• A Gould (unregistered) in reply to Aidan
    Aidan:
    TRWTF is this: "four-digit PIN number" It's PIN, not PIN number.

    Just a side effect of acronym ignorance - people know what a "PIN" is without knowing what PIN stands for.

  • pickybastard (unregistered)

    The real WTF is that you keep using the phrase "PIN number". I don't think it means what you think it means...

  • rbonvall (unregistered) in reply to OldGrover
    OldGrover:
    Why on earth would the timeout depend on the password? That makes no sense at all...

    Welcome to TheDail^H^H^H^H^H^H^HWorseThan^H^H^H^H^H^H^H^H^HTheDailyWTF!

  • (cs)

    I wonder if I'm right when I say "I think I've seen this happen before".

    #1 GetTimeout() isn't supposed to return a specific value, just one large enough to not timeout for a while

    #2 GetTimeout() is used by the authentication code as a means of obtaining the PIN without giving away the fact that it is, in fact, getting the PIN: a bit of obscurity as security.

    So changing it to add a thousand (or anything else) would indeed break the login.

  • An apprentice (unregistered) in reply to OldGrover
    OldGrover:
    Why not just:

    function getTimeOut() { return 2000; }

    Why on earth would the timeout depend on the password? That makes no sense at all... someone was smoking something when they wrote that function.

    If you make the timeout not constant, but rather changing on a case-by-case basis, you give less information to a potential attacker, thereby greatly increasing security! It's called, uh, encapsulation. I think...

  • (cs) in reply to lazarus84
    lazarus84:
    That's some badass intution right there... how did he make the link between "timeout" and "pin"? Or did I miss something?
    Meh, not so much...

    Troubleshooting code in 8 parts:

    My PIN works, his doesn't; set my PIN to his ->
 Initially works ->
  Subsequently stops working in a short period of time ->
   Timeout value? ->
    Look for $_SESSION['TIMEOUT'] in code ->
     Find timeout set to output of function ->
      Find function ->
       Discover previous developer is an asshat

    Fin.

  • Jax (unregistered)

    Wow what a great trick, i'm inspired!

    int orderNumber = getOrderNumber(); int orderQuantity = getOrderQuantity();

    public int getOrderQuantity() { return customer.age; }

    Now I don't need to implement a quantity dropdown!

  • lazarus84 (unregistered) in reply to caffeinatedbacon
    caffeinatedbacon:
    lazarus84:
    That's some badass intution right there... how did he make the link between "timeout" and "pin"? Or did I miss something?
    Meh, not so much...

    Troubleshooting code in 8 parts:

    My PIN works, his doesn't; set my PIN to his ->
 Initially works ->
  Subsequently stops working in a short period of time ->
   Timeout value? ->
    Look for $_SESSION['TIMEOUT'] in code ->
     Find timeout set to output of function ->
      Find function ->
       Discover previous developer is an asshat

    Fin.

    Ah, good point. I missed the part where he saw that the code stopped working in a short period of time.

    That'll teach me to skip critical reading classes...

  • Obi Wan (unregistered) in reply to rd
    rd:
    Chancy:
    dtfinch:
    Fixed it: function getTimeOut() { return 1000+(int)$_POST['pin_number']; }

    That's assuming getTimeOut isn't actually used for PIN validation somewhere . . .

    You're assuming quite a bit there, aren't you?

    Given the original setup of the PIN being the user's timeout, nothing would be out of bounds in terms of assumptions about THIS code.

  • bvs (unregistered) in reply to dtfinch

    pin_number = 9999 ?

  • (cs)

    grumble grumble PIN == Personal Identification Number. "PIN Number" is redundant! It's as annoying as signs that say "ATM Machine"

    Edit: Oops, looks like some other people already mentioned that pet peeve of mine.

  • (cs) in reply to /dev/null
    /dev/null:
    I wonder if they were the TPS reports...?
    I think you should ask one of the Bobs about that.
  • mccoyn (unregistered)

    Here are my guesses why this code was written.

