The Daily WTF: Curious Perversions in Information Technology

Otto · 2006-03-07 Reply Admin

stevekj:

The only WTF I don't see is an SQL injection attack. Of course, it could still contain one if the caller of the function isn't careful with those filenames.

Heck, if the caller isn't careful with the filenames, it could be a doorway to getting the box owned. Imagine filename = "whatever; insert_command_to_give_remote_access_on_a_port_here; echo ". The final echo prevents the thing from returning an error code for whatever the rest of the command line happens to be.

Gotta be real careful with those system calls.

2006-03-07 Reply Admin

VGR:

I'm surprised more WTF readers aren't aware of this. An empty for loop was a very common method of creating a delay in BASIC. BASIC was still in pretty common usage as of 20 years ago.

Exactly. This code has

a delay loop
a reference to string concatenation with '+'
a system() call
an ON GOTO rendered as a switch statement

Forget QBasic, the last one make it clear that this guy's background is in BASICA or GW-BASIC.

2006-03-07 Reply Admin

Enric Naval:

Oh, and notice that I had to restart the JSP server at night, because backuping the whole server using either "cp" or "tar" happened to lock both the HTTPD and the JSP server while copying "/var" and maybe "/usr", I never got to learn exactly which ones...... Linux is so nice and reliable for enterprise level........

Well, since Google, IBM, Oracle, and a few other Fortune 500 companies use it on a daily basis, I'd guess that it continues to be operator error. You've even admitted that you simply try to "work around" the issues rather than figuring out why they are occurring and figuring out what the proper solution is.

Which has an awful lot in common with most of the WTFs posted here. Particularly this one.

And, as for your particular statement -- sounds like an issue with something you were doing. Neither the JSP or httpd should have issues with other programs accessing /var or /usr (and both cp and tar do so in read-only mode, and not exclusive; Linux, like most Unix flavors, has no issues with mutliple programs opening files at the same time). And, of course, then there's the WTF of why you're do full backups every night, since /usr should change only when you install new software.

Oh, and BTW, flock is a Perl function as well. Not just a C one.

2006-03-07 Reply Admin

Nowadays, if you want to do full live filesystem backups in Linux, you should learn to use the Linux/Logical Volume Manager (LVM). With it, you can "freeze" a live block device (creates a block device you can access that will not change), back up that frozen filesystem (or just the block device with dd), then unfreeze it. End result is that you've got a consistent filesystem to back up from, and no files will change while you're backing up. System stays up, and all writes happen on the "live" version of the filesystem so apps keep running, oblivious to the fact that there's a frozen image of the filesystem.

Some filesystems support native level freeze and unfreeze, like xfs and I believe, ext2/3...

2006-03-07 Reply Admin

Are are saying that ERRORLEVEL cannot be negative? I am pretty sure it can...

2006-03-07 Reply Admin

Enric Naval:
Computers should "just work".

They do just work. But only just.

2006-03-07 Reply Admin

It's also nicely reentrant and threadsafe

sigh :-)

2006-03-07 Reply Admin

** 13) The use of strcat over sprintf (I know, I'm scraping the bottom of the barrel here...) ...

Or strncat.

Or snprintf, for that matter. Although you may be right that they'd better use strncat, or they'll probably just manage to introduce format string vulnerabilities...

2006-03-08 Reply Admin

HAHAHA! Imagine that! Thats freakin funny man.. even though i would personally think about getting another job if that was the case. Not just the concern about code quality but also the future trust with his boss..

2006-03-08 Reply Admin

I see red every time I see rediculous.

Enric Naval · 2006-03-08 Reply Admin

Anonymous:
Enric Naval:

Oh, and notice that I had to restart the JSP server at night, because backuping the whole server using either "cp" or "tar" happened to lock both the HTTPD and the JSP server while copying "/var" and maybe "/usr", I never got to learn exactly which ones...... Linux is so nice and reliable for enterprise level........

Well, since Google, IBM, Oracle, and a few other Fortune 500 companies use it on a daily basis, I'd guess that it continues to be operator error.

