WTF Bites

[dkf]

@HardwareGeek said in WTF Bites:

At least in English, when used for food, the leaves are called cilantro; the seeds are called coriander.

In English English, they're both just coriander. "Cilantro" is just the Mexican influence (which we largely lack).

[Applied Mediocrity]

@PleegWat said in WTF Bites:

Since the hash was not declared with an explicit type, I'd guess it could contain keys of mixed types, and it was looking for UInt32s in a hash which only contained entries with Int32 keys.

That just gets more funky, since in C# the hash function for both Int32 and UInt32 is the same - its own value.
I have thus far successfully evaded Powers-hell in my daily kneeling, so I must be missing something. Can we get teh codez to look at?

[PleegWat]

@Applied-Mediocrity I'm afraid not, but the hash declaration was simply @{}. I'm also pretty sure it worked two months ago when it was handed to me to 'finish up' (read: remove all the unnecessary cruft and fix the bugs) and then yesterday it got back from QA as non-functional, and it didn't work on my test env anymore either. So I think they changed something relatively recently.

[HardwareGeek]

@dkf said in WTF Bites:

In English English

[Bulb]

@Applied-Mediocrity said in WTF Bites:

That just gets more funky, since in C# the hash function for both Int32 and UInt32 is the same - its own value.
I have thus far successfully evaded Powers-hell in my daily kneeling, so I must be missing something.

Note that Powers-hell is dynamically typed, which among other things means it's almost certainly using the boxed variants of everything, because everything must be an object. It also doesn't create the plain simple collections but some fancy variants of its own.

[Bulb]

@Applied-Mediocrity said in WTF Bites:

Powers-hell is .

Yes, it is. It is a weird mixture of a shell and a programming language that doesn't know what it wants to be and as a result doesn't do anything well.

And not only because it insists on having a signed integer type for a numeric identifier, but because it doesn't throw on the cast it silently pulls out of its ass.

Error handling is particularly funky in Powers-hell. By default it just prints error messages and limps on. You can make it throw exceptions instead by setting some global variables, or by wrapping things in try/catch blocks, but the later seems to work only in some depth and I couldn't really understand the scoping of it. Probably the interaction between pipelines and scopes is too weird for me.

[LaoC]

@HardwareGeek said in WTF Bites:

@LaoC said in WTF Bites:

@topspin said in WTF Bites:

@LaoC panoramic pictures are obviously stitched together from basically a video pan. A normal picture I expect to be a picture of one moment, not some arbitrary alteration of it.

TFA says they took it as a panorama though.

But I guess that ship has sailed, what with everything applying a crap-load of filters and the Chinesium phones putting in fake pictures of the moon.

Those were the Koriander phones.

Koriander = coriander = cilantro

Phones that taste like soap.

[cvi]

Dear Windows, I asked you to copy files, not discover them.

Windows "discovering" the files took about as long as scp took to copy them to the network share in the first place. Windows is currently copying files at a rather leisurely pace.

Note to self: next time, just use cygwin+scp on Windows.

[Applied Mediocrity]

@cvi Hey, it must discover if your files are still where you left them

[topspin]

Fuck off, there is no such thing! My user profile is network mapped and it's none of your business.
Also, it took the stupid thing about 30s to check that.

Just shut up and do what I say!

[Bulb]

@cvi said in WTF Bites:

Note to self: next time, just use cygwin+scp on Windows.

Native build of scp would be even better. Filesystem access in cygwin is slower for api impedance mismatch reasons.

[Kamil Podlesak]

@Gurth said in WTF Bites:

@sebastian-galczynski said in WTF Bites:

Out of curiosity, what happens when you open this one?

Since you asked: it opens it fine :)

Now that is one hefty fine! I suppose jail time might be preferable.

[sebastian.galczynski]

There's a countdown clock on the website, counting down the time remaining until a thing happens in the system. It's broken. If I hide the tab, it starts lagging, sometimes by many minutes. But it also runs too fast sometimes. It's 2023, I guess you can't just make an approximately accurate clock like in the 1700s.

[Bulb]

@sebastian-galczynski Because using the API for accessing the actual system clock would be too easy.

[sebastian.galczynski]

@Bulb said in WTF Bites:

@sebastian-galczynski Because using the API for accessing the actual system clock would be too easy.

He gets the time from the server (in the document) (probably because the browser clock may be wrong) and then counts down approximately like this:

let time = <?php echo $time; ?>
let countdown = () => {
    time --;
    document.getElementById("time").innerHtml = time;
    setTimeout(countdown, 1000);
}

So he doesn't even count seconds, but seconds + time to update the DOM.

