The Daily WTF

Long Distance

Remy Porter — Tue, 15 May 2012 13:00:00 GMT

Lawrence's employer had heard that this newfangled "Desktop PC" could reduce their IT costs, and they wanted in on it. It was the mid 80s, and at the time, their plants scattered all over Alabama connected to a central mainframe via dumb terminals connected over very expensive leased lines. It was time to upgrade, and Lawrence wasn't in charge of it. He didn't get called in until things went wrong.

"This new PC system is really slow," he was told while on a plant tour. That didn't sound likely- the PCs were running blisteringly fast 4.77MHz, 8088 CPUs with 16Kb of RAM, and since someone had connected "arithmetic-heavy accounting usage" to "floating point processing", they all had 8087 co-processors. There was no way they were slow, especially since half the time they were just running a 3270 terminal emulator.

But sure enough, when they fired up the terminal emulator, it was slower than anything. Going from the login screen to the menu, and then from the menu to the order fulfillment screen took multiple minutes. Was the 300-baud smartmodem that slow? Lawrence fiddled connections, tested the line, and then eventually got around to cranking the volume on the modem's speaker. No, the modem wasn't that slow.

Whoever had configured the deployment had tried to mirror their old system as closely as possible. In the old system, the terminal started a new connection every time the user pressed enter, and then disconnected from the mainframe until the user triggered the next command. So in the new system, they did the same thing- which meant each time the client finished loading a screen, the modem would hang up.

That particular problem was easy to fix, and simply involved making sure each PC had its own phone line, and that the terminal emulator made sure to keep the connection open. But one of their remote offices, someplace deep in the Alabama backwoods, proved intractable- they couldn't connect at all.

Lawrence tried diagnosing their problem remotely at first. The phone line seemed good- he could dial it; the plant users could dial out. He shipped them a fresh modem, and eventually a fresh PC, but nothing seemed to make a difference. They couldn't dial the mainframe. So he had to go out to the plant.

Having learned his lesson, the first thing Lawrence did was crank the volume on the modem speaker. When the computer attempted to dial out, he heard the sound of touchtone bleeps followed by a crackly voice saying, "Number please."

That particular plant was so back in the backwoods of Alabama that it didn't have direct-dial long distance. The users were so used to it that they didn't even think it could be the problem. The small town phone company had no firm plan when they would start doing it. Lawrence helped pack up the PCs and reinstall the dumb terminals. By the time he left that company, they were still using them. They might still be using them today.

Coded Smorgasbord: FAIL FAIL,FAIL FAIL,FAIL FAIL and More

Alex Papadimoulis — Mon, 14 May 2012 13:00:00 GMT

"We're had been using a manufacturer's web service, but started getting errors all of a sudden," wrote Peter Lindgren. "Something has really, really failed."

<StatusCode>InternalServerError</StatusCode>
<StatusDescription>Internal Server Error</StatusDescription>
<WebHeaders>
  <X-Backside-Transport>FAIL FAIL,FAIL FAIL,FAIL FAIL</X-Backside-Transport>
</WebHeaders>

"Fortunately, a short time later, it started working again with this message."

<StatusCode>OK</StatusCode>
<StatusDescription>OK</StatusDescription>
<WebHeaders>
  <X-Backside-Transport>OK OK,OK OK,OK OK</X-Backside-Transport>
</WebHeaders>

"I'm not sure of the purpose of this," Jasmine wrote via the Submit to The Daily WTF visual studio extension, "maybe the stack was just too small or something?"

Public Function Save() As Boolean
    Try
        SaveMeeting()
    Catch ex As Exception
        Throw ex
    End Try
End Function

"I was asked to modify some simple web page used to generate an online store," Mihai Todor wrote, "here's a Javascript function that I found in it, which is used to validate the required fields."

function checkdata() {
    dataok = true;
    t1 = document.forms.signup.firstName.value;
    t2 = document.forms.signup.lastName.value;
    t3 = document.forms.signup.userName.value;
    t4 = document.forms.signup.password.value;
    t5 = document.forms.signup.passwordConfirm.value;
    t6 = document.forms.signup.email.value;
    t7 = document.forms.signup.url.value;
    t8 = document.forms.signup.adminFrontname.value;
    t9 = document.forms.signup.locale.options.selectedIndex;
    t10 = document.forms.signup.currency.options.selectedIndex;
    t11 = document.forms.signup.timezone.options.selectedIndex;
    t12 = document.forms.signup.packetType.options.selectedIndex;
    t13 = document.forms.signup.captcha_code.value;
    if(t1 == '' || t2 == '' || t3 == '' || t4 == '' || t5 == '' || t6 == '' || t7 == '' || t8 == ''){
        alert("Please fill-up all the fields");
        dataok = false; return(dataok);}
    if(t4 != t5){
        alert("Please enter the password again");
        dataok = false; return(dataok);}
    if(t9 == 0){
        alert("Please select a locale");
        dataok = false; return(dataok);}
    if(t10 == 0){
        alert("Please select a currency");
        dataok = false; return(dataok);}
    if(t11 == 0){
        alert("Please select a time zone");
        dataok = false; return(dataok);}
    if(t12 == 0){
        alert("Please select a packet type");
        dataok = false; return(dataok);}
    if(t13 == ''){
        alert("Please fill-up the code field");
        dataok = false; return(dataok);}
    return(dataok);
}

"I've seen these types of constants on The Daily WTF before and always questioned if they were real," wrote Sterge, "and then I saw these."

public static final String SLASH = "/";
public static final String PERCENT = "%";

"I'm on a team that maintains a pretty 'serious' banking application," Giga B wrote, "it's pretty serious about the number of parameters in functions."