Remember that google uses it because it's cheaper, you can modify the source code, create a custom version, never have the owner of the OS pull the plug on you, no need for renewing licenses, etc., not because it's more nice or reliable. I imagine that the rest of companies have similar reasons.

You've even admitted that you simply try to "work around" the issues rather than figuring out why they are occurring and figuring out what the proper solution is.

Which has an awful lot in common with most of the WTFs posted here. Particularly this one.

Yes, it has lots in common. It's the "I don't know how to fix and I need it for yesterday, so I'll patch it" approach, so typical of system administrators for small systems :) Notice that in my administrator job I'm asked to keep the server running, not to solve weirds problems caused by other people's software.

I'll accept operator error. But I still think that computers should just work. Differents combinations if hardware/software have different peculiarities. That's why you got pre-configured computers which already have all peculiarities accounted for. When you mount your own computer, you always risk getting a hardware/software combo with some weird interaction. Of course you can handle better those interactions better as you get more experienced, why do we have those interactions in the first place? I want fail-less computers! And I want them cheap!

And, as for your particular statement -- sounds like an issue with something you were doing. Neither the JSP or httpd should have issues with other programs accessing /var or /usr (and both cp and tar do so in read-only mode, and not exclusive; Linux, like most Unix flavors, has no issues with mutliple programs opening files at the same time). And, of course, then there's the WTF of why you're do full backups every night, since /usr should change only when you install new software.

I do a backup every month,not every night :) (I do a weekly DB backup, too). I was getting tired of getting calls every first day of month about "the web not working". You're right that I must be doing something wrong.... but... what exactly? What can possibly be going wrong? I'm making a tar on a directory, not trying to launch a rocket.

What the hell, here you have the whole script. You can even see how I commented out the lines using cp and replaced them with tar. How exactly can a single line using cp or tar take down the servers is something beyond my imagination. I even make subdirectories fo the /home directory because it generated a tar file bigger than 4GB, and ext3 didn't like that. I imagine I'll have to use LVM like a poster says in a message after yours.

You'll also find some WTFs, like the fact that I was running seti@home for a while, and I killed it for the duration of the backup, or that I tried desactivating and activating DMA to solve some problems with the Seagate hard disk. Or the fact that I no longer bother on checking wether the servers are still there instead of blindly restarting them. Basically, they were going down every time, so I no longer checked. Maybe someone will find something useful on it. The comments are in catalan. I'm sorry I don't have time to translate it.

(one of my comments on the script says that it can take down the JSP server and slow a lot the apache server. I remember that *both* were taken down..... false memories?


#/bin/bash
#
#Backup de tots els arxius del servidor de griho.udl.es
#Si se executa dues vegades el mateix dia, nomes es guarda la ultima execucio
#El script intenta primer montar tots els sistemes de fitxers disponibles
#Al final, el log es enviat al email que correspongui
#
# PRECAUCIO: Pot tirar a terra el servidor de JSP i ralentitzar
#     moltissim el servidor apache!
#

matar_seti ()
{
  # matem el SETI per a que no menji CPU mentres fem el backup
  /opt/setiathome/matar_seti.sh
}

# preparem les variables del programa

fecha="$(date +%Y%m%d)"
fecha_completa="$(date)"
dispositivo_a_montar="/dev/hdb"
punto_de_montaje="/mnt/bkup"
dir_copies="$punto_de_montaje/copies"
dir_backup="$dir_copies/$fecha"
log="/tmp/"$fecha"_log_backup"
log_definitiu="$dir_backup/backup.log"


echo "Arxiu de log: $log"
echo "Directori on es guardara el backup: $dir_backup"

# creem i inicialitzem directoris i fitxers

echo "$fecha_completa" > "$log"
echo "$fecha" >> "$log"
2>&1
1>> "$log"


# posem dades varies

echo "$(date)" >> "$log"
echo "$(df -h)" >> "$log"