I'll rewrite it so that it gets the clock offset at the start and then just shows something based on new Date() every second.

Git blame shows Mr Senior Architect as the author...

[sebastian.galczynski]

Ok, the timer worked at first attempt. Unlike fixing some other Senior Architect's code, on which I wasted 3 hours today. The guy overdosed on Uncle Bob or something. He just can't write a fucking function, which takes a thing and returns another. No, must create 3 poltergeist objects with methods like 'initialize', 'setValues' and so on, preferably naming the same value differently every time. And then inject the whole app into each of them, so that he can log in setters (and sneakily mutate something unrelated).

[Bulb]

@sebastian-galczynski said in WTF Bites:

browser clock may be wrong

Browser clock being wrong is extremely rare these days, because mobile devices get time from the network, company devices get time from the domain, any other computer at least defaults to getting time from NTP at boot time, and incorrectly set clock break half the logins. But you can always compare the browser clock with the server clock and calculate adjustment if they differ too much.

[BernieTheBernie]

@Bulb Uhm, OK, 20 years ago.
When I worked in health care software business...
So there was a form shown to the user on their Windows 95 desktop. One of the fields was a date/time, and it defaulted to the system time of that computer. When the user clicked OK, data were sent to the server, and validation was done there. And then the user was shown an error message:

... must not be in the future

A support request showed that users then repeatededly clicked OK till it eventually worked...

At program start, our program asked the server for the current time and set the windows clock. But not all users had the priviledge to set the clock, and for reasons of convenience, an error at that attempt was just swallowed. And eventually the local machine was way ahead in the future, and ...

[Bulb]

@BernieTheBernie said in WTF Bites:

health care software

That means it was at least partially controlled environment, no? But that in turn means even 20 years ago the answer should have been “the computer must have NTP enabled”.

[Tsaukpaetra]

@cvi said in WTF Bites:

Dear Windows, I asked you to copy files, not discover them.

Windows "discovering" the files took about as long as scp took to copy them to the network share in the first place. Windows is currently copying files at a rather leisurely pace.

Note to self: next time, just use cygwin+scp on Windows.

Windows needs to be sure you are fully able to do that, Dave. Wouldn't want a permission issue to interrupt you in the middle of--- wait, that happens? Uh, hrm, wouldn't want to get stuck with only half of the files copied because space exhausti--- that happens too? Hrm. hum. Shirley it's doing something useful, right?

[Tsaukpaetra]

@Bulb said in WTF Bites:

@BernieTheBernie said in WTF Bites:

health care software

That means it was at least partially controlled environment, no? But that in turn means even 20 years ago the answer should have been “the computer must have NTP enabled”.

This. If the computer had the ability to stop users from changing the time, it definitely would have the ability to sync NTP.

[Polygeekery]

If you have Google Fi as your wireless provider and you go to order new phones you have to order each one individually.

• Choose phone
• Add to cart
• Pay
• Checkout

For each individual phone.

I have 9 lines of service. That means 9 checkout processes. 9 individual charges to my account for the exact same dollar amount in the span of a few minutes. Honestly, I am surprised that it did not trip some fraud alert algorithm.

Absolutely retarded. A company of their size cannot figure out "buying multiple items in one transaction".

It does not even require you to assign a purchased phone to a line of service or anything that would complicate matters. You're buying phones that you could run through a shredder after you get them and it would not make any difference to their systems.

[Bulb]

@Tsaukpaetra said in WTF Bites:

@Bulb said in WTF Bites:

@BernieTheBernie said in WTF Bites:

health care software

That means it was at least partially controlled environment, no? But that in turn means even 20 years ago the answer should have been “the computer must have NTP enabled”.

This. If the computer had the ability to stop users from changing the time, it definitely would have the ability to sync NTP.

In fact I was under the impression that Kerberos is one of the things that are broken by unsynchronized clocks and therefore NTP has always been included in Active Directory setup.

[Arantor]

@Bulb default for Kerberos is a tolerance of 5 minutes for that exact reason but in newer versions it is at least configurable.

[kazitor]

@sebastian-galczynski said in WTF Bites:

and sneakily mutate something unrelated

I read ‘mutilate’. I prefer it.

[Tsaukpaetra]

@Polygeekery said in WTF Bites:

. A company of their size cannot figure out

AppleGoogle: nobody has more than one phone line...!

[sebastian.galczynski]

@Bulb said in WTF Bites:

Browser clock being wrong is extremely rare these days,

That's right, in this case it's the server clock that's off by a few seconds. And for various reasons it can't be simply adjusted daily with NTP. Yep, that's an embedded device.