public void WriteStep1Data(int LoanRequestID,
                           string InsertDate,
                           string OperatorID,
                           string FirstName,
                           string LastName,
                           string BirthDay,
                           int DocuemntTypeID,
                           int MaritialStatusID,
                           string DocumentIssueDate,
                           string DocumentExpireDate,
                           string DocumentIssuer,
                           string DocumentNo,
                           string PersonalNo,
                           int UniversityDegreeID,
                           string Address,
                           string Address2,
                           int RealAddressLivingPeriod,
                           int ChildrenCount,
                           int FamilyMembersCount,
                           decimal MonthlyIncome,
                           decimal MonthlyFamilyExpanses,
                           string HomePhoneNumber,
                           string MobilePhoneNumber,
                           string WorkPhoneNumber,
                           string EmailAddress,
                           string JobOrganizationName,
                           string JobOrganizationAddress,
                           string JobOrganizationActivity,
                           string JobOrganizationPhoneNumber,
                           string JobPosition,
                           string JobWorkingYears,
                           string JobBossName,
                           string JobBossPhoneNumber,
                           byte ClientSex,
                           decimal FinTotalProductsAmount,
                           decimal FinCommissionAmount,
                           int FinLoanPeriod,
                           decimal FinFirstPaymentAmount,
                           decimal FinLoanAmount,
                           decimal FinMonthlyPaymentAmount,
                           string GuarantorName,
                           string GuarantorLastName,
                           string GuarantorBirthDate,
                           string GuarantorPersonalNo,
                           int? GuarantorDocType,
                           string GuarantorDocumentNo,
                           string GuarantorDocIssuer,
                           string GuarantorDocIssueDate,
                           string GuarantorDocExpireDate,
                           string GuarantorTelHome,
                           string GuarantorTelMobile,
                           string GuarantorAddress,
                           string GuarantorAddressReal,
                           string GuarantorJobName,
                           decimal GuarantorIncome,
                           byte? GuarantorSex,
                           decimal HistoryPlaticAnnualTurnOver,
                           string HistoryDescription,
                           string MarketingQ1,
                           string MarketingQ2,
                           int StatusID,
                           string DateViewed,
                           string DateAnswered,
                           string BackOfficeUserID,
                           string RepaymentDate,
                           string ShopID,
                           string CalculationGroupID,
                           decimal RegFeeAmount,
                           int clientDeptNo,
                           int guarantorDeptNo,
                           int guarantorMaritialStatusID,
                           string AccountCodeWord,
                           string ClientFatherName,
                           string ClientBirthPlace,
                           string ClientCityAttendingToReg,
                           string GuarantorFatherName,
                           string GuarantorBirthPlace,
                           string GuarantorCityAttendingToReg,
                           string GuarantorJobActivity,
                           string GuarantorJobPosition,
                           string GuarantorJobContactPhone,
                           string GuarantorJobCodeWord,
                           string GuarantorEmailAddress
    )
{
   ... snip a few hundred lines ...
}

"I learned a neat trick from our enterprise framework," Eli noted, "if you want to convert an int to a double, just do this!"

double d = Double.valueOf(new Integer(i).toString()).doubleValue();

"I had to look over some C# code written by a colleague of mine," notes John D, "the following lines represent just the tip of the iceberg of the pain that I had to go through while understanding the code."

bool true1 =true;
bool true12 = true;
.... snip ....
true1 = false;
true1 = false;

"I found this pattern in source code I have been working on," wrote Nas Nubian, "this is how some developer decided to open a new window for when users click on a links."

<a href="/the/path/to/the/url" 
  onclick="window.open(this.getAttribute('href'),'_blank');return false;">
  link text
</a>

"So," wonders Johnny B, "I guess GUID from our production db servers are better than local GUID?"

Function GetNewGuid()
    Dim cnGuid, rsGuid
    
    Set cnGuid = CreateObject("ADODB.Connection")
    Set rsGuid = CreateObject("ADODB.Recordset")

    cnGuid.Open = _
        "Provider=SQLOLEDB.1;" + 
        "Data Source=<production server>; " + 
        "Initial Catalog=<production DB> " +
        "user id = '********';" + 
        "password='*********'""

    rsGuid.Open "SELECT newid() as Guid", cnGuid

    If Not rsGuid.EOF Then
        GetNewGuid = rsGuid("Guid").Value
    End If
End Function

"The comment says it all," wrote Michael.

/**
 * Defines the value for none. Default is "none".
 */
public static String NONE = "none";

"This is snippet of code I found in a large program I maintain," wrote Brian. "The original developers have long since moved on. Funnily enough, this particular code was properly mutexed, but I guess the paranoid programmer doesn't trust mutexes. I only wish the original developers were so 'paranoid' when it came to avoiding things like buffer overflows, memory leaks, and sql injection."

if ( resData.state() == RESOURCE_STATE_ACTIVE )
{
    elapsedTime.setBase( resData.startTime() );
    if ( elapsedTime.diff() >= maxDuration )
    {
        // Do one more validity check, the paranoid programmer knows
        // the state may have changed since the last check.
        if ( resData.state() == RESOURCE_STATE_ACTIVE )
        {
            resourceActiveTooLong( resData );
        }
    }
}

Error'd: Squared Interior Design

Alex Papadimoulis — Fri, 11 May 2012 13:00:00 GMT

"I found this ad for an interior design company," wrote Wouter, "they probably do a lot of rectangular designs."

"How am I supposed to troubleshoot this?" wonders Jeff Mitchell.

"I'm not really sure what happened here, but I had to use Chrome's developer tools to hack my birthdate into the form so I could submit it," writes Dave.

"I need this form to renew my immigration documents," writes Jack Nathan, "what do i do now?!?"

"I found this ad for an interior design company," wrote Wouter, "they probably do a lot of rectangular designs."