# muntem la particio on farem el backup

mount -a

if [ ! -d "$punto_de_montaje" ]
 then
   mkdir "$punto_de_montaje" 
 fi

mount "$dispositivo_a_montar" "$punto_de_montaje"

sleep 5

# desactivem el DMA per al disc de backup, per 
#     pura precaucio (els seagate donen problemes amb el
#     dma si han estat parats molt de temps. Es posen
#     automaticament en mode sleep, i no saben despertar-se be.
#hdparm -d0 "$dispositivo_a_montar"

# activem el DMA, perque si no la maquina se atasca :(
hdparm -d1 "$dispositivo_a_montar"

#netejem el directori (per si ja existia)
#  (no volem dos backups del mateix dia, un ademunt del altre)

mkdir "$dir_copies"
nice -n 19 rm -rf "$dir_backup"
sync
mkdir "$dir_backup"
cd "$dir_backup"


fer_directori_mnt()
{
  mkdir "$dir_backup/$dir/floppy"
  mkdir "$dir_backup/$dir/cdrom"
  mkdir "$dir_backup/$dir/bkup"
}


# fem un cp de tots els directoris de "/" (el arrel del sistema)

for dir in $(ls /) ;
 do
     if [[ "$dir" == "mnt" || "$dir" == "proc" || "$dir" == "tmp" ]]; then 
         ## directoris que no hem de copiar
         mkdir "$dir_backup/$dir"
         echo "Saltem directori: $dir" >> "$log" 
         if [[ "$dir" == "mnt" ]]; then
           fer_directori_mnt;
         fi
      else
         echo "******** $dir ********" >> "$log" 2>> "$log"
         if [[ "$dir" == "usr" || "$dir" == "home" ]]; then  
            # els directoris mes grans els dividim en subdirectoris
            mkdir "/$dir_backup/$dir/" >> "$log" 2>> "$log"
            cd "/$dir/";
            for subdir in $(ls) ; do
               echo "******** $subdir ********" >> "$log" 2>> "$log"
               #######mkdir "/$dir_backup/$dir/$subdir" >> "$log" 2>> "$log"
               #######nice -n 19 cp -a "/$dir/$subdir" "$dir_backup/$dir/" >> "$log" 2>> "$log"
               nice -n 19 tar -czp --same-owner -f "$dir_backup/$dir/$subdir".tar.gz "$subdir" >> "$log" 2>> "$log"
            done
            cd "$dir_backup";
            subdir=""
            service httpd restart
            service resin restart # reiniciem el servidor de JSP, que pot haver caigut
         else  # directoris petits
            ######nice -n 19 cp -a "/$dir/" "$dir_backup/" >> "$log" 2>> "$log"
            nice -n 19 tar -czp --same-owner -f "$dir_backup/$dir".tar.gz "/$dir" >> "$log" 2>> "$log"
         fi # directoris mes grans
      fi
      sleep 3
      sync
done # bucle /

# reiniciem el servidor de JSP per si ha deixat de funcionar

service httpd restart
service resin restart


# copiem les bases de dades del sistema


nice -n 19 pg_dumpall > $dir_backup/pg_dumpall_copy.out
nice -n 19 pg_dumpall -d > $dir_backup/pg_dumpall_inserts.out
nice -n 19 mysqldump -A > $dir_backup/mysqldump_all.out


#fem un arxiu buit amb la data del backup per nom

touch "$dir_backup"/"$fecha"


#guardem el log y el enviem por correo

echo "$(date)" >> "$log"
echo "$(df -h)" >> "$log"

cp -f "$log" "$log_definitiu"

cat "$log" | mail root@localhost [email protected] -s "backup griho.udl.es""$fecha" \ 
    >> "$log_definitiu" 2>> "$log_definitiu";


rm -f "$log"

cd /tmp #sortim del directori per a poder desmontar-lo

sync

sleep 10

umount "$dispositivo_a_montar"

sleep 10

sync


exit 0

Oh, and BTW, flock is a Perl function as well. Not just a C one.

