WTF Bites

Gribnit

Status: I successfully executed the tar command (probably) correctly the first time!

Congratulations! A little blood is normal. It'll get better.

kazitor

@Bulb said in WTF Bites:
The documentation also suggests this for getting the unix time:
(julianday('now') - 2440587.5)*86400.0
How about no? That's even worse; it's now got mysterious constants in it!

Okay okay calm down

#define EIGHTY_SIX_THOUSAND_FOUR_HUNDRED 86400.0
#define TWO_MILLION_FOUR_HUNDRED_AND_FORTY_THOUSAND_FIVE_HUNDRED_AND_EIGHTY_SEVEN_POINT_FIVE 2440587.5

Gąska

@kazitor TIL the C standard requires the implementation to support at least 127-argument macros.

Hundred. Twenty. Seven. Arguments.

Tsaukpaetra

@Gąska said in WTF Bites:

@kazitor TIL the C standard requires the implementation to support at least 127-argument macros.

Hundred. Twenty. Seven. Arguments.

Yes, UE4 uses that for its blueprint macro expansion template thingy.

Gribnit

@Tsaukpaetra said in WTF Bites:

@Gąska said in WTF Bites:

@kazitor TIL the C standard requires the implementation to support at least 127-argument macros.

Hundred. Twenty. Seven. Arguments.

Yes, UE4 uses that for its blueprint macro expansion template thingy.

Sounds like a thingy.

remi

Dates are hard, let's string them together.

I have some code that returns a boost::posix_time::ptime and I need to pass it to another function in the UI that uses the UI toolkit's class, i.e. QDateTime.

After a bit of fumbling around with various functions on both sides, it turns out that the easiest way to do this conversion is to get the date written as an ISO date, and parse that string back

(fake edit: actually my starting point isn't really a ptime as I initially thought, it's a custom class in a 3rd-party library that does more or less the same thing, but that doesn't change the fact that the easiest way to convert from one data structure to another is to go through a string.)

Bulb

@remi Yes, dates are hard. Colleagues here are currently working on replacing an excessively memory-hungry xmlplus xml binding library with a codesynthesis one. The old code used xmlplus' DateTime and Duration types to do some date calculations, because xmlplus does define arithmetics on them (I didn't bother checking how correctly; iso-8601 is Complicated™). But the corresponding types in codesynthesis only support serialization and deserialization and you have to do the rest yourself (IMO the authors rightfully consider it out of scope; iso-8601 is Complicated™). So colleague implemented the functions corresponding to what the old code used. Well, the function to convert duration to unix time with mktime was really a sight to behold.

… the real point is that we don't need duration at all, and never really did. The code should be adding the linear timestamps (in microseconds or nanoseconds, usually) and then just convert to/from datetime for serialization and deserialization of xml. Reminds me the merge request is up since one or two days ago; I need to check whether it's fixed.

Tsaukpaetra

@remi said in WTF Bites:

After a bit of fumbling around with various functions on both sides, it turns out that the easiest way to do this conversion is to get the date written as an ISO date, and parse that string back

I nearly immediately predicted this would be your solution after your described problem.

Fuck dates!

remi

@Tsaukpaetra That also was my first instinct when I stumbled upon the problem. Then I thought that it really was a retarded way to do things and could possibly be a huge performance issue if I were to do that often (fortunately that's not the case, but still) so I thought there must be a saner way to do it. And the rest, as they say, is history.

dkf

@Tsaukpaetra said in WTF Bites:

Fuck dates!

That seems… well, OK. You do you.

cvi

@Gąska said in WTF Bites:

Hundred. Twenty. Seven. Arguments.

There's at least one somewhat amusing use case where I can see realistically hitting that limit. One of the methods for embedding GLSL code into C/C++ is to use a macro like such:

#define GLSL(...) #__VA_ARGS__
//...
constexpr char const* shaderSource = GLSL(
    #version 130 \n

    layout( location = 0 ) out vec3 outColor;

    void main()
    {
        outColor = vec3(1.0);
    }
);

If you have a comma separated list that is not inside a set of parentheses, it'll split the "code" into separate arguments for the purpose of the macro. One example would be a declaration such as vec3 a, b, c; which means that there would be at least three different arguments to the macro.