"My mother's middle name has 3 characters." wrote Julie Crowner. "I only have a middle initial. Fortunately, we're the only ones impacted by this. Well, except Ada. And Aja. And Ala, Ali, Ama, Ami, Amy, Ana, Ann, Ara, Ava, Bea, Bee, Bev, Deb, Dee, Dot, Eda, Ela, Ema, Ena, Era, Eva, Eve, Exa, Fae, Fay, Flo, Gay, Gia, Ica, Icy, Ida, Ila, Ilo, Ima, Imo, Ina, Ira, Isa, Iva, Ivy, Iza, Jan, Joe, Joi, Joy, Kai, Kay, Kia, Kim, Kya, Lea, Lee, Leo, Lia, Liz, Lou, Lue, Luz, Lyn, Mae, Mai, May, Meg, Mia, Mya, Nan, Nia, Nya, Oda, Ola, Oma, Ona, Ora, Osa, Ota, Ova, Pam, Pat, Rae, Ray, Roy, Sky, Sue, Tai, Tea, Tia, Tom, Ula, Una, Ura, Val, Zoa, Zoe, Abb, Abe, Ace, Acy, Ada, Add, Alf, Ali, Amy, Ann, Ari, Art, Asa, Bee, Ben, Bob, Bud, Cal, Cam, Cap, Cas, Che, Con, Coy, Dan, Dax, Dee, Del, Doc, Don, Dow, Ean, Ebb, Edd, Edw, Eli, Ell, Ely, Eva, Fay, Fed, Foy, Gay, Gee, Geo, Gil, Gus, Guy, Hal, Ham, Hoy, Huy, Ian, Ida, Ike, Ira, Irl, Iva, Ivy, Jan, Jax, Jay, Jeb, Jed, Jep, Jim, Job, Joe, Jon, Joy, Kai, Kay, Kem, Ken, Kim, Kip, Kit, Lea, Lee, Lem, Len, Leo, Les, Lew, Lex, Lim, Lon, Lou, Loy, Luc, Lue, Lum, Lyn, Mac, Mae, Mal, Mat, Max, May, Mel, Moe, Nat, Ned, Nim, Noe, Obe, Oda, Ola, Ole, Ora, Ott, Ova, Pat, Rae, Ras, Ray, Red, Rex, Rey, Rob, Rod, Roe, Ron, Roy, Sal, Sam, Sid, Sie, Sim, Sol, Son, Tab, Tad, Taj, Tal, Ted, Tex, Tim, Tod, Tom, Toy, Tre, Tye, Val, Van, Vic, Von, Wes, Yee, Zeb, and Zed." What will people with all these middle names do?

"My company recently partnered with a developer who had a custom applicatio written in Microsoft Access that we are now forced to train/support/install," writes Ben Reisner. "The following error message is just one of many that has an interesting definition of Equal."

Kira Russell snapped this when it was a bit cold in North Wales.

"I'm still getting used to my new keyboard, and occasionally hit the '\' and ENTER keys at the same time," writes Michael Dowden. "I was pretty sure I had done this one morning when I logged in to Windows for the first time, however I got in okay and figured all was well...until I got back from a morning meeting, having locked my workstation. I was greeted with the usual login prompt (screenshot attached), but with '\' appended to my username. I was forced to hard boot my machine since Windows doesn't allow you to edit your username on the locked-login screen."

CodeSOD: Epoch Billing System

Mark Bowytz — Thu, 10 May 2012 13:00:00 GMT

Everybody in the IT department was quite happy -- even a little surprised -- with how well the outsourced project to replace the legacy billing system was progressing.

Well, actually, the project managers weren't all that surprised. Over the past four months, they'd pumped out reams of specs and design documents, often boasting that their level of planning hadn't been seen since the Apollo missions. So, for them, the fact that everything was turning out as designed spoke volumes about the success of their planning and processes.

New Billing Code

Jeff and the other developers who were stuck supporting the existing billing system until the big cutover (still a few months away) wanted to see what this super system looked like under the hood. After all, because they were expected to support the new system once it came online, shouldn't they at least have an understanding of how the underlying code worked?

The developers made their case for months before the project managers gave up on their "it's not done yet" rhetoric and reluctantly handed over a few modules that they'd deemed bug-free.

When Jeff got his hands on the code, one line in particular caught his eye:

int strElapsedDays = ( 
 convertDate(intDay1, intMonth1, intYr1) - 
 convertDate(intDay2, intMonth2, intYr2)) / DAY;

Unusual Process

Knowing that C# had built-in functions to easily determine the span of days between two dates, Jeff thought the approach was a little strange. Once he tracked down convertDate, things got even weirder:

public const int DAY = 86400;
public const int WEEK = 604800;
public const int YEAR = 31449600;
        
private static int convertDate(int day, int month, int year)
{
 
  int[] months = new int[] 
     { 0,31,59,90,120,151, 
       181,212,243,273,304,334 };

  return ( ((year - 1970) * DAY * 365) + 
           (((year - 1970)/4) * DAY) + 
           (months[month - 1] * DAY) + ((day-1) * DAY) );
}

Caught off guard, Jeff just stared at the function for a good 10 minutes, trying to figure it out. When he did, it hit him like a ton of bricks. Rather than using the built-in C# date functions, the developer had opted to convert a date into its Unix Epoch -- the number of seconds elapsed since Jan. 1, 1970 -- and work from there.

Jeff had to admit, the solution was a little bit genius. Unfortunately, it wasn't a fit because the new system was running on a Windows server. So Jeff did his duty and raised the matter with the project management team so it could be added to the bug-fix queue for the offshore team.

Weeks later, Jeff followed up with one of the members of the project management team, just out of curiosity, to see if the fix had been made. To his surprise, it hadn't been addressed -- nor would it be any time soon. Apparently the "bug" was downgraded to a feature request because -- in the eyes of the project managers -- if an application functioned as it was designed, there wasn't a need to go back in and change it.

Epoch Billing System was originally published in the March 2011 edition of Visual Studio Magazine. VSM is the leading site for enterprise .NET developers, and offers a free magazine subscription for influential readers.

The Online Ordering System

Alex Papadimoulis — Tue, 08 May 2012 14:30:00 GMT

Local businesses aren't exactly known for their web savviness or IT prowess. And for the most part, that's just fine. You'd be better off judging a prospective attorney on the suit he wears rather than the website he maintains, as that at least has some tangential relationship to practicing law. But usually, you'd just go with whomever a trusted colleague recommended, anyway.

For restaurants however, this is quickly changing. With smartphones becoming the norm, many people will use the web to discover the restaurants around them, see what menus they have, and get a general vibe for the place. And as such, local restaurants do become judged by their web savviness – or at least, their ability to maintain a halfway-decent website.

Ludovico Gardenghi found himself in this exact position when looking for a local eatery that offered take-out. He stumbled upon the website of a nearby place that, despite having a hideously orange, flash-only website, looked like it'd be a good place to get dinner. And as luck would have it, there was even big, orange button that shouted ORDER ONLINE NOW!!!!!

Clicking on that button led to a rather curious page that described the process for placing an order. The exact words on the page were in a different language, and it translated to something like this:

Order Online Today!
Already familiar with ordering online? Then just head to the online ordering system now. Otherwise, just follow these few simple steps.

