItem.AccountID = account.ID;
            requisitionItem.AccountCode = account.Code;
        }
    }
}

Aaron continued, "the beauty of it is that the method is private within the class, and has an 'automation' boolean parameter. This parameter is always passed as true."

Fast Fix

Remy Porter — Tue, 31 Aug 2010 13:00:00 GMT

"Do you think it's wise to have consultants running our IT department?" Holger asked. It was an honest question, worded as diplomatically as possible. Holger's company had more consultants on hand than actual IT staff.

"Holger, these folks are experts," his manager replied. "It isn't cost effective to hire-on this level of expertise full time. We may pay a little more up front, but when we don't need the consultants anymore, we can hand it off to our internal people."

Holger left that discussion pretty sure he had just been called incompetent. Maybe I should ask the consultants if they're hiring, Holger wondered to himself, thinking of the big money they pulled down relative to his salary. The thought was still percolating in his head when he sat down with the two newest consultants, Zack and Jack for their status meeting.

Holger hooked his laptop up to the projector and ran through a few recent changes in the configuration database, discussed the implications, and then moved onto other topics. He stopped paying attention to the computer, and it eventually dropped to its screensaver. Moments later, there was some snickering from Zack.

"Having some computer trouble?" Jack asked, mockery in his tone.

Holger glanced at the projection screen and saw that his screensaver was was running merrily. It merrily painted a BSOD to the screen, with plausible driver dumps, merrily churned the disk a little, like it was saving the contents of RAM, and merrily ran through a simulated reboot sequence. After which, the process repeated itself, merrily. "Oh," Holger said, "that happens sometimes. I've got it under control. No worries."

"Yeah, whatever," Jack said. The meeting continued.

The product of the meeting, like too many other meetings with consultants, resulted in the need for another meeting. "Let's see what my calendar looks like," Holger said. He grabbed the mouse, killed the screensaver, and called up his email client.

Zack gasped. "How did you do that?" Jack marveled.

"Oh, that?" Holger said. With his best deadpan, he said, "I got tired of waiting for the reboots to complete. I put together a tool that does an automatic fix and restart, letting me just continue right from where I left off."

Holger waited a beat. After a moment, he was certain that these consultants would realize he was pulling their leg.

Zack was up in a flash and quietly closed the door. Jack leaned across the table towards Holger and asked, "Did you make that on company time? And does anyone here know if you did? Because before we go back into that hallway, I want to buy this off of you."

"You don't have that kind of cash," Holger said.

"No, but I can put it on the expense account and then pay it off when I get VC funding," Jack said.

Holger spent the next fifteen minutes declining their offers to buy his tool. In the process, he discovered that the consultants had creative and unethical ideas about how to quickly get funding, and that one of them had a trophy wife that would do anything for the kinds of profits they were talking about. "And I do mean anything," Zack said with a leer.

Finally, Holger "confessed". "Look, you guys are generous and all, but I've already signed a contract with another company. Even if you could beat their offer, I can't break a contract."

"Sure you can!"

Holger left the meeting without any interest in finding out if their company had any openings.

CodeSOD: Command 696

Alex Papadimoulis — Mon, 30 Aug 2010 13:00:00 GMT

Think of all those old applications you’ve had to maintain. You know the type: the ones written by long-forgotten developers in long-lost languages. The ones that, after spending days searching for that one line of code that needs to be changed, you frustratingly decree “this f%*#@ thing needs to be rewritten.” And, naturally, the ones that never are, nor never will be rewritten.

Call it luck or persistence, but after dozens and dozens of maintenance requests over the years, Israel Brewster finally was given the opportunity to rewrite an application. From scratch. And the right way, this time. No shoddy VB6 front-end; no horribly-designed SQL Server 2000 (only) database; and certainly no Microsoft Access-based administration tool.

Though, after his third straight week of digging through form validation logic requirements – many of which were quadruplicated (or more), inconsistent, and often incorrect –he’s started to question if a rewrite is even possible. Consider, for example, Command 696: a method named that simply because Command1 through Command695 were already taken.

