[HN Gopher] Coder wrote a bug so bad security guards wanted a wo...
___________________________________________________________________
Coder wrote a bug so bad security guards wanted a word when he
arrived at work
Author : amalinovic
Score : 117 points
Date : 2024-12-16 14:05 UTC (8 hours ago)
(HTM) web link (www.theregister.com)
(TXT) w3m dump (www.theregister.com)
| Cthulhu_ wrote:
| This reads a bit like an article from "the daily wtf", I used to
| frequent that one often [0].
|
| [0] https://thedailywtf.com/
| pavel_lishin wrote:
| I still have their mug!
|
| (Which my child consistently gives me shit for. "Dad, why we we
| have a cup with the F-word on it!?")
| baronswindle wrote:
| Sounds like your kid deserves a shoutout on dailystfu.com
|
| In case it needs to be said, I'm kidding.
| SV_BubbleTime wrote:
| This read to me as if someone asked a LLM to create a facebook
| urban legend about a bad programmer and prompted it with a couple
| bullet points.
|
| If it contained the words "you'll never believe what happened
| next..." they would be completely at-home.
| LPisGood wrote:
| This is a cute little story with some technical merit - the
| brief description of the three bugs is kind of interesting.
| duxup wrote:
| I got the same vibe. I hate that I get those vibes wrong
| sometimes, but this story is so devoid of detail and life that
| it seems like the outline of a more realistic story.
| paradox460 wrote:
| Dear Reg, it finally happened to me ...
| jasonjmcghee wrote:
| To me it read like someone saw a Reddit post and decided to
| write a story. Funny so many folks got similar vibes.
| dcminter wrote:
| In the early wild-west days of ecommerce a friend working as a
| tester at a well known British supermarket discovered that the
| backend card-validation logic on their payment form was
| essentially "return true" ... good thing the volumes were
| miniscule I guess?
| The_Blade wrote:
| 100% test coverage
| robertlagrant wrote:
| We know it works because all the happy path tests pass, and all
| the sad path tests fail.
| vrosas wrote:
| I worked at a very well known news company. Their auth proxy
| layer was set to "fail open" for a period of time if there was
| any issue detected in the auth backend (i.e. just return ok and
| a new cookie for 30 seconds). When I checked the logs that
| system was in a fail-open state over 50% of the time.
| michaelteter wrote:
| What's that boast again,
|
| "move fast and break things" ...
| sccomps wrote:
| Breaking things isn't ideal, but it's not the worst. What's
| truly problematic is when everything appears to be functioning
| perfectly, while underlying issues go unnoticed--exactly the
| situation in this story.
| duxup wrote:
| Are all these articles this "lightweight" and short on details
| and sound like a made up coding morality tale?
|
| Just the style here throws me.
| bangaroo wrote:
| i mean the register is kinda more of a tabloid than anything,
| it's real-ish news but with a loose and snarky editorial style,
| so... it's pretty on-brand.
| eitally wrote:
| El Reg is basically The Onion but targeted at enterprise IT.
| That said, for things in that domain -- like SAP or Oracle,
| but especially SAP -- they really do know their stuff and
| offer frequently insightful content.
| crmd wrote:
| I have briefed Register journalists 100+ times and this is is
| absolutely their editorial style. If you go technical, they do
| their best to translate what you've said into analogies that
| mid-market IT managers will understand. It was embarassing
| because my fellow engineers would often read an article and be
| alarmed that _I_ may not understand our technology because of
| this.
|
| The issue is that you can't not brief The Register because
| they're insanely influential with customers in certain tech
| markets. All said, they're usually fun to meet with and many of
| their writers are real characters.
| ChrisMarshallNY wrote:
| They also Know Their Stuff; even if they have a "redtop"
| style.
| dmd wrote:
| Wait, people actually read The Register, like, for real? I've
| been vaguely aware of it for .. 25+ years and in all that
| time assumed it was basically The Onion but for tech.
| shahzaibmushtaq wrote:
| _Ship fast_ they say, but do not ship that much faster.
| bjourne wrote:
| Reminds me of a similar bug in a payment processing system the
| company I worked for used. Long story short, overflow in Java
| numerical types (counting milliseconds for durations in weeks...)
| caused the system to go haywire and charge customers 1000x the
| normal amount...
|
| It turned out very profitable for the company though.
| Stonewalling customers and refusing charge backs is too easy. Not
| picking up the phone is a good business strategy.
| newprint wrote:
| damn
| timmaxw wrote:
| > refusing charge backs is too easy
|
| That doesn't sound right...? Credit/debit card chargebacks are
| handled by the bank. If the merchant doesn't pick up the phone,
| the bank will take the money from the merchant and return it to
| the customer.
|
| https://www.usatoday.com/money/blueprint/credit-cards/credit...