Ordering online is really easy:

After reading these instructions, click on the orange, "online ordering system" button below to sign-on to the system

When you click on that link, you will be asked to open a connection to a remote server. Click the "accept" button to immediately sign-on, or click the "save" button to create a shortcut on your computer. With a shortcut, you'll then be able to directly access the online ordering system, even without opening our web site just by clicking on the icon (extension .rdp).

Once you accept the connection, a grey screen will appear, asking you for a password. Do not enter a password here; just click the OK button to continue.

Wait a few moments for the online ordering system to load.

If you've already registered, just you can enter your user ID and password, otherwise click on "Register" button and fill out the registration form.

online ordering system

Clicking on the hideously orange "online ordering system" button downloaded an .rdp file:

    screen mode id:i:2
    autoreconnection enabled:i:1
    username:s:beneeats
    domain:s:
    alternate shell:s:
    shell working directory:s:
    disable wallpaper:i:1
    disable full window drag:i:0
    disable menu anims:i:0
    disable themes:i:0
    disable cursor setting:i:0
    bitmapcachepersistenable:i:1

And opening that .rdp file of course opened a connection to their server using Remote Desktop Connection.

"I didn't try to log in as Administrator," wrote Ludovico, "mostly out of pity." Clicking the OK button did exactly what it advertised:

"I couldn't help myself and pressed Ctrl-Alt-End. This brought up Task Manager, allowing me to run anything I'd want (cmd.exe and explorer.exe were already in the history), or change the password, shut down the machine, etc.

Ludovico adds, "I did not dare to check if I could run things as other users, but I could see other users logged in ('cash desk', 'administration'), presumably so that the complete database of users, orders, and payments could be easily accessed from home. I visit this website from time to time and it has surprisingly survived over the past few years, though I would really love to know the story which led to this innovative online ordering system being created in the first place."

And that story, dear readers, I'll leave as an exercise of your imagination. Feel free to share your version of the story in the comments.

CodeSOD: The Bit Setter

Alex Papadimoulis — Mon, 07 May 2012 13:00:00 GMT

"Bit manipulation can be tricky," writes Nathan, "especially if you have no familiarity with bitwise operators or logic."

"At least, that's what my smarter-than-built-in-language-features colleague must have thought when he authored setBit. Fortunately, his code was the only one that utilized this function, as it doesn't quite work as advertised."

/*
 *    setBit($val, $bit, $switch)
 *
 *    This will switch all the bits specified by $bit to on or 
 *    off in $val depending on $switch. So, if $val = 8, and 
 *    $bit = 4, $switch is true, it will turn on the 4 bit, 
 *    and $val will end up being 12; Now, if $val = 12, and $bit 
 *    is 5, if $switch is true, $val will be 13, if false $val 
 *    will be 8. So, all the bits of $bit is turned on or off
 *
 */
function setBit($val, $bit, $switch = true) {
    $val = (int) $val;
    $bit = (int) $bit;

    // set some strings that humans would consider false
    // but would be converted to true if converted by PHP
    if (is_string($switch)) {
        switch ($switch) {
            case 'false' :
            case 'down' :
            case 'off' :
            case 'not' :
            case '0' :
            case '' :
                $switch = false;
                break;

            default :
                $switch = true;
                break;
        }
    }

    if ($switch) { // we are turning the bits on
        $newval = $val | $bit; // val OR bit
    }
    else { // we are turning the bits off
        $newval = $val & ( ~ $bit); // val AND ( NOT bit)
    }

    return $newval;
}

Sponsor Appreciation, nullnull, and More Error'd

Alex Papadimoulis — Fri, 04 May 2012 15:00:00 GMT

Please take a few moments to check out the great companies that sponsor The Daily WTF.

TDWTF Sponsors

JRebel is a JVM-plugin that makes it possible for Java developers to instantly see any code change made to an app without redeploying. JRebel lets you see code changes instantly, reloading classes and resources individually and updating one at a time instead of as a lump application redeploy. Download your FREE Trial Today!

Joyent - This cloud ain't for storing music. Running your apps on Joyent's open-source SmartOS is a different, smarter cloud choice. Automatic and Free 400% vertical scaling, copy-on-write with ZFS, DTrace for killer visibility (heat maps! flamegraphs!) Come check out our stack.

Inedo - the makers of BuildMaster, the free, and easy-to-use, web-based deployment and release management tool. Going far beyond Continuous Integration and into Continuous Delivery, BuildMaster delivers a series of robust features unparalleled by other build-promote-deploy-distribute tools. They're also behind the upcoming ProGet, a NuGet package repository that lets you host and manage your own personal or enterprise-wide NuGet feeds.

And now back to our regularly scheduled program...

"I don't know what they were thinking putting this ad up," writes Christian Riesen, "but I think I can hold my enthusiasm for that gigantic jackpot easy."

"I spotted this while upgrading the Samsung KIES software on Windows," writes Scott Coonce, "I wasn't sure if I should accept the empty license agreement or not."

"I got this error when trying to upgrade PostgreSQL," writes David, "they must really like cloud computing."

"I was rushing to catch my train at St. Pancras the other day," notes D Bee, "but it appears there was plenty of time before it departed."

"I'd hate to be selfish and not share null with the other readers of the Daily WTF," wrote Dwayne, "I hope you find the same benefits of null that I have."

"The newspaper didn't really contain any interesting news," writes Wout van Poppel "but at least it has interesting photo captions which serve to draw attention quite well."

"Free drink every 0 stars?" writes Andrew ,"wow, now I really want to get to be a 'Gold' members!"

CodeSOD: Mybad

Alex Papadimoulis — Thu, 03 May 2012 00:00:00 GMT

"At my company," writes Ryan L, "we have a 'certain' developer who has been here a while but is very reluctant to learn or improve. In fact, he actively works against the rest of us when we want to implement pesky things like proper version control, design patterns, or architecture to our code behind having 3000-line code-behind files."