Is the macro pretty? Nah. Is it useful? Yeah. For quickly prototyping something out, or in cases where you have e.g. compute work that is tightly coupled with the surrounding host code. It has an advantage over raw strings in that C++ macros get expanded inside the GLSL code, so it's possible to share some definitions with the GLSL code.

(FWIW, IMO with offline GLSL to Spir-V compilation, this is less necessary nowadays.)

Edit: There's a bit more preproc trickery involved to make the #version line work reliably across compilers.

Bulb

@cvi said in WTF Bites:

One of the methods for embedding GLSL code into C/C++ is to use a macro like such:
#define GLSL(...) #__VA_ARGS__

I used extremely similar macro for embedding SQL statements into C++ code. The application was doing some transformations, in steps, over sqlite database. Each step required a SQL statement, at least a bit of C++ glue (declaring the tables and dependencies and targets) and whenever it had any C++ processing, it was very closely coupled.

cvi

@Bulb Yeah, I can see how it'd be useful in that case as well.

Thinking back, I've seen it used for embedding code for scripting languages (Lua, JS, ...) as well. I used it for Lua at one point, where setting up the Lua VM's environment in a certain way was much easier to do in actual Lua code rather than via the API. (For that specific case, I think raw strings would work well these days, though.)

hungrier

@Gąska said in WTF Bites:

@kazitor TIL the C standard requires the implementation to support at least 127-argument macros.

Hundred. Twenty. Seven. Arguments.

Well yeah, that makes sense. If it was something like 79 that would just be weird

Gąska

Last month I bought a cheap USB switch on Amazon so I can share keyboard and mouse between my desktop and my laptop without swapping shitload of cables all the time. Today I couldn't get the laptop to recognize keyboard and mouse. I thought the switch is busted. But after some testing, it turned out it's not the switch that's the issue - it's the $400 Dell docking station.

dcon

@kazitor said in WTF Bites:

Okay okay calm down

#define EIGHTY_SIX_THOUSAND_FOUR_HUNDRED 86400.0
#define TWO_MILLION_FOUR_HUNDRED_AND_FORTY_THOUSAND_FIVE_HUNDRED_AND_EIGHTY_SEVEN_POINT_FIVE 244587.5

TTFY Cause you know that'll happen.

MrL

@Gąska said in WTF Bites:

Dell

Oh, here's your problem.

share keyboard and mouse between my desktop and my laptop without swapping shitload of cables all the time

Solution:

Logitech MX Master

Gribnit

@dkf said in WTF Bites:

@Tsaukpaetra said in WTF Bites:

Fuck dates!

That seems… well, OK. You do you.

Now that was a sticky situation!

Gribnit

@hungrier said in WTF Bites:

@Gąska said in WTF Bites:

@kazitor TIL the C standard requires the implementation to support at least 127-argument macros.

Hundred. Twenty. Seven. Arguments.

Well yeah, that makes sense. If it was something like 79 that would just be weird

79 kinda makes sense. But 81, well, no.

Bulb

@hungrier said in WTF Bites:

@Gąska said in WTF Bites:

@kazitor TIL the C standard requires the implementation to support at least 127-argument macros.

Hundred. Twenty. Seven. Arguments.

Well yeah, that makes sense. If it was something like 79 that would just be weird

The C++ template recursion depth limit used to be (required to be at least) 17 (C++11 raises it to more round 1024).

Gribnit

@Gribnit said in WTF Bites:

@hungrier said in WTF Bites:

@Gąska said in WTF Bites:

@kazitor TIL the C standard requires the implementation to support at least 127-argument macros.

Hundred. Twenty. Seven. Arguments.

Well yeah, that makes sense. If it was something like 79 that would just be weird

79 kinda makes sense. But 81, well, no.

wow, people really hate the 80-column break. Hollerith made some enemies...

Gąska

YouTube is A/B testing again.

My regular window:

My incognito window:

Personally, I hate everything they changed.

Zerosquare

Someone should write a viral article about how A/B testing is a form of gaslighting.

Zecc

@Zerosquare And then delete it.

dkf

@Zerosquare said in WTF Bites:

Someone should write a viral article about how A/B testing is a form of gaslighting.

Write two versions of the article with different conclusions and allocate different people a random one to see…

coderpatsy

@dkf said in WTF Bites:

@Zerosquare said in WTF Bites:

Someone should write a viral article about how A/B testing is a form of gaslighting.