Private Sub Command696_Click()

  On Error GoTo Err_Command696_Click

  Dim stDocName As String
  Dim Response As Integer

  If Frame500 = 1 And pax > 37 Then
     MsgBox "CHECK PAX DASH 8 LIMIT 37 SEATS", vbOKOnly
  Else
  End If
  If Frame500 = 2 And pax > 29 Then
     MsgBox "CHECK PAX DASH 8 LIMIT 29 SEATS", vbOKOnly
  Else
  End If
  If totalload1 > 2000 Then
     MsgBox "OVERWEIGHT Fwd Shelf ", vbOKOnly
  Else
  End If
  If ttshelf > 1000 Then
     MsgBox "OVERWEIGHT Aft Shelf ", vbOKOnly
  Else
  End If
  If totalload1 + ttshelf > 2000 Then
     MsgBox "OVERWEIGHT Aft Compartment max 2000 lbs ", vbOKOnly
  Else
  End If
  If Frame500 = 1 And totalloadsecd > 0 Then
     MsgBox "DASH 8 WITHOUT SECTION D ", vbOKOnly
  Else
  End If
  If Frame500 = 2 And totalloadsecd > 2150 Then
     MsgBox "OVERWEIGHT SECTION D ", vbOKOnly
  Else
  End If
  If Remaining < 0 Then
    MsgBox "DASH 8 OVERWEIGHT REDUCE LOAD !!!!", vbOKOnly
  Else
  End If
  If ttload <= 0 Then
    Response = MsgBox("ARE YOU SURE AFT CARGO COMPARTMENT IS EMPTY!!!!", vbYesNo)
  Else
   Response = 6
  End If
  If Frame500 = 1 And pax <= 37 And totalload1 <= 2000 And _
     ttshelf <= 1000 And totalloadsecd = 0 And _
     Remaining >= 0 And totalload1 + ttshelf <= 2000 And Response = 6 Then
    stDocName = "csaprintinfo37seats"
    DoCmd.OpenReport stDocName, acPreview
  Else
  End If
  If Frame500 = 2 And pax <= 29 And totalload1 <= 2000 And _
     ttshelf <= 1000 And totalloadsecd <= 2150 And _
     Remaining >= 0 And totalload1 + ttshelf <= 2000 And Response = 6 Then
    stDocName = "csaprintinfo29seats"
    DoCmd.OpenReport stDocName, acPreview

  Else
  End If

Error'd: There is No Survey Currently Running

Mark Bowytz — Fri, 27 Aug 2010 13:00:00 GMT

Kristján writes, "I agree. No, wait..."

"I got this while doing my online homework for a calculus class I am taking," wrote Chase P., "I mean, it's freaking 42 of all numbers - how could it NOT be correct??."

In order to take over the earth, the Brain hatched a plan where he would sieze control of the world's banking system. The plan was true genius, but like all big plans, he had to start somewhere which, in this case, was to take control of OneWest Bank's QuickPricer.

"I know that folks in Texas have strong feelings about where they live," wrote Reinier, "but I had NO idea that people in South Africa did too!"

"I wasn't exactly sure what to do here so," writes Johann, "I figured it safest to click on the "X" to close the window, manually restart, and pray for the best"

"The text translates roughly "Some tray icons can't be shown. There isn't enough space to show all objects in system tray. Uninstall some programs or try to use larger display resolution.," writes Maar, "I guess that I'll be able to justify that larger monitor purchase after all!"

"I think I'm going to take my chances and say 'no' the extended warranty," writes Stewart.

Stoned!

Mark Bowytz — Thu, 26 Aug 2010 13:00:00 GMT

When Greg was shopping for jobs at his college’s career fair, there was a whole lot of business as usual.

The larger banks were on-hand looking to swoon the upcoming Financial grads. Several representatives from a few big name manufacturing corporations were there to interview the Chemistry majors and a few IT firms were on the lookout for the soon-to-be CS grads, like Greg, to add to their ranks. However, amid the ocean of pamphlets and suits there was one aerospace corporation with one particular position that caught Greg’s attention. The position that he applied and was ultimately hired for could be summed up in one sentence:

“You’ll be testing laser tag games for the military.”

A Dream Come True!...kind of

Actually, Greg’s official title was “QA Analyst for Battlefield Training Simulation Systems” but the idea of the system being a great big laser tag game really wasn’t all that far off the mark.

The way the existing setup worked was that sensors on a soldier’s body vest would detect a “hit” during the simulation, and would then set off an annoying alarm that could only be turned off with a special key. Once deactivated, the solder was ‘dead’ for the rest of the training scenario. It all worked, but one big problem with the whole setup was that, to the displeasure of many, a few enterprising soldiers managed to get their hands on and started selling tester keys (also known as “God Keys”) that allowed soldiers to resurrect themselves and get back into the battle.