Ryan continues, "I was exploring our SVN logs and came across something checked in by this "engineer". It was a single file, with a commit message of 'Mybad'. The file turned out to be a config file. Here was the previous version checked in:

<app key="ContactEmailAddress" value="jdoe@initrode.com"/>

"and here was the modified value:"

<app key="sContactEmailAddress" value="jdoe@initrode.com"/>

"Yes," Ryan added, "he did a commit with no indication of what the commit was for, simply to add a Hungarian Notation prefix to a configuration file setting, in case we weren't sure that 'ContactEmailAddress' was a string."

CodeSOD: Self Documenting

Alex Papadimoulis — Mon, 30 Apr 2012 15:15:00 GMT

"A little while back, someone introduced the concept of 'self-documenting' code to our team," writes Ryan L. "It was certainly a step forward, but it's somehow taken us two steps backwards. Consider, for example, the following code from an MVC controller."

if (TheFormIsInvalid()) return View("Index", form);

... snip ...

private bool TheFormIsInvalid()
{
    return ModelState.IsValid == false;
}

"Is it really that much easier to follow than if (!ModelState.IsValid)? I'll set that question aside for the moment to instead present some other code from the same class that handles online registrations for events:

public bool IsEligibleToSeeThisEvent(EventRegistrationInformation eventRegistrationInformation)
{
  if (ThisEventDoesNotRestrictRegistrantsBasedUponActivityType(eventRegistrationInformation))
      return TrueBecauseThisEventDoesNotRegistrictBasedUponActivityType();

  var activityTypes = GetTheActivityTypesAttachedToThisEvent(eventRegistrationInformation);

  if (NoActivityTypesAreAttachedToThisEvent(activityTypes))
      return TrueBecauseThereAreNoActivityTypesToFilterOnThisEvent();

  if (TheUserIsNotLoggedIn(eventRegistrationInformation))
      return FalseBecauseNoActivityTypesAreAvailableForUsersWhoAreNotLoggedIn();

  return ThereIsAtLeastOneSharedActivityTypeBetweenTheEventAndCurrentUser(
           eventRegistrationInformation, 
		   activityTypes);
}

private static bool TrueBecauseThisEventDoesNotRegistrictBasedUponActivityType()
{
  return true;
}

 private bool ThisEventDoesNotRestrictRegistrantsBasedUponActivityType(
    EventRegistrationInformation eventRegistrationInformation)
{
  return eventActivityTypeFilterRetriever
      .DoesThisEventHaveARestrictionBasedOnActivityTypes(
          eventRegistrationInformation.EventId) == false;
}

private bool ThereIsAtLeastOneSharedActivityTypeBetweenTheEventAndCurrentUser(
    EventRegistrationInformation eventRegistrationInformation, 
	IEnumerable<ActivityType> activityTypes)
{
  var currentActivities = registrantActivityRetriever
    .GetRegistrantActivityProductCode(eventRegistrationInformation.AccountId);

  return activityTypes.Any(x => currentActivities.Any(y => y.Id == x.Id));
}

private static bool FalseBecauseNoActivityTypesAreAvailableForUsersWhoAreNotLoggedIn()
{
  return false;
}

private static bool TheUserIsNotLoggedIn(EventRegistrationInformation eventRegistrationInformation)
{
  return eventRegistrationInformation.IsLoggedIn == false;
}

private static bool TrueBecauseThereAreNoActivityTypesToFilterOnThisEvent()
{
  return true;
}

private static bool NoActivityTypesAreAttachedToThisEvent(IEnumerable<ActivityType> activityTypes)
{
  return activityTypes.Any() == false;
}

private IEnumerable<ActivityType> GetTheActivityTypesAttachedToThisEvent(
    EventRegistrationInformation eventRegistrationInformation)
{
  return eventActivityTypeFilterRetriever.GetAll(eventRegistrationInformation.EventId);
}

Error'd: Out of Service

Alex Papadimoulis — Fri, 27 Apr 2012 13:00:00 GMT

"I came across this 'digital' sign in NY Penn Station," Dan wrote, "for some reason, it makes me think of Mitch Hedberg."

"I'm going through the process of applying to law school," wrote Alex M, "it's not an easy process, but so far it has been incredibly streamlined and, even more surprising since it's entirely online, hitch-free. And then I came to a certain school's application. Not only was it redundant (in certain sections, triply so -- apparently they wanted my name three times just to make sure I remembered it), but I discovered that gender isn't merely a Male/Female/Other, but in fact is a binary proposition for each possible state."

"I was really confused about what I was supposed to choose," writes Audun Kvasbø.

"I was accessing the MSDN Academic Alliance site to download Visual Studio," wrote Louis W, "but I wasn't sure which school I went to. Is it 'Arizona State University' or 'ASU'? Perhaps 'Arizona State Univerrsity'? And what's 'is dept'?"

"My opinion is important to Congressman Peters..." notes Eric, "so long as I don't express it with the forbidden words."

"My uncle recently ordered a product sample on the internet," wrote Alex van Herwijnen, "when it got delivered, he noticed this oddity in the address."

"I guess leading digit in 'Brooklyn' is not just silent but invisible," writes Gabriel Goldberg.

"I did a search for a user in Sametime," wrote Ken Brittain "Apparently there are too many user with that name...or none at all."

Classic WTF: Behavioral Deficiencies

Alex Papadimoulis — Wed, 25 Apr 2012 14:00:00 GMT

I'm on vacation this week and am a bit behind on all things TDWTF; so, here's Behavioral Deficiencies. It's a classic that was originally published on February 28, 2008.

Shawn O. was not used to bright lights, smiling faces, or greetings like “hi Shawn, how are you today?” In fact, just about anything that wasn’t specifically intended to bring pain and misery to all had become foreign to him. It was simply par for the course. Shawn, after all, was an Oracle DBA. And not just any Oracle DBA, but one who sat on the company’s Database Code Review Council.

Like at many other Oracle shops, the Council at Shawn’s company was responsible for defining policies and procedures to make it virtually impossible for any developer within the company to make changes to their databases. For example, if a developer wanted to change, say, the columns retrieved from a single SELECT statement, he’d have to fill out a ream of paperwork, venture all the way up to the top floor, find his way to The Council’s chambers, humbly plead his case to The Council’s members – each of whom would be ensconced in darkness, wearing their traditional Oracle DBA robe – and then repeat the process several times after The Council ridicules him for missing paperwork, too little whitespace, too much whitespace, etc., and rejects his request for change. It’s just the way things work.