Oh, you mean that there's a perl function that mimicks the flock C function behaviour. Sorry, I had to say it. I'm happy that perl has lots of useful functions, but I just couldn't stop myself from pointing that it's not a coincidence that both are called the same :) I used "man flock", and I got a C function, that's why I said it was a C function. I should have thought that perl would have a similar API.

ferrengi · 2006-03-08 Reply Admin

Anonymous:
wintermyute:
Wa wa waaaaa. I think Marc should have been a little more tactful before he opened his mouth -- although tact is certainly in short supply among many developers, especially when confronted by code like this. I shudder to think what you would have to do to rank as a "horrible coder" with the manager.

I don't know.....it could be that the "horrible coder" and the manager were just as equally bad. I am currently working at a place where the manager is also a "coder" and he thinks that certain people that have left were just horrible. Well, breaking into the code you find that the manager and the ex-employees were about the same: just godawful.

Anyway, long story short, they were both probably pretty bad.

JJ

Wow, am I the only person who thinks the manager just made up this story about a horrible coder and it was the manager that wrote all of the bad code? That seems like the most reasonable explanation to me.

Where I work, we have to put our initials, date and ticket # we are working on when we add or modify code.
So it would look something like:

// DN Ticket #1000 03/08/06 - Begin
....
// DN Ticket #1000 03/08/06 - End

I thought this was common practice so that when bugs crop up you can throw it back into the original developer's lap or at least ask him/her to explain in english what the code is doing (since a lot of coders do not provide enough useful comments).

2006-03-08 Reply Admin

Anonymous:
Anonymous:
WTF again! No OS takes "a pair of seconds" just to close a TCP port.

Sorry for being not to specific on the terms, but.. after closing a socket, it will remain in (i don't remember what) state, and can not be reused again for a few seconds (os dependent), except with the SO_REUSEADDR socket option. Caused me a lot of trouble, when testing java server application, restarting it and it just could not bind to the same port. Fortunatelly we have solution, and we have the reason (i can not remember what is it, it was long time ago, getting old :))

most of the time, lingering sockets are caused by dirty clients not closing properly.

http://www.faqs.org/rfcs/rfc793.html

I find the diagramme on page 23 quite useful.

the captcha is quite dinky.

hank miller · 2006-03-09 Reply Admin

ferrengi:
Wow, am I the only person who thinks the manager just made up this story about a horrible coder and it was the manager that wrote all of the bad code? That seems like the most reasonable explanation to me. Where I work, we have to put our initials, date and ticket # we are working on when we add or modify code. So it would look something like: // DN Ticket #1000 03/08/06 - Begin .... // DN Ticket #1000 03/08/06 - End I thought this was common practice so that when bugs crop up you can throw it back into the original developer's lap or at least ask him/her to explain in english what the code is doing (since a lot of coders do not provide enough useful comments).

I have NEVER seen the above anyplace where there is a proper version control system in place. (though I'll admit I have not seen everything. Go over to www.subversion.org and take a look. It is free and it works pretty good. (There are also some comercal solutions you can buy - they might be better, but the advantage of the free ones is you can sneak it in the backdoor, and then force IS to support it after everyone uses it)

A real version control provides the same advantages (easy to see who last touched some line of code), plus it prevents the version comments from cluttering the code when you can figure it out on your own, if only you didn't have to scroll to read the entire function. As a bonus it allows you to try out code, revert latter when you decide there is a better way.