[Bulb]

@sebastian-galczynski An embedded device with network connectivity, though.

Also, most embedded devices I had in hands had access to even more accurate time source (GPS).

Which reminds me of another bite. In the project I was abruptly shuffled away from for budget reasons a couple of month ago, they were trying to use some cheap GPS+a couple of buttons dongles that crews in the field could send some signals with.

The devices had GPS, obviously, and they also had setting for NTP, but what they did not have is any hardware clock to keep time while turned off. So when they were turned off, they started with some initial time, and then adjusted it when they got network connection. But in the mean time they could already record a couple of events, and those would be transmitted with the bogus timestamp.

1. I'm not sure any of those messages had a valid position recorded, but note that you can get time from GPS the moment you tune the first satellite and running through the 32 codes shouldn't take more than a few seconds. But it looked like they relied on NTP (using the less reliable cellular connection).
2. They also could have recorded the messages with time-since-boot and convert to time-since-epoch once they got hold of the real time, but apparently that was too complex logic for the cheapo devices. And you couldn't fix that server-side, because you had no idea what time actually passed between the last message with wrong time and the first with valid time.

[sebastian.galczynski]

@Bulb said in WTF Bites:

@sebastian-galczynski An embedded device with network connectivity, though.

Often very poor connectivity. And then, there are communication windows with some other things, and sudden jumps in system time without some additional hacks will cause the server to miss them.

[dkf]

@Bulb said in WTF Bites:

@sebastian-galczynski An embedded device with network connectivity, though.

Many embedded devices have network connections on them (as it is often either that or USB) but that doesn't mean they can see the internet in any sort of useful way. They're often physically connected to a single host computer that could tell the device the time... or might never do so.

[sebastian.galczynski]

There's a big drama with trains in Poland. A manufacturer (not the smelly one, a competing company called Newag, that started by painting burned down trains and selling them as new, although their recent inventions are quite good IMO) put a piece of sabotaging code in the onboard computers of their new trains.

The code basically bricked the train when it found that someone is replacing parts while the train is stationary and within certain geographical coordinates. These coordinates matched exactly the repair shops owned by Pesa, in Bydgoszcz and Mińsk Mazowiecki, and some other shops not owned by Newag. The list of coordinates could also be updated remotely, and there was some insecure UDP-to-CAN device plugged in inside each train.
Since the trains were bought with full repair manuals and without any exclusive service clauses, that probably constitutes a breach of contract and anti-trust laws. There's a lot of noise in the media, unfortunately only in Polish, for example on this popular InfoSec blog. Their stock is tanking apparently.

The whole thing was discovered by an "unauthorized" repair shop that won the bid for routine repairs and struggled with trains bricking themselves.

Edit: The nastiest thing: To unbrick the train, no special hardware or software was needed. You could simply press some buttons on the dashboard in appropriate sequence, and voila - it works!
Just so that when they would finally call an "authorized" technician, he could just press some buttons and say "I don't see any problem, you guys are just incompetent. You should have hired us instead".

[Zecc]

@sebastian-galczynski So he both doesn't trust the browser clock but trusts the timeout to fire every second? Brillant.

[Parody]

@Bulb said in WTF Bites:

@BernieTheBernie said in WTF Bites:

health care software

That means it was at least partially controlled environment, no? But that in turn means even 20 years ago the answer should have been “the computer must have NTP enabled”.

Maybe? Windows 9x didn't support Internet time sync on its own; I downloaded a program that sat in the system tray to time sync our LAN pit machines if they were on while the shared dialup Internet was available. An NT Domain-joined machine could sync with the domain's time server from the command line using domain client commands, IIRC. No idea how it worked with Novell.

[TimeBandit]

@BernieTheBernie said in WTF Bites:

@Bulb Uhm, OK, 20 years ago.
Windows 95 desktop

But not all users had the priviledge to set the clock

On Windows 95, everyone was an admin.

Also, on the login screen, the Cancel button would get you to the desktop anyway with full privileges

Edit: unless I remember that wrong

[MrL]

@TimeBandit said in WTF Bites:

On Windows 95, everyone was an admin.

Also, on the login screen, the Cancel button would get you to the desktop anyway with full privileges

I komu to przeszkadzało.

[Bulb]

@TimeBandit said in WTF Bites:

On Windows 95, everyone was an admin.

Also, on the login screen, the Cancel button would get you to the desktop anyway with full privileges

Well, Windows 95 didn't have a login screen. Any login screen would be for some networking add-on like the infamous No-well Netware. So it makes sense you could bypass that and get to the desktop, just without being able to access the network resources.

