What is the meaning of OR?

boomzilla

Jan 7, 2022

How a routine gem update ended up creating $73k worth of subscriptions

On November 5, 2021 (a Friday of course), we've deployed innocent-looking gem updates. Minor versions of Ruby on Rails, Ruby Sentry client, Ruby Slack client, http libraries, Puma, Devise, OmniAuth Ruby client, Mongoid, and a few test gems. However, something went very wrong. We saw odd Stripe...

In Mongoid (The MongoDB driver for Ruby) 7.0.8 , or() meant filter documents that contain any of the argument conditions. In our case, filter users that have a specific id AND that have either never had a renewing_early_lock or their renewing_early_lock is less than 1 hour ago.

...
In Mongoid 7.3.3 , or() now means filter documents that contain any of the argument conditions OR any of previous method conditions! In our case filter users that have either a specific id OR that have never had a renewing_early_lock OR their renewing_early_lock is less than 1 hour ago.

The code:

Oops! Even the bugs are webscale!

dkf

@boomzilla They can't bring themselves to write in an actual query language, so instead they create something that makes bugs extremely easy to make.

Gribnit

@dkf said in What is the meaning of OR?:

@boomzilla They can't bring themselves to write in an actual query language, so instead they create something that makes bugs extremely easy to make.

Or to write tests or to jump 3 minor versions and not act surprised when the dick hits their ass from same.

cvi

Well, changing the behaviour of or() like that is ... special.

Gribnit

@cvi said in What is the meaning of OR?:

Well, changing the behaviour of or() like that is ... special.

Surely. But the fluent builder fashions could easily indicate for either. Symbols excluding and including are too long for Ruby, so there was no option...

topspin

@Gribnit said in What is the meaning of OR?:

@cvi said in What is the meaning of OR?:

Well, changing the behaviour of or() like that is ... special.

Surely. But the fluent builder fashions could easily indicate for either.

It should either be previous_conditions.or(new_condition) or items.or(list, of, conditions). But not both. That makes zero fucking sense.

Silent breaking changes in a minor version surely is a great case of move fast and break things, too.

cvi

@Gribnit Too proud to go all PHP?

Filed under: .real_or()

boomzilla

@Gribnit said in What is the meaning of OR?:

@dkf said in What is the meaning of OR?:

@boomzilla They can't bring themselves to write in an actual query language, so instead they create something that makes bugs extremely easy to make.

Or to write tests or to jump 3 minor versions and not act surprised when the dick hits their ass from same.

: Automated tests are useless!

Gribnit

@boomzilla said in What is the meaning of OR?:

@Gribnit said in What is the meaning of OR?:

@dkf said in What is the meaning of OR?:

@boomzilla They can't bring themselves to write in an actual query language, so instead they create something that makes bugs extremely easy to make.

Or to write tests or to jump 3 minor versions and not act surprised when the dick hits their ass from same.

: Automated tests are useless!

You can make them useless, sure. That also makes them very stable. The loss of the sense of proportion being what it is, he was probably correct for any tests he had used.

Gribnit

@cvi said in What is the meaning of OR?:

@Gribnit Too proud to go all PHP?

Filed under: .real_or()

should be .realOr()

Arantor

@cvi Don't get me started on && and || vs and and or (yes, PHP has both sets of operators, yes you can intermix them, but no you fucking shouldn't because operator precedence will absolutely bite your ass)

Though this one isn't really a language problem but a toolchain problem, and you can write bad frameworks in any language.

izzion

@Arantor said in What is the meaning of OR?:

@cvi Don't get me started on && and || vs and and or (yes, PHP has both sets of operators, yes you can intermix them, but no you fucking shouldn't because operator precedence will absolutely bite your ass)

Though this one isn't really a language problem but a toolchain problem, and you can write bad frameworks in any language.

But most of them are written in English

Arantor

@izzion English is the PHP of human communication languages. It's inconsistent at best, many books have been written on 'how to use it' but all of them are bad advice given by people who don't know any better, all of the advice is at least two generations out of date but is still accepted as gospel and while things have improved, everyone else still carries the old reputation around in their mind so we're all still thoroughly fucked while some folks pine for the olden days when everything was simpler.

Gribnit

@izzion said in What is the meaning of OR?:

@Arantor said in What is the meaning of OR?:

@cvi Don't get me started on && and || vs and and or (yes, PHP has both sets of operators, yes you can intermix them, but no you fucking shouldn't because operator precedence will absolutely bite your ass)

Though this one isn't really a language problem but a toolchain problem, and you can write bad frameworks in any language.