This should be programmer 101, something you learn on the first day of your first real job. Sadly many programmers do not know it. (Note, this is not something that should be taught in school, student projects are not big/long enough for version control to prove itself)

Martin · 2006-03-09 Reply Admin

hank miller:
I have NEVER seen the above anyplace where there is a proper version control system in place. (though I'll admit I have not seen everything. Go over to www.subversion.org and take a look. It is free and it works pretty good. (There are also some comercal solutions you can buy - they might be better, but the advantage of the free ones is you can sneak it in the backdoor, and then force IS to support it after everyone uses it) A real version control provides the same advantages (easy to see who last touched some line of code), plus it prevents the version comments from cluttering the code when you can figure it out on your own, if only you didn't have to scroll to read the entire function. As a bonus it allows you to try out code, revert latter when you decide there is a better way. This should be programmer 101, something you learn on the first day of your first real job. Sadly many programmers do not know it. (Note, this is not something that should be taught in school, student projects are not big/long enough for version control to prove itself)

I/we use full source code control where I work, and we are also supposed to use code comments similar to those shown by ferrengi, alas most of us are to lazy to actually do it!

2006-03-10 Reply Admin

no, it's not. the C and C++ standards don't actually define the size of anything, and i've seen some compilers (for embedded code on DSP chips) where everything is 16 bits, its, chars, etc. and there, sizeof(char) would be two (2) ... !?

2006-03-10 Reply Admin

if you 'close' a socket by killing the process, rather than letting it do sock.close(), then the listening end will go into a FIN_WAIT state, which takes a (kernel configurable) delay to close, this is just because you killed it rather than shutting down cloanly.

hank miller · 2006-03-10 Reply Admin

Anonymous:
no, it's not. the C and C++ standards don't actually define the size of anything, and i've seen some compilers (for embedded code on DSP chips) where everything is 16 bits, its, chars, etc. and there, sizeof(char) would be two (2) ... !?

No, the C standard requires that sizeof(char) == 1. On 16 bit systems that means that 1 byte is 16 bits long.

C has never required a byte have any particular number of bits. Perhaps because when it was first designed many machines with various bit lengths exists. I recall that one was 36 bits. I know there were others (we have had this discussion before, but I'm too lazy to search for it), perhaps 12 or 9 or something.

Systems where a byte is 16 bits do have problems because most code assumes that a byte is 8 bits. This is even more common than code that assumes that int is 32 bits, or sizeof(int) == sizeof(void *).

masklinn · 2006-03-10 Reply Admin

Anonymous:
and there, sizeof(char) would be two (2) ... !?

No, by definition sizeof(char) == 1 period

2006-03-20 Reply Admin

The tactful programmer would use the souce code management system to look up the check-in history and see who checked in that FUGLY code.

On second thought, that presumes they even have a SCM system and use it properly.

2006-03-22 Reply Admin

Hi,

Here is a sighting of a similar "design pattern", but posted as a Python Cookbook recipe ! I can't believe it...

Regards,
Nicolas

2006-07-13 Reply Admin

marvin_rabbit:
Anonymous:
Manni:
Give me the power. That's right, grant me appropriate privileges to get rid of such crap. I swear I won't delete anyone else's posts. Especially not Gene Wirchenko.

(Insert obvious statement here)

Sincerely,

Ludvig Ericson (wonder if this is going to show up correctly)

Oh yeah?!?! Well, (insert obvious retort here).

So THERE!

Why you little (insert namecalling)!
(Insert counter-retort and suggestion to co-locate named body parts.)

And that's final!

2010-11-17 Reply Admin

I felt like counting the WTF's Lol, yes, I know I am commenting on a post that is over four years old.

executing a program using system instead of using SQL C API. 1a) passing information to the program by writing to files.
the idea of waiting an arbitrary amount of time. 2a) the method used to do so.. wtf?
memory leak.
dead write to response variable (ok, this is pretty common). 4a) adding return values together, wtf? I can't explain anything about that
actionFlag with magic numbers. 5a) why does this function delete the files?

the code is gonna end up looking like execSqlCommand(2,file1,file2); writeSqlToFile(); execSqlCommand(0,file1,file2);

2012-01-28 Reply Admin

Error in cheat-sheet: This is how strcpy works: Say a = "abcd\0"; //\0 is string terminator strcpy(a, "ba\0"); //a=bacd

I see you haven't done this much...

C SQL. C SQL Run. Run SQL Run.

Leave a comment on “C SQL. C SQL Run. Run SQL Run.”