|
| Were you using a different payment system with fewer consumer
| protections than credit/debit cards?
| greenthrow wrote:
| This is not a true story because as a merchant you cannot
| "refuse chargebacks". In fact too many chargebacks will result
| in a loss of your merchant account. You should really stop
| making things up.
| jagged-chisel wrote:
| I read this person as using "chargeback" to mean refund.
|
| However, merchants do have an opportunity to respond to a
| chargeback request. Providing plausible evidence that the
| request is in bad faith will often result in the bank not
| performing an actual chargeback.
| greenthrow wrote:
| Yeah you can dispute them but it's by no means guaranteed
| and it can cause further problems. You certainly would not
| dispute them in the case mentioned by the GP poster. So
| bringing up disputes is just muddying the waters.
|
| Refusing chargebacks and not issuing refunds are two very
| different things with distinct language. And if you don't
| issue refunds for a case like the GP described, where
| thousands of customers were incorrectly billed, you
| certainly would be flooded with chargebacks and likely put
| your merchant account in jeopardy. (Most of the big
| processors would close your account if they get evidence
| you are fraudulently billing customers and actively
| resisting making it right.)
|
| It's clearly a made up story by someone with no experience
| actually managing credit card payments for a real business.
| bjourne wrote:
| Sorry Sherlock, I meant charge back as in "refunds" not
| credit card disputes. Also, merry Christmas.
| seadan83 wrote:
| I recommend to edit your post with an "update" so others
| don't have to dig to find this clarifying comment
| skeaker wrote:
| HN locks out edits after a little while.
| lazycog512 wrote:
| This belongs to the class of bugs/"features" that one could refer
| to as "Superman 3" issues.
| louthy wrote:
| Or, Office Space issues.
|
| (And before anybody says it, yes I know they refer to Superman
| 3 in Office Space)
| rendaw wrote:
| It's unstated but are we to understand that he set up the test to
| send money to a test account which was his own personal account?
| atoav wrote:
| Not to defend that, but the question is how quickly would they
| be able to set that dev up with a test-bank account? In the
| orgs I know this would probably take a month or so.
|
| So taking your own account during early development can make
| sense. Leaving it in is probably a bad idea tho.
| joshribakoff wrote:
| Its my opinion, but you shouldn't need a bank account or even
| internet connection to work on the code at all. Instead its
| better to mock it out in development.
| atoav wrote:
| How do you ensure the mocking system represents an accurate
| and current response without using a real bank account
| first?
| whstl wrote:
| Not unheard of, unfortunately.
|
| Funny enough, in a fintech I worked for, developers and QAs
| actually used their own personal credit cards and bank accounts
| for testing.
|
| Interestingly, they also needed to test ApplePay, but the
| laptops didn't allow for adding their personal iCloud accounts.
| So someone in the development team got the "admin" password and
| distributed among devs and QA team, and they all had
| unprotected laptops. They probably still do.
| wruza wrote:
| I wonder if NOT providing a separate, exclusive
| account/card/sim etc to a developer is a common trope in
| fintech. I avoided linking my personal things like hell, and
| they avoided giving me a damn immutable plastic that would
| work/get paid for more than a few days. So much friction just
| because something stopped working or had to get back into
| oven and they had no replacement at hand. I even had to
| maintain a separate table for tracking personal balance-
| replenishing expenses cause no one's gonna do it immediately.
| The same people who were chirping about the importance of
| experimenting, prototyping and not minding any expenses under
| $$$ or something all day.
| whstl wrote:
| It's a ouroboros of bureaucracy getting in the way of
| security and security causing the bureaucracy itself.
| sleepybrett wrote:
| I work somewhere where it can take four layers of management to
| get a service or test account. No one has time for that shit.
| tetha wrote:
| Stories like this are why I'm happy that the company is
| understanding that OPs, stability and control vs Dev, Fast
| changes and Agility aren't binary, polar opposites, but more of a
| throttle.
|
| Like, for a lot of state free application logic, or even read-
| only frontend stuff, just do. A roll-back or a roll-forward is
| easier than heavy-weight procedure.
|
| But if payment, customer authentication, migrations of large
| databases comes in... Suddenly these ops-guys with their careful
| rollout, validation functionality, dry-runs and ring rollouts are
| pretty good at keeping the day boring.
| RandallBrown wrote:
| I worked for a large retailer on their iPhone app and our test
| environments were terribly slow so we tended to do most of our
| development against production.
|
| This retailer is pretty old and had issued their own credit cards
| that didn't have any sort of checksum validation. This made
| making test orders easy because any sequence of numbers for that
| credit card type would let the "checkout" call succeed, and then
| the order wouldn't actually be fulfilled because the card would
| turn out to be invalid.
|
| We usually used a sequential list of numbers because that was so
| fast to type and we used a made up Address in Tok Alaska. The
| state picker had Alaska first and Tok (also Eek) were the
| shortest city names we could find in Alaska.