But most of them are written in English

Well, it is a lingua franca.

cvi

@Arantor C++ allows both spellings, but they're the same. Perhaps a bit too much the same... void f( int const bitand constReferenceArgument ).

topspin

@cvi WTF, TIL. Can you do an r-value ref with and or is that bitand bitand?

Gąska

@Arantor said in What is the meaning of OR?:

@cvi Don't get me started on && and || vs and and or (yes, PHP has both sets of operators, yes you can intermix them, but no you fucking shouldn't because operator precedence will absolutely bite your ass)

Operator precedence was a mistake. Like break in C#'s switch statements, parentheses should always be mandatory.

Gribnit

@Gąska you are incorrect on this point. I present ahead of you LISP. If you wish to continue unto the tarpit, beware! there's tar in it.

cvi

@topspin I had to check(*) - you have to use and. bitand bitand is the same as & &, which isn't valid either (GCC: reference to reference).

(*) I don't think I've ever used the alternative spellings.

Gąska

@cvi said in What is the meaning of OR?:

(*) I don't think I've ever used the alternative spellings.

There are approximately zero people in the world who ever used any of them, which is why the C standard committee decided to release in 1995 an amendment to the 1990 standard that adds those through the iso646.h header. Other, less important additions had to wait until full standard revision in 2011, such as the boolean type.

Tsaukpaetra

@dkf said in What is the meaning of OR?:

@boomzilla They can't bring themselves to write in an actual query language, so instead they create something that makes bugs extremely easy to make.

👋

Though to be fair to me, the default is AND, and it should be abundantly clear when you're applying something else.

topspin

@Gąska said in What is the meaning of OR?:

@Arantor said in What is the meaning of OR?:

@cvi Don't get me started on && and || vs and and or (yes, PHP has both sets of operators, yes you can intermix them, but no you fucking shouldn't because operator precedence will absolutely bite your ass)

Operator precedence was a mistake. Like break in C#'s switch statements, parentheses should always be mandatory.

No thanks, I don’t want to write a + (b*c).

kazitor

@topspin
You’re hardly going to see @Gąska endorse Reverse Polish Notation, are you?

Seems right up the Germans’ alley, though

topspin

@kazitor said in What is the meaning of OR?:

@topspin
You’re hardly going to see @Gąska endorse Reverse Polish Notation, are you?

Seems right up the Germans’ alley, though

Maybe not full blown, but I hate modern calculators that make you type sin whatever instead of whatever sin.

Steve_The_Cynic

@Gąska said in What is the meaning of OR?:

Operator precedence was a mistake.

Correct. Strict right-to-left, with parens if necessary, FTW!

A Programming Language wins all.

topspin

@Steve_The_Cynic wow, that’s even worse. So a*b + c is equal to a * (b+c).

Arantor

I suppose you could do what a former colleague of mine did which had the virtue of being 100% utterly unambiguous if wasteful.

You want to do a * b + c?

$result_of_a_times_b = $a * $b;
$result_of_adding_c = $result_of_a_times_b + $c;

Yup, every operation on its own line with its own one-use variable to achieve it. For this example it's mildly annoying but imagine 5-6 operations stacked up like that complete with variable names that for intermediate steps really were named like that.

cvi

@Gąska said in What is the meaning of OR?:

Other, less important additions had to wait until full standard revision in 2011, such as the boolean type.

Wasn't that added in C99? _Bool in the language and bool via stdbool.h

Gąska

@cvi it was. Whatever, it was just a dumb joke anyway.

PleegWat

@Arantor said in What is the meaning of OR?:

Yup, every operation on its own line with its own one-use variable to achieve it. For this example it's mildly annoying but imagine 5-6 operations stacked up like that complete with variable names that for intermediate steps really were named like that.

That's horrible.

izzion

@PleegWat said in What is the meaning of OR?:

@Arantor said in What is the meaning of OR?:

Yup, every operation on its own line with its own one-use variable to achieve it. For this example it's mildly annoying but imagine 5-6 operations stacked up like that complete with variable names that for intermediate steps really were named like that.

That's horrible.

That’s your brain on PCHP.

Gąska

@Arantor said in What is the meaning of OR?:

I suppose you could do what a former colleague of mine did which had the virtue of being 100% utterly unambiguous if wasteful.

You want to do a * b + c?
$result_of_a_times_b = $a * $b;
$result_of_adding_c = $result_of_a_times_b + $c;
Yup, every operation on its own line with its own one-use variable to achieve it. For this example it's mildly annoying but imagine 5-6 operations stacked up like that complete with variable names that for intermediate steps really were named like that.