    1. The developer wanted to be able to quickly test the timeout functionality by creating a test user with a low-valued PIN.

    2. The developer didn't want to live with the policy of timeouts every hour so he put in a back door.

  • Dax (unregistered)

    I can't quite decide if this is a WTF or a totally epic code hack.

  • (cs) in reply to dtfinch
    dtfinch:
    Fixed it: function getTimeOut() { return 1000+(int)$_POST['pin_number']; }
    <form action="<?= $_SERVER['SCRIPT_NAME'] ?" method="POST"> <input type="hidden" name="pin_number" value="-1337" /> <input type="submit" name="submit" value="Time Out Before You've Even Logged In" /> </form>
  • Distiller (unregistered)

    This guy is so weak for not changing the code

  • jmcnary (unregistered)

    I wouldn't have assumed anything evil or malicious or even intentionally stupid about the original programmer. I think that it's just a copy-and-paste error: Originally, they had a method to get the PIN. They introduced a timeout variable, and the developer copied the method getPIN() and renamed it getTimeOut() -- but forgot to change the key it used to look up the variable. Since everything seemed to work, it went into production.

    But that's just me. Without seeing the rest of the code, I wouldn't know for sure.

  • (cs) in reply to Kluge Doctor
    Kluge Doctor:
    Someone help me out here...

    1. Gollum

    2. Yoda

    3. ???

    • Profit.

    Sorry. I believe that's an overused joke from somewhere, but never saw the original.

  • David (unregistered)

    The timeout should just be hard-coded at 15 or 30 minutes (or have it set in a config file).

  • tezoatlipoca (unregistered) in reply to Liquid Egg Product
    Liquid Egg Product:
    Kluge Doctor:
    Someone help me out here...
    1. Gollum
    2. Yoda
    3. ???
  • Profit.

    • Sorry. I believe that's an overused joke from somewhere, but never saw the original.

    In Soviet Russia, jokes overuse you! (Slashdot meme)

    Captcha: secundum - no thanks, already ate.

  • Matthew (unregistered)

    You know, I'd probably reach a compromise on this one: leave the code WTF in, just so long as people stop bloody well saying PIN number.

  • Rex (unregistered) in reply to Jonathan Holland
    Jonathan Holland:
    You crazy PHP monkeys, in ASP.NET, we just leak an arbitrary amount of memory knowing exactly how long until the leak forces the application pool to recycle.

    Then once it does, all the sessions are cleared.

    :)

    It's funny because it's true!

  • (cs)

    Ah, old 7734, from the classic days of turning LED calculators upside down to spell, well, basically HELL and BIG.BOOBS and not much else.

  • (cs) in reply to Mr. Bean
    Mr. Bean:
    TRWTF is this: "four-digit PIN number" It's PIN, not PIN number.
    Personal Identification Number Number. In other words, the amount of identification numbers you need.

    Hehe. I work in telecoms. In my code dealing with call statistics, I have variables like $numnums which is, of course, the number of phone numbers dialled in a given time period.

    I've been sitting here thinking how much more satisfied I was in my old telecoms job until you said that and reminded me of some truly awful variable names.

    But now as I'm writing this, I'm remembering my recent fiasco trying to figure out the difference between sAccountName, sFundame, cAccountFundCode, cFundName, cFundCode, and cFundAccountName. I guess stuff like that happens everywhere.

    bIgnoreStandardsToSupportCustomerName at my old job was my favoritest variable name ever though.

  • Bob N Freely (unregistered) in reply to corned_beef
    corned_beef:
    Ah, old 7734, from the classic days of turning LED calculators upside down to spell, well, basically HELL and BIG.BOOBS and not much else.

    5318008

  • (cs) in reply to pickybastard
    pickybastard:
    The real WTF is that you keep using the phrase "PIN number". I don't think it means what you think it means...

    Why do people say things like "SCUBA diving"? I mean, by definition you're going to be underwater when using your self contained breathing apparatus, so do you really need to specify that you're diving?