After a number of years of trying to prevent soldiers from exploiting the system and a host of other technical headaches, the military was finally able to replace their system with something a little newer.

New features like the addition of GPS tracking units, RF data modules reporting hits and their locations and a slew of backend upgrades meant that military trainers could execute more extensive and complex training scenarios and, over time, recoup the costs because the new system was designed to rely on “off the shelf” 3rd party solutions, but first, these solutions would need to be vetted by QA guys like Greg.

Getting Stoned

Like any new hire, Greg was completely pumped and ready to contribute and shake things up his first week, but as time went by, Greg’s excitement dwindled when he found that doing QA analysis didn’t really involve shooting co-workers with laser guns, but instead was a lot of tedious, hard work with project managers and piled on bureaucracy for good measure.

In one particular situation they received a firmware update for one of the GPS systems being used in the Player Unit modules.

While trying to figure out why the latest hardware revision was failing immediately after the first test he noticed that the GPS receiver would send out a burst of garbage every few seconds.

Puzzled by this he checked and re-checked the connections and tried one of the spare units only to find the same result. Everything seemed like it should fine and the supplier swore there was nothing wrong with their system. Not able to let something like this go, Greg spent many late-night hours pouring through raw dumps of the results and along the way, he began to notice a pattern of the same Hex data repeating in the noise. As he painstakingly translated the hexadecimal into ASCII, he was genuinely surprised upon being greeted with a curious snippet of text.

Your PC is now Stoned!

After a quick search on the message, it all made sense. Somehow, the firmware upgrade for the GPS system had become infected with a disk boot sector virus, which ran perfectly fine on the embedded processor. Since this virus couldn't write itself to a disk, as there were no floppy drives on the GPS card, it instead sent itself out through the RS-232 port once every 5 seconds in hopes of infecting another computer.

Greg wrote up his analysis and forwarded it off to the vendor, who quickly (and quietly) issued another update to their firmware, identical to the last except without the virus.

Upon loading of the updated firmware, Greg noticed the difference immediately and was pleased to see that the vendor's "fix" resolved the "data issue" that he'd reported, however, there was a small catch to this tiny update. You see, preliminary testing for military equipment is a long and detailed process that makes the most draconian corporate processes look positively streamlined. Also, since the magic keyword "virus" had been uttered, QA testing couldn't just pick up where it left off, and couldn't just be for the GPS module. In fact, Greg had to start over at step 1 with added "anti-virus" steps add in for good measure just to be sure.

CodeSOD: Masquerading as a Loop

Alex Papadimoulis — Wed, 25 Aug 2010 15:00:00 GMT

"While digging through some inherited code," writes Joe "M2tM" Smith, "I encountered a conditional masquerading as a loop."

"Thankfully, the fellow responsible is 'no longer with us', and I suppose this type of code stands as silent testament to why. This interesting loop is only created so the break keyword can be used as an elaborate GOTO."

bool bCreateModel = false;
for (;;)
{
    if (!pModel)
    {
        bCreateModel = true;
        break;
    }

    if (asModelParts.GetSize() != asModelPartsToLoad.GetSize())
    {
        bCreateModel = true;
        break;
    }

    for (UINT32 i = 0; i < asModelPartsToLoad.GetSize(); ++i)
    {
        if (asModelPartsToLoad[i] != asModelParts[i])
        {
            bCreateModel = true;
            break;
        }
    }

    break;
}

Large Blockage

Remy Porter — Tue, 24 Aug 2010 14:00:00 GMT

The words "Enterprise Integration" strike fear into the most stalwart of developers. When coupled with "in-house developed" and "B2B", one is almost guaranteed to find complex code, arcane requirements, and a thicket of poorly understood file formats. Dan was made of sterner stuff. When the contract was explained to him, he didn't flinch. There were between 40 and 80 partners that used a web app to extract data about multimedia assets? Gigantic recordsets of them? In formats ranging from Excel to iTunes-compatible databases? No problem.

Steve, the project manager, explained: "Our original lead developer was one of those rockstar types. Real cutting edge, pushing the envelope type guy. He's since moved on to bigger and better things, so we've just muddled on the best we could. We really need you to step up and take on that rockstar role for us, because there are a few problems we'd like you to fix. And we need a real quick turn-around on this."