Write two versions of the article with different conclusions and allocate different people a random one to see…

And then silently edit them from time to time.

Benjamin Hall

Comment from a PR I'm reviewing:

// Updating params seems like a basic thing for a UI library to support, so naturally MDBootstrap does not.

Tsaukpaetra

Status: What the fuck is the point of having this be a stored proc?

ALTER procedure [dbo].[AspNetUser_Update] @Id uniqueidentifier
      ,@Email nvarchar(256)
      ,@EmailConfirmed bit
      ,@PasswordHash nvarchar(70)
      ,@SecurityStamp nvarchar(40)
      ,@PhoneNumber nvarchar(20)
      ,@PhoneNumberConfirmed bit
      ,@TwoFactorEnabled bit
      ,@LockoutEndDateUtc datetime
      ,@LockoutEnabled bit
	  ,@LockoutReason varchar(200)
      ,@AccessFailedCount int
      ,@UserName nvarchar(256)
      ,@CreationDate datetime
      ,@Country int
      ,@Gender nvarchar(30)
      ,@BirthDate datetime
      ,@FirstName nvarchar(60)
      ,@LastName nvarchar(80)
      ,@NameSuffix nvarchar(20)
      ,@UserStatusID int
      ,@HypatiaCharacterName nvarchar(50)
      ,@ChatServerKey varbinary(256)
      ,@CurrencyHard bigint
      ,@CurrencySoft bigint
	  , @RowsAffected int output

as

UPDATE [dbo].[AspNetUsers]
   SET [Id] = @Id ,[Email] = @Email ,[EmailConfirmed] = @EmailConfirmed ,[PasswordHash] = @PasswordHash ,[SecurityStamp] = @SecurityStamp 
      ,[PhoneNumber] = @PhoneNumber ,[PhoneNumberConfirmed] = @PhoneNumberConfirmed ,[TwoFactorEnabled] = @TwoFactorEnabled 
      ,[LockoutEndDateUtc] = @LockoutEndDateUtc ,[LockoutEnabled] = @LockoutEnabled,[LockoutReason]=@LockoutReason ,[AccessFailedCount] = @AccessFailedCount 
	  ,[UserName] = @UserName ,[CreationDate] = @CreationDate ,[Country] = @Country ,[Gender] = @Gender 
      ,[BirthDate] = @BirthDate ,[FirstName] = @FirstName ,[LastName] = @LastName ,[NameSuffix] = @NameSuffix 
      ,[UserStatusID] = @UserStatusID ,[HypatiaCharacterName] = @HypatiaCharacterName ,[ChatServerKey] = @ChatServerKey 
	  ,[CurrencyHard] = @CurrencyHard, [CurrencySoft] = @CurrencySoft
 WHERE Id = @Id
 
 Set @RowsAffected = @@ROWCOUNT

It does nothing special at all so....

izzion

@Tsaukpaetra said in WTF Bites:

Status: What the fuck is the point of having this be a stored proc?

It does nothing special at all so....

All business logic must be in stored procedures.

Usually either because the person setting the rule is a DBA type who got sick of performance messes from developers writing shit queries, so he requires sprocs that he can gatekeep & modify more easily, or because the person setting the rule heard that sprocs are better for avoiding SQLi vulnerabilities.

aitap

I really like this approach to software licensing. Figshare says it's CC-BY-4.0; README says it's "Open Source - GNU GLP version 3" (sic), but the code itself is p-code, an obfuscated form of MATLAB code, designed to be resistant to reverse-engineering. I guess it's a very convoluted way of saying "please do not redistribute", since the terms of GPL-3 (if that's what they meant) are impossible to fulfil.

boomzilla

https://www.bleepingcomputer.com/news/security/go-rust-net-library-affected-by-critical-ip-address-validation-vulnerability/

Tsaukpaetra

@izzion said in WTF Bites:

@Tsaukpaetra said in WTF Bites:

Status: What the fuck is the point of having this be a stored proc?

It does nothing special at all so....

All business logic must be in stored procedures.

Usually either because the person setting the rule is a DBA type who got sick of performance messes from developers writing shit queries, so he requires sprocs that he can gatekeep & modify more easily, or because the person setting the rule heard that sprocs are better for avoiding SQLi vulnerabilities.