    As a fan of recursive acronyms, I've come to see redundant ones as a close cousin, and therefore something to be appreciated. You know your acronym has made it big when people use it without having to know what it actually stands for.

  • (cs) in reply to pickybastard
    pickybastard:
    The real WTF is that you keep using the phrase "PIN number". I don't think it means what you think it means...
    Absolutely right. It stands for "Penis Increment Narcotic."

    My grandmother knew Errol Flynn, and I have worked for several major credit card companies. I Know These Things.

    Unfortunately, I can't tell you the unit of calibration, because then they'd have to chop mine off.

    I look forwards to the unsolicited adverts for Viagra below this.

  • (cs) in reply to Dax
    Dax:
    I can't quite decide if this is a WTF or a totally epic code hack.
    Epic? Ten seconds is hardly epic -- or indeed epochal (assuming that the timeout is measured in seconds). Ten milliseconds (more normal) is not epic. On Solaris, ten nanoseconds is not merely epic, but not actually supported by the chip, however good it might be.

    Epic?

    I would offer the Modest Proposal that this is evidence of an insane disconnect between the back-brain and the anus. In what way does it make sense to correlate a session timeout with the password supplied?

  • Steve (unregistered)

    Why on earth would anyone want the timeout to vary by user?

  • (cs) in reply to Liquid Egg Product
    Liquid Egg Product:
    Kluge Doctor:
    Someone help me out here...

    1. Gollum

    2. Yoda

    3. ???

  • Profit.

    • Sorry. I believe that's an overused joke from somewhere, but never saw the original.

    It's originally from South Park. In the episode Underpants Gnomes, said gnomes business plan was:

    1. Collect Underpants
    2. ?
    3. Profit
  • Publius (unregistered) in reply to Aidan

    The consensus among English professors is that ATM machine and PERL language are not redundant, because the initialism becomes its own word. A word that out of context can't stand on its own without an added specifier. Does the author mean a PIN diode or a PIN number? (In this case it's obvious but in others it's certainly not.)

    Still I think this situation could be avoided by saying AT machine and PI number, following the example of "MAO inhibitors" (instead of MAOIs).

  • (cs) in reply to vt_mruhlin
    vt_mruhlin:

    Why do people say things like "SCUBA diving"? I mean, by definition you're going to be underwater when using your self contained breathing apparatus, so do you really need to specify that you're diving?

    I can't think of anyone I know who regularly uses "SCUBA dive" unless they're differentiating it from "board diving" or "cliff diving". Usually, you'd just say "a dive", as in, "I'm going for a dive on Saturday."

    Also, I know people who have gone "drowning" while wearing SCUBA gear. (One of the guys I did AOW with died on a later dive.)

    The U is for Underwater, and that differentiates it from SCBA, which can't be used underwater (except when it is.)

  • ach (unregistered)

    So I believe what you all are saying is that "PIN number" is the real WTF fuck.

    (or is that WTF failure? hm..)

  • WTF Fuck (unregistered)

    The real WTF is that there is no WTF. $pin_number actually stands for Periodic Identity Neutralization number - the system is operating as intended, and there is no redundant acronymization with the variable name.

  • Daniel F. (unregistered) in reply to dtfinch

    And what if getTimeOut is also use to verify the PIN on login?

  • no name this time (unregistered) in reply to Eric

    I've been programming for a long time and I can never understand the mindset that allows programmers to make choices like this.

    I suppose it seemed clever at the time.

  • (cs) in reply to Daniel F.
    Daniel F.:
    And what if getTimeOut is also use to verify the PIN on login?
    Yes, I think we've done this one. Is reading comprehension still part of the SAT test?

    (Sigh. test used <sarcastically> there </sarcastically>).

  • Your Name (unregistered) in reply to Daniel F.

    Actually, I was thinking it was more along the lines of a hack to prevent people from logging in if they didn't provide a PIN.

    If there's no PIN supplied, then getTimeOut() would return 0, NULL, or false (commonly interchangeable in sloppy PHP), Making the person's session immediately time out.