I use this myself sometimes. But only sometimes. I find

var fooFactor = Config.User.GetBar("baz").shazams[0] + input.shazamModifier;
var fooValue = getBestFoo(input.foos).value * fooFactor;

more readable than

var foo = getBestFoo(input.foos).value * (Config.User.GetBar("baz").shazams[0] + input.shazamModifier);

boomzilla

@Gąska in moderate amounts, I agree, it can make things much clearer, especially for the people who come after you,

Arantor

@Gąska sure, for complex cases like that I'd tend to agree.

The example I gave was more representative of what code I'd actually seen. My former coworker would likely have written your sample more thusly:

var barBaz = Config.User.GetBar("baz");
var barBazShazams = barBaz.shazams;
var firstShazam = barBaz.shazams[0];
var shazamModifier = input.shazamModifier;
var fooFactor = firstShazam + shazamModifier;
var bestFoo = getBestFoo(input.foos);
var fooValue = bestFoo * fooFactor;

Probably without even putting empty lines in between. His argument was that doing this in all cases was more readable and easier to reason through. I would argue that once you go beyond 5 or so temporary variables it's actually harder to reason through because you're having to keep track of all the mental inventory as to what each of the things is.

This wasn't just calculations either; virtually any operation that had multiple operators in it would get like this.

So you'd also have to contend with if ($x && $y && $z) would become an if of if ($x && $y) with a nested if ($z) branch just for comedy. Or, more frequently, assigning the result of $x && $y to one temporary variable, the result of that && $z to another and then putting it into an if statement.

dkf

@Arantor said in What is the meaning of OR?:

So you'd also have to contend with if ($x && $y && $z) would become an if of if ($x && $y) with a nested if ($z) branch just for comedy. Or, more frequently, assigning the result of $x && $y to one temporary variable, the result of that && $z to another and then putting it into an if statement.

There's always:

var temp = $x;
if ($temp) {
    $temp = $y;
}
if ($temp) {
    $temp = $z;
}
if ($temp) {
    // ....
}

Which is correct, but really confusing because you have to think about when things are evaluated and what shields what and so on.

Arantor

@dkf Said ex-coworker never went that far.

Though I did catch him copying code from a blog, that he clearly didn't understand having done so and I know this because he'd removed bits of it that he didn't think were 'relevant' and it caused other errors.

Zecc

@Gąska said in What is the meaning of OR?:

    var foo =
            getBestFoo(input.foos).value *
            (Config.User.GetBar("baz").shazams[0] + input.shazamModifier);

Gąska

@Zecc ITYM

    var foo =
            getBestFoo(input.foos).value *
            (Config.User.GetBar("baz").shazams[0] +
                    input.shazamModifier);

Arantor

Is that eggshell white or Egyptian cotton paint you're buying for the bikeshed?

Zecc

I can't be bothered to explain why that looks wrong to me, so I won't.

I'll just stick to a snarky "do you code on a phone, or something? My screen's got width."

topspin

@Zecc yes, 80 columns worth.

Gąska

@Zecc said in What is the meaning of OR?:

I can't be bothered to explain why that looks wrong to me

Yours looks equally wrong. Every line of code that ends with a binary operator looks wrong.

PleegWat

@topspin I generally go to 120 columns for code, but stay within 80 columns for comments.

cvi

@PleegWat 80 columns for comments, no limit for code (editor gets to deal with that; I use word-wrapping with automatic extra indentation for the wrapped parts. There's also a small symbol to indicate when that happens).

PleegWat

@cvi Depends on the language of course. I mean, if you write stuff like this a lot you're not manually wrapping it:

        Frobnicator frobnicator = frobnicatorFactory->GetFrobnicator( frobnicationType );

cvi

@PleegWat Yeah, true. Thinking of it, expressions like the one shown above, I'd wrap by hand too. At that point, the column width matters less though, since one would (presumably) try to wrap in places that make sense.

: I then tend to put the operator on the new line.

PleegWat

@cvi I'm actually not consistent with operators on previous/next line. I do also like to align things vertically, particularly when I'm doing stuff like binding query parameters which involves calling the same or similar functions multiple times in a row with different arguments.

Tsaukpaetra

@cvi said in What is the meaning of OR?:

places that make sense.

Oh. Oh no....

Gribnit

@Gąska which is useful for multiline concatenation, b/c it doesn't look right until the statement is complete.

Parody

@dkf said in What is the meaning of OR?:

There's always:
var temp = $x;
if ($temp) {
    $temp = $y;
}
if ($temp) {
    $temp = $z;
}
if ($temp) {
    // ....
}
Which is correct, but really confusing because you have to think about when things are evaluated and what shields what and so on.

I did this for a while. The goal was to keep the only return statement at the bottom of the function; some book I'd read said it was a good idea. No clue if it was since I wasn't the "next guy".