Yeah, this is the only one like that though. Well, besides another one that's for deleting based on the primary key.

The other stored procs are very much more involved.

Zerosquare

@aitap said in WTF Bites:

the code itself is p-code, an obfuscated form of MATLAB code, designed to be resistant to reverse-engineering.

What's even more perplexing is that the authors ask those who use the software to cite their papers on the subject. In which they most probably describe the algorithm they're trying to obfuscate. So the only thing they're obfuscating is the implementation, which is usually not what matters in research.

topspin

@Zerosquare so either they just don’t know WTF they’re doing (with regard to licensing / releasing software, can’t judge the quality of their work), or they’re trying to get around some reproducibility requirements to release their code without actually releasing their code.

Bulb

@boomzilla said in WTF Bites:

https://www.bleepingcomputer.com/news/security/go-rust-net-library-affected-by-critical-ip-address-validation-vulnerability/

I don't see a plausible exploit scenario in the article and I can't really come up with any. The library interprets the addresses consistently, so any checks match what will be accessed, and if anybody downloads an access list from a server without verifying its identity, they already have a vulnerability, confusing in IP address interpretation or not.
Given the draft was expired and never made it to standard status I would strongly argue that the libraries mentioned are doing the right thing and chrome is doing the wrong thing.

topspin

@Bulb octal needs to die already.

Bulb

@topspin There are valid uses of octal. What should die, however, is the automagic parsing as octal when there is a leading zero. In most formats one base should be specified and that should be used. In IPv4 addresses that one base is 10 (and note that the Rust patch is correct in this regard—it does not parse the addresses as octal, it simply rejects them as invalid).

PleegWat

@Bulb Alternatively, we should move to 0o as an octal prefix (similar to 0x for hex and 0b for binary). I don't see that happening either though.

Gribnit

@izzion said in WTF Bites:

@Tsaukpaetra said in WTF Bites:

Status: What the fuck is the point of having this be a stored proc?

It does nothing special at all so....

All business logic must be in stored procedures.

Usually either because the person setting the rule is a DBA type who got sick of performance messes from developers writing shit queries, so he requires sprocs that he can gatekeep & modify more easily, or because the person setting the rule heard that sprocs are better for avoiding SQLi vulnerabilities.

In these settings, burn everything that will burn.

Bulb

@PleegWat said in WTF Bites:

@Bulb Alternatively, we should move to 0o as an octal prefix (similar to 0x for hex and 0b for binary). I don't see that happening either though.

For programming languages, yes. For data formats, no. Data formats shouldn't allow unnecessary options. IPv4 address is decimal, so it should be decimal, end of story (IPv6 is hexadecimal; OK, it's frugly, but it's too long to remember in most cases either way).

Zerosquare

@Bulb said in WTF Bites:

There are valid uses of octal. What should die, however, is the automagic parsing as octal when there is a leading zero.

It really should ; but as usual, doing so would probably break Important Legacy Stuff™, and in a dangerous way (you'd get plausible-but-wrong data).

dcon

@dkf said in WTF Bites:

@Zerosquare said in WTF Bites:

Someone should write a viral article about how A/B testing is a form of gaslighting.

Write two versions of the article with different conclusions and allocate different people a random one to see…

Every time the page refreshes, you get a random version.

Zerosquare

@dcon said in WTF Bites:

Every time the page refreshes, you get a random version.

You should sell that idea to Jeff ; it sounds like a Discourse feature.

Gribnit

@Zerosquare said in WTF Bites:

@dcon said in WTF Bites:

Every time the page refreshes, you get a random version.

You should sell that idea to Jeff ; it sounds like a Discourse feature.

Relieves group think
Encourages ideological diversity
Leans into a more human-focused development approach

HardwareGeek

@Zerosquare With Discurse, it's random whether you see the article, or "No longer welcome!"

hungrier

@HardwareGeek

cvi

@hungrier I'm triggered by the missing comma.

HardwareGeek

@cvi Two of them, one of them being educated at an English university of outstanding reputation.

hungrier

@HardwareGeek @cvi the bottom text wasn't written by me, so I take no responsibility for it

cvi

@HardwareGeek said in WTF Bites:

Two of them, one of them being educated at an English university of outstanding reputation.

And about nine if you learned English punctuation from a certain character in Star Trek TOS.

Filed under: Shattner, comma.