A New Opportunity
That said, imagine Shawn’s surprise when a former developer colleague called him up one day to see if he’d be interested in a different Oracle DBA job. Apparently, the developer’s company was looking to “Oracle-up” and invest big in a real Oracle installation. And really, what Oracle installation would be complete without its very own Oracle DBA?

A few days and a brief, two-minute phone screen later, and Shawn was at the new company, interviewing for the position. It all went extremely well: he barely had to say his name and they were sold. Shawn was offered more and a Senior Oracle DBA position, and did the only logical thing: he took the job. After all, who wouldn’t jump at the chance to create his very own draconian Code Review Council?

The new company was different. They had things like bright lights. People smiled and offered one another friendly greetings. They didn’t have things like the Pit of Despair. There wasn’t even a single oubliette for those who dared to break the build. But fortunately, the company was willing and ready to change that. After all, that’s why they hired an Oracle DBA.

Making Change
Unfortunately, change was not so easy. First came the money problems. Their plan to develop a “large Oracle cluster” was scaled back to a “medium Oracle cluster” and then, finally, to a “single Oracle server.” Worse still, their development strategy had gone from “cutting edge” to “barely holding an edge,” leaving things like continuous integration and quality assurance to fall by the wayside.

And that’s when the second problem – the cultural clash – started to occur. Shawn fought arduous battles with developers over formal code review, query tuning, and access restrictions. The developers insisted upon changing things immediately and fixing problems later, while Shawn demanded a rigorous QA process. Naturally, this led to a lot of heated arguments, a whole lot of swearing and bad-mouthing, and, usually, Shawn conceding his position.

After one of the more intense database code review sessions Shawn received a “one-on-one” meeting request from his boss. The subject was simply “Behavioral Deficiencies.”

Shawn had a gut feeling about what the meeting would be about: his strict policies and gruff attitude were simply unacceptable, and that he’d need to either shape up or ship out. And he knew exactly how he’d respond: there’s no way he was going to compromise further, as he was already operating in DBA-lite mode; heck, he even stopped dimming the lights and wearing his robe to code review meetings; in fact, they’d need to shape up or he’d ship out.

After three eternal hours, Shawn went to his boss’s office for his “Behavioral Deficiencies” meeting.

“Hi Shawn,” his boss started, “take a seat please.”

Shawn nervously sat down. He was still prepared to rattle off his “no, you shape up” retort, though not as confidently as he had fantasized.

“I’ve been reviewing some of your emails as of late,” his boss paused, “and I have to say, we’re a bit concerned. I’ve printed out a handful here, why don’t you take a look yourself.”

Still not saying a word, Shawn flipped through the small stack of paper. Each page had several highlight marks, and each word that was highlighted was either “I”, “I’ve”, or “I’ll”. Shawn let out a confused, “ummm…”

“Okay,” the boss started again, “so you see what I’ve highlighted? Do you notice something a little off there in your email?”

“I, uhhh,” Shawn mumbled, “ummm, well…”

“You don’t see it, do you?”

Shawn paused for a moment.

“You need to use the word ‘we’ more often. Look here,” his boss pointed to a highlight, “you say ‘I've put these policies in place’, but what you really need to say is, ‘we've put these policies in place.’”

“Okay,” Shawn raised his left eyebrow, “we?”

“Exactly,” his boss responded, “the word ‘I’ is just too negative. You are a part of us, and we make decisions for us. Even if it’s just you who made the decision, it’s really us who made it.”

Shawn stared blankly, trying to figure out what exactly his boss was saying.

“You see, Shawn, what we do is all about the team. One big team. Synergy. We know it feels like your DBA team against the development team – but really, it’s all just one big team.”

“That makes perfect sense,” Shawn said half-sarcastically. After all, he was the only Oracle DBA in the company. He expected his boss to crack up any moment.

“We’re just really concerned, though, that you’re not thinking team. Obviously, we’re all individuals, but we – you included – make up the team.”

“Got it,” Shawn replied. Unfortunately, though, his boss didn’t seem to hear that, or any of his subsequent “okay,” “will do”, “gotcha”, “allrightythen”, “okie-doke”, “you-betcha” responses. For the next thirty minutes, Shawn’s boss continued to lecture on the importance of team.

Finally, just before Shawn had heard all that he can take, his boss wrapped things up. “But what this all boils down to, is that we want you to feel free to express yourself in the manner of ‘we’ as opposed to using the word, ‘I’. We just think it would be better for the synergy of the team and for your own personal benefit to express yourself in that matter.”

Though Shawn had long since run out of thanks-we-get-the-point phrases, he replied with the thrice said, “understood!” He returned to his cubicle and took a few minutes to breathe in the absurdity of the last hour of his life. At least the good news, Shawn figured, was that there was no issue with the harsher and harsher policies he was implemented.

Just then, an email showed up his inbox. It was from one of the developers, was marked high-importance, and had the subject line, “EMERGENCY DB CHANGE - PLEASE RUN SCRIPT NOW”. Shawn wryly smiled and clicked reply.

“We apologize, but per the new Database Emergency Change Procedure we established, we are unable to run this script from an email request. Per the procedure, please request an emergency change review meeting, and we’ll be happy to review your change.”

On any day prior, Shawn would have probably just run the script and demanded that the developer follow procedure next time. But that day, he was instilled with a new sense of Oracle DBA Team synergy. After sending the reply, he dusted off his Oracle DBA robe in preparation for the code review. It was time, once again, for the Database Code Review Council to meet.

CodeSOD: The Enterprise User Agent

Alex Papadimoulis — Tue, 24 Apr 2012 13:00:00 GMT

"When the job ad specified that an 'enterprise' Senior Java Developer was needed, I knew I'd be in a treat for some enterprisey goodness," writes Chris B, "but what I didn't expect was the User Agent Detection Generation Framework. Here's what the API for this framework looks like."

"It's apparently designed to put an end to the extreme challenge of parsing user agent strings sent by various web browsers and devices. Here's what the UserAgent implementation looks like. I mean, an implementation; this is, naturally, extensible enough to handle any user agent parsing factory implementation."