"What sort of problems?" Dan asked.

"Well, these exports take hours. That's expected- it's a huge pile of data- but some of our partners are complaining that it crashes on them near the end of the job. So they have to start all over. Hours wasted. That's the big thing, but some of our other developers suggest that you try and do a little 'refactoring'?" Steve used air-quotes and a look of incomprehension to convey the question. "They said it should help make maintenance cheaper. Is that right?"

"It could," Dan said. "Let me see your documentation and the code, and I'll see what I can do."

They only had code. Dan opened the solution up in Visual Studio and started poking around. He looked for any classes that were responsible for exporting. He expected to see a whole family of them tied together through inheritance, probably named something like "XMLExport", "ITunesExport", or something equally transparent.

He didn't find a family of classes. In fact, he didn't find any classes. The entire project was lacking in any code or code behind files- not a single ".cs" in sight. Not even a ".vb". The only likely candidate was "Export.aspx".

"Do I have the right code?" Dan wondered, thinking there must be some class library he was missing. Dan double-clicked on "Export.aspx" and waited for the file to open. And waited. The HDD rattled away; its noise covered up the faint sound of Visual Studio sobbing to itself. By the time Dan finished his cup of coffee, the file appeared on the screen. Dan skipped down to the postback event handler, which was wedged in-line between the opening <body> and the page heading. It took Visual Studio over a minute to repaint the screen.

At four levels of indentation under the event handler, there was a switch statement. This statement simply checked which button was clicked. The first case, for "__exportButton" contained a twenty-five thousand line block of if/else statements.

"Oh, this can't be right," Dan wished. "This must be old code. Or some obscure branch used for… for… for hazing the new guy." He checked SVN. There was only one branch and the most recent check-in was from the day before, with the comment, "changed XML date format for iTunes export."

Dan patted Visual Studio's shoulder and tried to console it by closing every other application running, to free up some RAM. He and Visual Studio, both on the verge or crashing, struggled to read through the document together.

At the start of the event handler was this:


//Server.ScriptTimeout = 3600;
//Server.ScriptTimeout = 10800;
Server.ScriptTimeout = 21600; //six hours should probably be enough. If it keeps crashing, raise this.

The code went downhill from there. The actual export logic in the twenty-five thousand line block contained batches of hard-coded SQL queries- they all varied slightly, but not much, and it was hard to spot the differences. For each SQL query executed, a new database connection was opened. The block responsible for closing them all, was near the end, and looked something like this:


oldCnon.Dispose();
db1a.Dispose();
dbMain.Dispose();
db1.Dispose();
connCore.Dispose();
newConn.Dispose();

Once a connection was opened, it stayed opened until the export job completed. There were copy/pasted blocks that repeated the same code again and again, although over time, they had drifted apart so they weren't exactly the same anymore, but mostly. The web page itself handled all of the file I/O, the communication with Excel Interop libraries. One of the XML formats was generated, not by using the XmlWriter object, but by concatenating a pile of strings together. The entire pile was topped off with a bow- the "bow" meaning "only one exception handler for the entire block". The single catch(Exception ex) responded to any error that could possibly happen in that 25,000 line thicket. Its response was to simply print out the informative, "An error has occured(sic). Please correct your request and try again."

Dan wasn't even sure where to start. For the heck of it, he upped the script timeout from 21600 to 43200. He checked that minor change in with the comment, "This should fix timeouts for the foreseeable future," and then started trying to get a grip on how to pry this pile of spaghetti apart and turn it into supportable code.

The next day, he was elbow deep in "Export.aspx"'s entrails when Steve interrupted. "Hey, Dan!" Steve beamed. "Great work on fixing that bug. I saw your check-in, gave it a spin, and promoted it to production. Fantastic turn-around time on that. Look, since you're done, we've got a lot of other projects that could use some TLC- can I move you onto one of those?"

CodeSOD: Swallowed by the Beast

Scott Selikoff — Mon, 23 Aug 2010 13:00:00 GMT

Paul was having a good morning. It was a beautiful day outside, he managed to shave 15 minutes off his commute, and even the local coffee shop had his favorite donut in stock. All of that changed when he got his first support call of the day. It was from a client running "the beast" product. "The beast", as Paul and his coworkers nicknamed it, was a legacy version of their application developed somewhere overseas years before Paul was hired, by hundreds of poorly trained, and probably poorly paid, developers. The company's sales team actively encouraged clients to upgrade from the legacy application, but a select few had resisted.