[TimeBandit]

@Bulb said in WTF Bites:

Windows 95 didn't have a login screen.

While the NetWare login screen looked like this

I don't want to install it to confirm

[dcon]

@TimeBandit said in WTF Bites:

I don't want to install it to confirm

Googling confirms that Cancel would by-pass login.

[TimeBandit]

@dcon I remember the first time I saw it thinking "what does the Cancel button does" and trying it only to

[Gustav]

@sebastian-galczynski said in WTF Bites:

The guy overdosed on Uncle Bob or something.

Uncle Bob is like Rust. Many good ideas, but you need a functioning brain to make use of them. Unlike Rust, though, he won't show up at your house with a baseball bat and keep hitting you until you remove the code that breaks his principles.

[Gurth]

@TimeBandit said in WTF Bites:

On Windows 95, everyone was an admin.

Yet it kept telling you to contact the system administrator any time something went wrong.

[Benjamin Hall]

@Gustav also like Rust, he has a rabid cult of personality who can't accept that some of his ideas are any of

• Impractical outside of toy systems
• Actively harmful
• Pure personal preference cloaked as objective statements of fact

And will bitterly argue to the death about any perceived deviation.

[Gustav]

@Benjamin-Hall in both cases, it seems the haters base is larger than the fan base and just as impervious to reason.

[BernieTheBernie]

@Bulb said in WTF Bites:

@BernieTheBernie said in WTF Bites:

health care software

That means it was at least partially controlled environment, no? But that in turn means even 20 years ago the answer should have been “the computer must have NTP enabled”.

Hm. You could also say: our server was far behind in the past...
It was usually some vax or sun where the MUMPS environment was installed, so really health care...

[BernieTheBernie]

@sebastian-galczynski said in WTF Bites:

There's a big drama with trains in Poland. A manufacturer (not the smelly one, a competing company called Newag, that started by painting burned down trains and selling them as new, although their recent inventions are quite good IMO) put a piece of sabotaging code in the onboard computers of their new trains.

The code basically bricked the train when it found that someone is replacing parts while the train is stationary and within certain geographical coordinates. These coordinates matched exactly the repair shops owned by Pesa, in Bydgoszcz and Mińsk Mazowiecki, and some other shops not owned by Newag. The list of coordinates could also be updated remotely, and there was some insecure UDP-to-CAN device plugged in inside each train.
Since the trains were bought with full repair manuals and without any exclusive service clauses, that probably constitutes a breach of contract and anti-trust laws. There's a lot of noise in the media, unfortunately only in Polish, for example on this popular InfoSec blog. Their stock is tanking apparently.

The whole thing was discovered by an "unauthorized" repair shop that won the bid for routine repairs and struggled with trains bricking themselves.

Edit: The nastiest thing: To unbrick the train, no special hardware or software was needed. You could simply press some buttons on the dashboard in appropriate sequence, and voila - it works!
Just so that when they would finally call an "authorized" technician, he could just press some buttons and say "I don't see any problem, you guys are just incompetent. You should have hired us instead".

Their managers will soon find highly paid positions in the board of Volkswagen.

[Parody]

@TimeBandit said in WTF Bites:

I don't want to install it to confirm

Nobody does. We had an issue reported with our desktop publishing program that only happened on a Novell network. I got stuck setting up a demo Novell server on an old machine and installing the client on my work machine to try to find the problem. Never did get it narrowed down more than "Happens wirh Novell client and server access, doesn't with Microsoft client on same server with file sharing enabled in Novell." We'd never paid for a NetWare license so we didn't have any support incidents to use to get them to talk to us, and very few of our customers used Novell anyway, so it went unresolved.

FWIW, the other common login dialog (the Microsoft domain login) had the usual three boxes.

[Tsaukpaetra]

@sebastian-galczynski said in WTF Bites:

Edit: The nastiest thing: To unbrick the train, no special hardware or software was needed. You could simply press some buttons on the dashboard in appropriate sequence, and voila - it works!

Even more nasty: later software updates removed the key unlock key combo, but not the GEO locking code.

[Tsaukpaetra]

@TimeBandit said in WTF Bites:

I don't want to install it to confirm

Didn't need to install to confirm.

Also the concept of user profiles wasn't a thing.

[TimeBandit]

@Tsaukpaetra said in WTF Bites:

Didn't need to install to confirm.

Because of course you have a Win95 machine available

[Zerosquare]

Yes. That's his main machine