"Based on the commit history, it took several months to create this masterpiece. There are more than forty Java classes, eight interfaces, and several hundred lines of XML configuration. Speaking of which, here's the configuration XML for Firefox:"

<!-- ============================================================================================================== -->
<!--                                                     Firefox                                                    -->
<!-- ============================================================================================================== -->

<!-- Firefox -->
<ua:UserAgent ua:id="Mozilla Firefox" ua:browser="Firefox" ua:version="$6" ua:platform="$1">
  <ua:Element ua:id="mobile" ua:type="boolean" ua:value="false" />
  <ua:Element ua:id="osName" ua:type="string" ua:value="$2" />
  <ua:Element ua:id="osVersion" ua:type="number" ua:value="$3" />
  <ua:Element ua:id="engineName" ua:type="string" ua:value="Gecko" />
  <ua:Element ua:id="engineVersion" ua:type="number" ua:value="$4" />
  <ua:Detection>
    <!-- 
      Mozilla/5.0 (Windows; U; Windows NT 5.1; nl-NL; rv:1.7.5) Gecko/20041202 Firefox/1.0
      Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
      Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6
      Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051107 Firefox/1.5
      Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
      Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
      Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 
      Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5        
		Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a5pre) Gecko/20100418 Minefield/3.7a5pre
		Mozilla/5.0 (Windows NT 5.1; rv:2.0b6) Gecko/20100101 Firefox/4.0b6        
    -->
    <ua:RegExp>Mozilla/5.0 \((Windows).*(Windows NT) (\d+\.\d+).*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Firefox/(\d+\.\d+).*</ua:RegExp>
    <ua:RegExp>Mozilla/5.0 \(.*(Windows) (NT) (\d+\.\d+).*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Firefox/(\d+\.\d+).*</ua:RegExp>
    <ua:RegExp>Mozilla/5.0 \((Windows).*(Windows NT) (\d+\.\d+).*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Minefield/(\d+\.\d+).*</ua:RegExp>

    <!-- 
      Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4
      Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5
      Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2
      Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
      Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.6) Gecko/20060808 Fedora/1.5.0.6-2.fc5 Firefox/1.5.0.6 pango-text
      Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1) Gecko/20060601 Firefox/2.0 (Ubuntu-edgy)
      Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.2) Gecko/20070220 Firefox/2.0.0.2
      Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.2) Gecko/20070221 SUSE/2.0.0.2-6.1 Firefox/2.0.0.2         
      Mozilla/5.0 (X11; U; Linux i686; en-US; rv:2.0a1pre) Gecko/2008060602 Minefield/4.0a1pre
		Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
    -->
    <ua:RegExp>Mozilla/5.0 \((X11); U; (\w+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Firefox/(\d+\.\d+).*</ua:RegExp>
    <ua:RegExp>Mozilla/5.0 \((X11); (\w+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Firefox/(\d+\.\d+).*</ua:RegExp>
    <ua:RegExp>Mozilla/5.0 \((X11); U; (\w+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Minefield/(\d+\.\d+).*</ua:RegExp>
    <ua:RegExp>Mozilla/5.0 \((X11); (\w+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Minefield/(\d+\.\d+).*</ua:RegExp>


    <!-- 
      Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
      Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7
				Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:5.0) Gecko/20100101 Firefox/5.0  
    -->
    <ua:RegExp>Mozilla/5.0 \((Macintosh); U; ([^;]+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Firefox/(\d+\.\d+).*</ua:RegExp>
    <ua:RegExp>Mozilla/5.0 \((Macintosh); ([^;]+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Firefox/(\d+\.\d+).*</ua:RegExp>
	  	<ua:RegExp>Mozilla/5.0 \((Macintosh); U; ([^;]+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Minefield/(\d+\.\d+).*</ua:RegExp>
	  	<ua:RegExp>Mozilla/5.0 \((Macintosh); ([^;]+)().*rv:(\d+\.\d+).*\).*Gecko/(\d+).*Minefield/(\d+\.\d+).*</ua:RegExp>

  </ua:Detection>
</ua:UserAgent>

Error'd: A Minor Error

Alex Papadimoulis — Sat, 21 Apr 2012 09:00:00 GMT

"I was a bit worried when I received an alert from the bank telling me that my balance went bellow $25," Mike, "I called the bank to see what was going on, and they chalked it up to a 'minor' error. I'd sure like to know what a major one is..."

"At first I thought the 800x601 requirement was a bit odd," wrote Odi, "but then I realized that my 800x602 resolution should have been more than adequate."

"One of these flip-flop thumbnails is far more appealing to me than the others," wrote Modano, "see if you can guess which one."

"I spotted this while waiting at my local McDonalds drive-thru," Christopher Scholfield writes, "I told the attendant I didn't order that, she didn't quite get the joke."

"My credit card expired, so I thought I'd delete the credit card registration," Karsten wrote, "or not."

"My friend is an old school hacker and has been online for quite a long time," wrote Johnny, "but I'm pretty sure he wasn't idle that long."

"Based on the unit price," Sam writes, "my local grocery appears to have found a supplier of infinitely heavy salami."

"So, which is it," wonders Joey, "or if the error message has been APPROVED, what was the actual message?"

Representative Line: Simple Date Validation

Alex Papadimoulis — Thu, 19 Apr 2012 17:30:00 GMT

Simple Date Validation "I'm very fortunate that my new job is at a cool company working with cool coworkers on cool projects," writes Dave via the Submit to WTF Visual Studio Plug-in.

"Of course, it wasn't always like this. Many years back, WTF Joe (as we now call him) was a key contributor to our codebase and always worked hard to find the hardest way to do the simplest things. Like date validation.

args.IsValid = new Regex(@"^((0?[1-9]|[12][1-9]|3[01])\.(0?[13578]|1[02])\.20[0-9]{2}|(0?[1-9]|[12][1-9]|30)\.(0?[13456789]|1[012])\.20[0-9]{2}|(0?[1-9]|1[1-9]|2[0-8])\.(0?[123456789]|1[012])\.20[0-9]{2}|(0?[1-9]|[12][1-9])\.(0?[123456789]|1[012])\.20(00|04|08|12|16|20|24|28|32|36|40|44|48|52|56|60|64|68|72|76|80|84|88|92|96))$").IsMatch(args.Value, 0);

"I guess his feeling for this was that the database will do another date validation anyway, so it's not that big of a deal."