"The beast" had a reputation for containing some of the worst code Paul had ever seen and every time he had to support it, he felt like he needed a shower afterwards. It was during his fourth hour of debugging that Paul came across a previously unvisited function shown below.

public boolean isWidgetReferenced(int widgetId) {
	boolean available = false;

	try {
		String query;
		ResultSet rs = null;
		int count = 0;

		Connection connection = getConnection();
		query = "SELECT COUNT(*) FROM WIDGET_REGION WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}
		if (0 < count) return false;

		query = "SELECT COUNT(*) FROM WIDGET_OFFERING WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}
		if (0 < count) return false;

		query = "SELECT COUNT(*) FROM WIDGET_ORDERS WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_NEW WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_HISTORY WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_STATS_RECORDED WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_VIEWED WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_SETS WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_INSTALLED WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_PENDING WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;
		query = "SELECT COUNT(*) FROM WIDGET_JOURNAL WHERE widgetId=" + widgetId;
		rs = connection.createStatement().executeQuery(query);
		for (; rs.next();) {
			count = rs.getInt(1);
			break;
		}

		if (0 < count) return false;

		available = true;
	} catch (Exception e) {
		logger.error("isWidgetAvailable", e);
	}

	return available;
}

Paul wasn't sure what bothered him the most: that the developer had used a strangely formed for() loop on a structure that always returned exactly one record; that the integer count could have been implemented as a boolean; or that the pattern had been repeated 10 times in this file and dozens of times in other files. As it turns out, the root cause of the issue was unrelated to the sheer amount of repetitive code. Had the developer taken the time to clean up this function, they might have noticed that they never closed any of the JDBC connection resources defined in the method.

Error'd: Logon-ing Off

Alex Papadimoulis — Fri, 20 Aug 2010 13:00:00 GMT

Andrew Carpenter writes, "I guess this is like turn-oning off a switch?"

"While trying to signup for a Windows Live account, I found myself without my best friend Neil," wrote Rob, "unfortunately, my second-best friend Ray, third-best friend Jane, and fourth-best friend Tom are also excluded."

"I got this rather odd message when trying to install the Evo Java client," wrote Nick Edwards, "I clicked OK and it worked... even though I wasn't SURE_IT_WORKS!"

"I'm not sure why Google would omit entries and return zero results," Michael noted, "clicking on the link, I received 0 omitted results which were indeed very similar."

"YUM!! Blank Insert bear claws," wrote Matthew Sowders

"This came up while configuring Neverwinter Nights on my PC," Ville Rastas writes, "I was worried the game might not support today's high resolution screens, but I guess it's quite the opposite."

"I knew IKEA has some funny names on it's furniture," writes Patrik, "but who knew they were into the new fashion trend of nerd chic?

"According to Virgin Mobile," writes Glenn Jones, "Unlimited is twice as big as 10G (so maybe around 20G), except for videos where Unlimited is only 1.3 times 10G."

Is Your PC Frozen?

Mark Bowytz — Thu, 19 Aug 2010 13:00:00 GMT

Bob was in the process of shutting down a software company that he had built over the past seven years. He had found a buyer for all of the software that he'd developed, collected his "eff you money" and was now retiring.

In fact, things were at the point where Bob had already closed the building and redirected the phones to his home phone with a distinctive ring so that he could tie up loose ends while the building was up for sale.

Bob woke one morning at 8:00am to the phone ringing, crawled out of bed and picked up the ‘Bat Phone,' as he called it, in the living room.

"Hello?" Bob said, and gave the name of the company.

Without preamble or introduction, Bob was informed by a woman's voice, "Hi this is Sally Brumbaker, my user id is smb1985. My computer's frozen."

Bob didn't recognize the voice and certainly not the name. Also, it was before coffee. "Your computer's frozen?" Bob affirmed.

"Yes."

"Is the side cold?" Bob asked matter of factly.

"Wait a minute," replied Sally, and then after a pause, "No not at all."

"Ok, then," Bob assured her. "Your computer's not frozen, then, it's probably just running a program. Give it a minute."