|
| One day someone took a look at one of our test account's order
| histories and noticed that there was a tracking link for the
| order. That "fake" credit card number turned out to be quite
| real. We shipped a dress to Alaska, which was then returned to
| sender because the address (1 A St) didn't exist.
|
| We were much more careful after that but as far as I know, nobody
| ever complained and we never heard about it from anyone outside
| our team.
| aristus wrote:
| They literally didn't have a Lunh check digit? Like, 1960s
| math? My gobs are smacked.
| marklar423 wrote:
| I worked on a large makeup website for a while, and it was
| common for us to place test orders and subsequently cancel
| them. The dev doing it usually put their name and the office
| address as the shipping address.
|
| One day, we got a big box of makeup at the office - turns out
| their warehouse had gotten so fast that in the time it took us
| to cancel the order they had already picked & shipped it.
|
| After that we put "TEST DO NOT SHIP TEST DO NOT SHIP" as the
| shipping name and "123 Fake St" as the address to try and avert
| this scenario, which seemed to work until we could modify the
| system to hide those orders from the warehouse entirely.
| glonq wrote:
| Long story short, as a junior programmer I did not fully
| appreciate the difference between credit and debit and ended up
| putting a bunch of money on customer credit cards instead of
| deducting it. And yes the app somehow passed our payment
| processor's validation exercises. Total damage was maybe $10k,
| but I think we managed to roll most of it back.
| iepathos wrote:
| Office Space just keeps replaying in my head. All he needed was a
| timely fire to get away with it.
| IvyMike wrote:
| I always liked this clause from the Underhanded C Contest:
|
| "The Underhanded C Contest was a programming contest to turn out
| code that is malicious, but passes a rigorous inspection, and
| _looks like an honest mistake even if discovered._ "
| Clubber wrote:
| I wrote a faxing queue because our fax server at the time was
| horrible at converting pdf's to fax appropriate tiff's. I didn't
| think to block an area code that was 911. The cops showed up when
| a user accidentally fat fingered 911 as an area code.
| ChrisMarshallNY wrote:
| This reminds me of the bug in the stealing script in _Office
| Space_. The script was supposed to steal fractions of a cent,
| but, instead, it was stealing dollars.
|
| In the end, it turned out OK. The joint burned down, and Milton
| ended up on a beach, sans Swingline.
| DowsingSpoon wrote:
| >Regomize is a made-up word that combines "The Register" and
| "Anonymize." We coined the term to reflect our practice of
| inventing names for contributors to On Call and its sibling
| column Who, Me?. We offer this explanation as in recent weeks
| we've had readers suggest the word is a spelling error.
| karim79 wrote:
| Working at a fortune 500 way back in 2011, I was assigned a
| ticket which was about asynchronously rotating an ad block at the
| top of a public search page on an extremely busy site.
|
| There was a tiny bit of logic in there if I remember correctly,
| relating to when and whom to show the ad to.
|
| I implemented it, tested in dev, assigned it to QA, QA approved
| it and rolled it out that afternoon.
|
| The next morning when I showed up to work one of the other team
| leads walked straight up to me as I entered the campus, laughing
| hysterically.
|
| Turned out that in production it behaved differently. The ad
| appeared, correctly. Then doubled every couple of seconds,1 ad, 2
| ads, 4 ads and so on, until the client browser exploded into
| flames.
|
| As luck would have it there was zero consequence, only chuckles
| all over the place. It was something to do with order of
| inclusion of a mad number of js libraries which differed in
| production and went unnoticed. The End.
| EVa5I7bHFq9mnYK wrote:
| I wrote industrial control software that bumped a very expensive
| piece of equipment against the wall because I miscalculated the
| encoder position. Since then, special limit switches were added,
| colloquially known as anti-EVa5I7bHFq9mnYK switches.
| rekabis wrote:
| At least you got your name on something. Posterity forever!
| bokohut wrote:
| Several payments and financial posts within as money mistakes
| often leave impacting memories for those involved.
|
| As a dotcom kid who founded and wrote the core systems for
| several payment processing companies over the decades I recall
| 2005 when a company using one of our partner banks was breached.
| This was CardSystems, the largest publicly known breach at the
| time, and I was tasked to perform a full code review of their
| systems to find any issues. The payments gateway contained a
| valid crc nontest card number compiled into authorization logic
| that had no deployment switching control and recorded no
| transaction information when that card number was used. Any
| merchant using CardSystems under this payment gateway suffered
| unknown losses from approved transactions that were never
| recorded into any system. I postulated who had done this but
| federal law enforcement around the breach buried this and other
| key discoveries I had found since the company was being dissolved
| and my findings were therefore deemed immaterial.
___________________________________________________________________
(page generated 2024-12-16 23:01 UTC)