The Core Launcher

Alex Papadimoulis — Wed, 18 Apr 2012 16:30:00 GMT

“You R haccking files on my computer~!!!” Charles Carmichael read in a newly-submitted support ticket, “this is illigle and I will sue your whoal compiny. But first I will tell every1 nevar to buy youre stupid game agin.”

The bizarre spelling and vague threats were par for the course. After all, when you market and sell a game to the general public, you can expect a certain percentage of bizarre and vague customer communications. When that game is a popular MMPORG (no, not that one), that percentage tends to hover around the majority.

It took a few days to see the pattern, but the string of emails started to make sense. “Uh, when did your game become spyware?” said one email. “Are you doing this just to force us to play more often?” another customer asked. “I know you have a lot of AI and whatnot, so I think it leaked out. Because now my whole computer wants me to play all the time… like my dog bringing me his chew toy.”

As it turned out, the problem started happening a few days after an update to the core launcher was published. The core launcher was one of those terrifically handy executables that could download all of the assets for any single game that was published, scan them for completeness, replace bad or missing files, and then launch the game itself after the user signed in. It’s a must-have for any modern multiplayer online game.

This core launcher could also patch itself. Updates to this executable were fairly rare, but had to be made whenever a new title launched, as was recently the case. Obviously, a large battery of automated and manual testing is done to ensure that there are no problems after publishing, yet something seemed to have slipped through the cracks… at least for some customers.

After a whole lot of back and forth with customers, Chris was able to compile dozens of detailed process lists, startup program launches, newly installed applications, and firewall usage rules. As he pored over the collected information, one program was always there. It was Interfersoft’s fairly popular anti-virus suite.

It took a solid two days of research, but Chris was finally able to uncover the new “feature” in Interfersoft’s Advanced Firewall Protector that was causing the problems. Like many similar anti-virus suites, when a program wanted to use network services, Interfersoft would pop-up a dialog confirming that the program’s operation was authorized. Behind the scenes, if the user allowed the program, Interfersoft would make a hash of that executable file, and would allow its communications to pass through the firewall every time thereafter.

Users who had this antivirus solution installed had, at one time, allowed the launcher through their firewall. The first time they connected to the game server after the launcher patch was released, their executable would download its patch, apply it to itself, and restart itself. But then of course, the executable hash didn’t match any more, and the program was no longer able to go through the firewall.

Rather than asking users if they wanted to allow the program to connect to the internet, in the new version of Interfersoft’s suite, the anti-virus system would rename the executable and move it. The logic being that, if it was changed after connecting to the internet, it was probably malware.

But what did they name the file? Program.exe. Unless that was already taken, then they would name it Progra~1.exe or Progra~2.exe and so forth. And where did they place this file? Well, in the root directory of C of course!

This naming convention, as it turned out, was a bad idea. Back in the very old, Windows 3 days, Windows did not support long file names. It wasn’t until Windows NT 3.5.1 (and then Windows 95 later) that long file names were supported. Prior to this, there were a lot of limitations on what characters could be part of a filename or directory, one of those being a space.

In fact, any space in a shell command execution was seen to be an argument. This made sense at the time so you could issue a command like this:

C:\DOOM\doom.exe -episode 3

That, of course, would start Doom at episode 3. However, when Microsoft switched to Long File Names, it still had to support this type of invocation. So, the way the windows cmd.exe shell works is simple. You pass it a string like this:

C:\Program Files\id Software\Doom\Doom.exe -nomusic

And it will try to execute “C:\Program” as a file, passing it “Files\id Software\Doom\Doom.exe -nomusic” as argument to that executable. Of course, this program doesn’t exist, so it will then try to execute “C:\Program Files\id”, passing it “Software\Doom\Doom.exe -nomusic” as argument. If this doesn’t exist, it will try to execute “C:\Program Files\id Software\Doom\Doom.exe” passing in “-nomusic” as an argument. It would continue this way until a program existed and started, or until the path was depleted and no program was to be found.

And on top of all this, desktop shortcuts on Windows are mostly just invocations of the shell, with the actual location of the executable you want to start (the path) stored in text inside the shortcut. When you click it, it reads this path, and passes it to the shell to start up the program. And this is why Intersoft’s process of moving files to the root directory was the worst decision they could have made.

Most of the programs installed in Windows at this time were installed to the “Program Files” directory by default. This was a folder in the root (C:\) directory. So when you wanted to launch, for instance, Microsoft Word, the shortcut on your Desktop pointed to “C:\Program Files\Microsoft\Office\Word.exe” or Firefox, which was in “C:\Program Files\Mozilla\Firefox\”. But thanks to Program.exe in the root directory, you ended up doing this:

C:\Program.exe “Files\Microsoft\Office\Word.exe”

and

C:\Program.exe “Files\Mozilla\Firefox\”

So, when users were trying to launch their application – applications which resided in the Program Files directory on their C drive – they were getting the launcher instead.

Chris explained all of this in great detail to Interfersoft, all the while explaining to customers how to fix the problem with the firewall. It helped some, but several hundred customers ended up closing their accounts a direct result of the “hacking”.

A few weeks later, Interfersoft started responding to the issues with their customers. Fortunately (for them), they decided to not use their own auto-update process to deliver a new version of the firewall.

TDWTF Sponsors
		JRebel is a JVM-plugin that makes it possible for Java developers to instantly see any code change made to an app without redeploying. JRebel lets you see code changes instantly, reloading classes and resources individually and updating one at a time instead of as a lump application redeploy. Download your FREE Trial Today!
		Joyent - This cloud ain't for storing music. Running your apps on Joyent's open-source SmartOS is a different, smarter cloud choice. Automatic and Free 400% vertical scaling, copy-on-write with ZFS, DTrace for killer visibility (heat maps! flamegraphs!) Come check out our stack.
		Inedo - the makers of BuildMaster, the free, and easy-to-use, web-based deployment and release management tool. Going far beyond Continuous Integration and into Continuous Delivery, BuildMaster delivers a series of robust features unparalleled by other build-promote-deploy-distribute tools. They're also behind the upcoming ProGet, a NuGet package repository that lets you host and manage your own personal or enterprise-wide NuGet feeds.