"I don't understand, what do…" the woman began, and then, "Oh, ok. There is goes." and that, she hung up the phone and Bob did the same, thinking about how much cream to put into his coffee.

THREE MONTHS LATER

The ‘Bat Phone’ rings. Though the company had long been put to bed, Bob was suddenly reminded of was that he’d forgotten to stop the phone service.

"Hello?" Bob asked, and with a little hesitation, gave the name of his (now non-existent) company.

"Hello,” introduced the caller in a very serious tone, “I need to speak to someone in charge of your technical support."

"Well, that's pretty much me,” replied Bob, “What do you need?"

"Did you or someone working for you tell Sally So-And-So that she could tell if a computer was frozen by feeling the side?"

"What?"

"Sally says she called this number three months ago, and was informed by a support tech that she could tell if a PC was frozen by feeling for the side being cold. Since then, she's been feeling the sides of people's computers, and she's completely humiliated."

"Sally works in your IT department?" Bob asked.

"No, Sally is the Director of our human resources department," Bob was informed.

"And this is...?"

"I sit on the board for Plainston-Princeboro Teaching Hospital."

"I see. So, Sally hires doctors and nurses."

"She does - and now she's been humiliated by you or someone at your company,” huffed the voice on the phone,” What do you have to say for yourself?"

"Well, first," Bob answered, "I'd like to say that, if I get seriously hurt, I'll drag myself right past YOUR hospital."

"WHAT!?"

"Sir," Bob said, with great sincerely, "you have to admit, that's pretty dumb."

Suddenly, the man on the other end of the line was at a sudden loss for words.

"Ok," he said finally, a little deflated, "Sally isn't the most computer savvy person we have, but that doesn't give you the right to prey on her..."

"Sir," Bob said, "I took that call, Sally didn't identify herself, and as soon as she thought she had an answer from me, she hung up the phone before I could explain that I was kidding. I'm sorry if I humiliated her, but I have no idea how she got my number and this isn't a computer technical support company."

"Oh, I see," the person informed Bob. "We’ll, just be more careful, next time,” and with that, hung up the phone.

Since then, Bob disconnected the ‘Bat Phone’ for good, officially severing himself from his old life, but still gets a chuckle thinking of a smartly dressed executive going through the hospital, troubleshooting issues by feeling the sides of PC's and telling their users whether they were frozen of not.

CodeSOD: Avoiding Magic Constants

Alex Papadimoulis — Wed, 18 Aug 2010 13:00:00 GMT

Everyone knows that "Magic Numbers" are bad, Bad, BAD! Take, for example, dividing something into quarters. Because including the literal "4" in your code would be a Magic Number, many developers agree that it's best to define a constant named "FOUR", and then use that constant instead. Makes sense, right?

Wrong! The problem with using "FOUR" is that, like "4", it's a Magic Constant. While not nearly as bad as Magic Numbers, Magic Constants certainly aren't elegant. Fortunately, Allen's colleague has provided us all with a valuable lesson the proper use of Magic and Non-Magic constants. Read it, and learn.

public class Constants {

    ...

    public static final int FOUR = 4;
    public static final int THREE = 3;

    public static final int INTEGER_FOUR = 4;
    public static final int INTEGER_FIVE = 5;
    public static final int INTEGER_ONE = 1;
    public static final int LENGTH_FOUR = 4;
    public static final int LENGTH_FIVE = 5;
    public static final int LENGTH_SEVEN = 7;
    public static final int LENGTH_EIGHT = 8;
    public static final int LENGTH_NINE = 9;
    public static final int LENGTH_ELEVEN = 11;
    public static final int LENGTH_TWELVE = 12;
    public static final int LENGTH_EIGHTEEN = 18;
    public static final int LENGTH_FIFTEEN = 15;
    public static final int ONE = 1;
    public static final int INTEGER_FIVE = 5;
    public static final int INTEGER_ONE = 1;
    public static final int PLUS_ONE = 1;
    public static final int INTEGER_THREE = 3;

    public static final Long LONG_VALUE_TEN = Long.valueOf(10);
    public static final Long LONG_VALUE_ZEARO = Long.valueOf(0);

    public static final BigDecimal BIGDECIMAL_ZERO = new BigDecimal(0);
    public static final BigDecimal BIGDECIMAL_ONE = new BigDecimal(1);

    public static final BigDecimal NEGATIVE_NUMBER_ONE = new BigDecimal(-1);

    public static final int COMPARE_RESULT_ZERO = 0 ;
    public static final int COMPARE_RESULT_ONE = 1 ;
    public static final int COMPARE_RESULT_NEGATIVE = -1 ;

    ...

    public static final String NINE_STRING = "9";
    public static final String ONE_STRING = "9";

}

Powerful Stupidity

Remy Porter — Tue, 17 Aug 2010 13:00:00 GMT

Everything went dark and a chill wind went up Simon's back. A deep rumble rattled his brain in his skull. He glanced behind him to see Noel looming over him. "Simon, can you ping the Exchange server?"

