I’ll give an example. At my previous company there was a program where you basically select a start date, select an end date, select the system and press a button and it reaches out to a database and pulls all the data following that matches those parameters. The horrors of this were 1. The queries were hard coded.

  1. They were stored in a configuration file, in xml format.

  2. The queries were not 1 entry. It was 4, a start, the part between start date and end date, the part between end date and system and then the end part. All of these were then concatenated in the program intermixed with variables.

  3. This was then sent to the server as pure sql, no orm.

  4. Here’s my favorite part. You obviously don’t want anyone modifying the configuration file so they encrypted it. Now I know what you’re thinking at some point you probably will need to modify or add to the configuration so you store an unencrypted version in a secure location. Nope! The program had the ability to encrypt and decrypt but there were no visible buttons to access those functions. The program was written in winforms. You had to open the program in visual studio, manually expand the size of the window(locked size in regular use) and that shows the buttons. Now run the program in debug. Press the decrypt button. DO NOT EXIT THE PROGRAM! Edit the file in a text editor. Save file. Press the encrypt button. Copy the encrypted file to any other location on your computer. Close the program. Manually email the encrypted file to anybody using the file.

  • i_dont_want_to@lemmy.blahaj.zone
    7·
    8 hours ago

    I was told about a bug in a specific tool. It was being used in production. Apparently we’ve gotten a lot of complaints about it over the years, and they would complain if the site was actively used it always failed.

    I couldn’t find it in the development branch in source control.

    I asked if this tool was purchased from a third party. My boss, who was not a developer, said no. And he was very sure of that. But he didn’t know where the code was.

    I was the developer with the most seniority, and I was there for less than a year at this point.

    I looked again. I finally found it… In an unapproved pull request from a few years prior.

    The meat of this tool basically took information to make an order and create an order in the system.

    Any time we needed to insert a record, it would find the highest Id in the table, increment 1, and insert the new record, id and all. It did this for every entity that needed to be inserted. Address, customer… Everything.

    Worse, very little validation was done. Want to order something but it’s out of stock? No problem, this tool just pushed it right through.

    Want to ship something using a shipping method that doesn’t exist? You got it.

    Want to ship something to an address that doesn’t exist? Sounds like the warehouse’s problem.

    Knowing about the level of knowledge here, you know that there were no transactions. All sorts of unused records were left in the database when there was an error. The users would get a generic error and try again several times, too.

    The worst part was, we have an already existing function that would take order information and try to make an order. And it would give you actionable errors!

    • JackbyDev@programming.devEnglish
      1·
      2 hours ago

      This reminds me of a time at work when we got sued. The company was allegedly using (or had copies) of some tool we couldn’t have anymore. Annoying, but fine. However, to check this, they scanned all of our computers for the name of that company. They told us all to delete our entire local Maven repository. Someone who worked there was on the commiter list for a couple of open source projects. I just manually deleted those files because I knew for a fact that our central Maven repository didn’t have some of the versions of our own code on it and I wasn’t confident we wouldn’t need them again. Turns out I was right and needed to grab one later on to upload. Because I manually deleted the files with the company’s name instead of just deleting everything, the scanner thing they were running didn’t detect offending files. (Not that a file listing someone’s email address as a commiter to an open source project should be offending, but still.)