    Instant timeout = failed login attempt

  • (cs) in reply to Bob N Freely
    Bob N Freely:
    corned_beef:
    Ah, old 7734, from the classic days of turning LED calculators upside down to spell, well, basically HELL and BIG.BOOBS and not much else.
    5318008
    Reminds me of Dinosaur Comics: Investment goals.
  • (cs) in reply to vt_mruhlin
    vt_mruhlin:
    pickybastard:
    The real WTF is that you keep using the phrase "PIN number". I don't think it means what you think it means...

    Why do people say things like "SCUBA diving"? I mean, by definition you're going to be underwater when using your self contained breathing apparatus, so do you really need to specify that you're diving?

    As a fan of recursive acronyms, I've come to see redundant ones as a close cousin, and therefore something to be appreciated. You know your acronym has made it big when people use it without having to know what it actually stands for.

    I usually just say "I'm going Self Contained Breathing Aparatusing" People ALWAYS know what I mean.

  • SeaDrive (unregistered)

    re: "PIN Number"

    William Safire said OK to "SALT Talks."

  • (cs) in reply to Aidan
    Aidan:
    TRWTF is this: "four-digit PIN number" It's PIN, not PIN number.
    Its my Personal PIN number you dolt.
  • Rohan Prabhu (unregistered) in reply to dtfinch

    how about just..

    return 1000 + (enter_some_time_here);

    if he was so wise to dwelve in the code.. why didn't he just made that simple change in the function rather than have to reset his pass to some 1000+ value to make a totally non-sensical system work...

  • room34 (unregistered)

    This just hurts my brain. As confused, convoluted, flawed, and otherwise bad as most of the other WTFs are, this one truly blows my mind. How could anyone -- ANYONE -- ever think to write code like this???

  • Joe in Australia (unregistered)

    It looks like a kludge to lock people out. Suppose there was originally no way to lock people out, and for some reason there was no easy way to add a flag that would let you tell if someone was allowed to log in. If you set someone's personal identification PIN number to zero they can't log in, because the system will immediately timeout. So, you've got a lock-out mechanism that will work well for 99% of all PINs. It's an ugly kludge, but who knows what they had to work around.

  • hai2u (unregistered)

    The real WTF is using 4-digit numbers for authentication, let alone authentication info as a timeout.

    Also, Nintendo NES System.

  • Phleabo (unregistered) in reply to Publius
    A word that out of context can't stand on its own without an added specifier. Does the author mean a PIN diode or a PIN number?

    All you're really saying is that a word without context needs context. If I say "tree" to you, it's about as meaningful as "PIN." Perhaps you imagine an oak or pine, but I was actually talking about syntactic parse trees. All words depend on their use context for their expressive power.

    Still I think this situation could be avoided by saying AT machine and PI number, following the example of "MAO inhibitors" (instead of MAOIs).

    Yeah, but why bother avoiding the situation? Nobody actually misunderstands when someone says ATM machine or PIN number, despite the prima face redundancy. And, I'd imagine that most of the people carping about it here would actually produce sentences containing the phrase "PIN number" and "ATM machine" in normal speech, if they weren't deliberately trying not to.

    It's not that different from the silly prescriptive grammatical rules they make you learn in grade school. You're told, for example, that it's wrong to end a sentence with a preposition, despite the fact that it's quite natural and common in English (and has been for most, if not all, of its history). It's a post-hoc justification for some personal prejudice.

  • squigley (unregistered) in reply to Mr. Bean

    In my code dealing with call statistics, I have variables like $numnums which is..

    What does bird food have to do with it? mmm, birdy num nums

  • Ethan (unregistered)
    Fearing that he'd break the old PHP system
    A real WTF. What's worse, the developer who writes bad code or the developer who let's bad code live on out of fear and superstition?
  • /dev/null (unregistered) in reply to Kluge Doctor
    1. ??? == Paul :-P

Leave a comment on “Biltmore Can't Log In”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article