When the trained bear that doubles as your IT manager asks that question, it's a bad thing. Simon tried to ping Exchange and failed. He then tried to ping an app server. And a database. And the outside world. All dead.

About a thousand users were about to discover that the only IT asset they could access were their desktop computers. Shortly thereafter, the phone next to them was going to ring. The person at the other end would likely scream. And then it would ring again. The ringing and screaming would continue until the network was back up.

They hustled to the server room, with Noel's bulk clearing a path through the corridor. It was hectic, and he may have trampled an intern. In one corner of the server room, a jump-suited man with a tool-belt bobbed his head to the music in his earphones. The server room was so quiet that the two could actually hear his music from across the room.

"What have you done?" Noel rumbled. The ominous wave of fury failed to penetrate the shield of Lady Gaga songs the electrician had surrounded himself with. Noel closed on him and repeated the question, with more volume and a heavy hand on the shoulder.

Once he had the electrician's attention, he didn't wait for an answer. "I will tell you what you have done," Noel said, "since you obviously do not understand. You are drilling away into a little metal box that is labeled 'Uninterruptible Power Supply', rendering it quite interruptible and cutting power to the room."

"I… I'll fix it…" the electrician managed to croak out.

He set to work. Noel set to work as well by providing a profanity laden commentary on the level of failure the electrician had just wreaked, how many tens of thousands of dollars of equipment the electrician had probably damaged, how many users were useless at the moment.

The electrician worked through the tirade, which says good things about his saving throw versus intimidation, even if his saving throw against stupidity left something to be desired. With a sigh of relief, he flipped the circuit breaker. Green blinking lights and the sounds of whirring disks filled the room.

Then the breaker clunked back into position. The servers rattled back to silence. An expensive sounding clunk came from a hard drive somewhere in the room.

"I'll fix it!" the electrician squeaked. After a frantic adjustment, he flipped the breaker again. The show repeated itself, although the encore added some sparks in the UPS. The third time the electrician reached for the breaker, Noel nearly broke his hand off.

"I think that's enough of that for the day," Noel warned.

"The… the breaker can't handle the load?"

Noel ignored the electrician and turned to Simon. "Do you think I can heave him up to the ceiling?" Simon looked up, and fifteen feet away, he saw the spare pin-and-sleeve-plugs that had been installed to power future expansion.

Since the electrician didn't have a ladder -- and since Noel's throwing arm wasn't up to the task -- Simon clambered on his back. One egregious violation of the health-and-safety policy later, the server room was on a different circuit. A round of cajoling, screaming and cursing brought the servers back online, although a few HDDs were trashed. Noel's blood-pressure receded to something slightly less than the water pressure in the Challenger Deep, and Simon drafted a thoroughly plausible explanation as to why there were shoe prints above head level.

The root-cause for the debacle was traced back to Building Facilities. The server room, normally accessible only to sever admins and the facilities manager, contained an emergency power-off switch. Despite the fact that all of those people were quite clear about the purpose of the switch, and that it was clearly marked, someone with pointy-hair had deemed it an "unacceptable" risk, and decided to do an end-run past change-control to "fix" it. After all, if left unfixed, someone might cut off power to the server room and damage the equipment.

CodeSOD: Role-based Canary

Alex Papadimoulis — Mon, 16 Aug 2010 13:00:00 GMT

Role-based security requires, at a minimum, two key elements: users and roles. Roles (such as Administrator, Clerk, and ViewOnlyUser) are defined by the application code and then assigned to users to restrict which functions of the application they may use. It's a pretty simple concept that involves all of two database tables, or one if the user names come from some external source like Active Directory.

In Adam's case, the Role-based security feature served as a coalmine canary in the application he was tasked with reviewing. Although it passed all of the test cases — employees could only do certain things, customers could do other things, etc. — there was one fundamental flaw with the system. See if you can spot it.

public bool IsInRole(string roleName)
{
   return UserName.StartsWith(roleName.Substring(0, 3));
}

The roleName parameter is a string ("Employee") that's is passed in from a method to check security, and UserName is just that: it's the user's name. So, users with a name that started with "Emp" would be granted access to Employee functions, while no one else would. And why "Emp"? As it turned out, the user names created for testing were "Employee1", "Employee2", "Employee3", and so on.

As for the rest of the system, it's development was similar: it passed the test cases and little more.

Error'd: Existential Philosophy

Alex Papadimoulis — Fri, 13 Aug 2010 13:00:00 GMT

"I got this elegant statement of existential philosophy from Microsoft's Process Monitor utility," Matthew wrote, "It died while trying to start up, so yes indeed, for a few shining moments, the application was."

"I saw this on a Freeview channel in the UK," writes Chris Emerson, "taken out of context, it's really one to mess with your head!"

"I got this receipt after I exchanged a shirt at Beverly Street," writes Sameera, "I wonder whether the person at the counter misunderstood what I wanted them to do."

Kevin Fricke found this unusual error on his company's iPrism server.

"This came through the door a little while back," writes Tom Wright, "I'm not sure what's worse; that they didn't understand about social media or that it wasn't checked before printing and delivering."

"I saw this reboot loop at the Wynn in Vegas," Haig noted, "of course, the people playing didn't seem to mind."

"Every time I turn on my Mac Mini, I have to re-pair my Rocketfish Bluetooth keyboard," Mike Enns wrote, "and every time, the system tells me there is no keyboard connected and that at the same time pairing was successful."

"Gee, thanks Windows 7," Warrick wrote, "I didn't know my problem was most likely caused by my problem."

Production Promote

Remy Porter — Thu, 12 Aug 2010 13:00:00 GMT

"John, it's about time I showed you how to do a production install," Dave said.

John had only been at the job for a few weeks, and was still learning the ins-and-outs of their shop. It was a small team, with the stereotypical alpha-geek at the top, people like Dave in the middle, and John at the bottom. They lived to support a complex pile of applications that all existed to extend or manage their flagship application.

Said flagship was a .NET web app with hundreds of external corporate customers that considered it "mission critical". It was still in .NET 1.1, but the upgrade was coming soon. It was still running on SQL Server 2000, but again, the upgrade was coming soon. That the flagship was a little rickety didn't matter; the application was a "big deal", and that was what the business cared about.

"So, you know the Enterprise Manager," Dave said as he pulled the application up and logged into the test database. "I'm going to export a CREATE script for all of the stored procedures off the test DB." With that done, he explained the next steps as he executed them: log onto production, navigate down the tree to where the stored procedures were, delete that entire branch of objects without mercy, and run the script to recreate them.

While they waited for the delete step to complete, John asked, "Does it usually take this long?"

"No, not usually," Dave admitted. He frowned and the screen and waited a few minutes longer before adding, "I hope it isn't hung… I always worry about just killing something like this. I'm afraid I'll lose data in the database." The task finally completed, and Dave ran the script to create the procedures.

It failed. The procedures, it seemed, already existed. Dave expanded the branch and confirmed that they were still there. "Then what did I delete?" he wondered.

A frantic call from the user support reps answered that question: the tables. Dave had selected the wrong branch and deleted gigabytes of customer generated data. Stunned by the immensity of his screw up, Dave stared at the screen, like it was the oncoming headlamps of a semi. "Should… should we start restoring from backup?" John asked.

"Backup?" Dave said the word, but it held no immediate meaning. "Backup? Backup!" The semi sailed by, and Dave relaxed. The day was saved! They could restore from backup! Dave started hunting down the most recent backup so that they could get the restore underway ASAP.

Unfortunately for Dave, the most recent backup was months old. The backup maintenance task, also Dave's responsibility, had fallen out of the scheduler, and no one had ever confirmed that it was running. The next day, John helped Dave's replacement, Phil, reverse engineer as much data as they could off of other servers and databases. It took weeks to complete. The company lost hundreds of thousands of dollars from the downtime alone, breached several contracts, lost several major customers, and a significant chunk of their reputation.

It wasn't all a loss. John learned a valuable lesson about how not to do a production install.