The Daily WTF: Curious Perversions in Information Technology

2006-08-24 Reply Admin

Good point! Why validate anything? Just 'cause the big 4 major credit card companies use the "Mod 10" hashing algorithm doesn't mean you shouldn't accept cards that don't pass the check!

Hell, they don't allow *letters* in SSN numbers yet, but they might someday, so let's let those in too! And maybe they'll add more digits later!

Don't validate data! It's more future proof!

This is a large WTF I'm surprised nobody has commented on.

Properly formatted data is not the same as valid data. Having somebody else's SSN against your record could be much much worse than having a fake SSN.

I've lost count of the number of braindead GUIs or web forms that have rejected my slightly unexpected input as invalid.

I recently encountered a process that rejected anything involving a State that the company did not service as being "Invalid XML". Yeah, they built the list of States they service into their DTD. Instead of returning an error for that element later, it would drop the whole file.

2006-08-24 Reply Admin

If you used parmeterized queries, then '; DROP DATABASE; would be converted to a literal string, assuming you specified it as a varchar. If you specified it as some other, non-text, type, then your code would crash and the query would not be run. If you could actually see the resulting SQL, it would look something like:

myField = '''; DROP DATABASE;'

This would just get inserted as a regular string. The moral of the story, is to use query parameters if the environment you're working in makes them available to you. Otherwise, write your own functions to escape all necessary characters and validate that they have an appropriate value based on the column type.

rsynnott · 2006-08-24 Reply Admin

masklinn:
iwpg:
masklinn:
no anonymous functions

You wish... please try not to vomit all over the carpet when you read this: create_function.

glhfds

WHAT THE HELL IS THAT?

I guess I should thank you for correcting me and teaching me that PHP has anonymous functions since PHP4.0.1, but I fear I just can't right now, gotta go gouge my eyes out.

See the discussion. Note that they're not real anonymous functions. Note also the solution suggested; concatenating a function together and using eval! Obviously! What else? It's like lisp marcos designed by a schizophrenic person!

Again, the PHP developers have taken a good idea and completely missed the point.

olddog · 2006-08-24 Reply Admin

Anonymous:
olddog:

It's fun to revisit the reason why I didn't choose ColdFusion a long time ago. The price tag. Currently $5,999.00 USD. Although - all the Adobe bling is cool, that's a high price tag for something that isn't generally reguarded as an enterprise solution. None the less, Adobe is creating an impressive toolbox. Probably the best purchase was Macromedia.

It's hard to imagine that the Adobe toolbox would eclipse MicroSoft in the enterprise arena. I think that still puts ColdFusion in the "specialty" category along with PHP.

To me, the first criteria when choosing a platform for project development is simply: do I (A) need the expense of an on-going "enterprise solution" - or is this (B) a short-lived disposable pet project, likely to be discarded?

If it's (B) I'll save the money and use PHP.

Like I mentioned before, the standard edition is only $600-$1200, and there are free alternatives out there like BlueDragon and Railo. For an enterprise app, CF is not that expensive at $6000, how much is websphere again?

It sounds like you're fairly well set on using ColdFusion and nothing but ColdFusion. Heck, if the tool works, keep it in the toolbox.

The thing about enterprise systems is that they have to play well with other enterprise systems, and be understood by future programmers. That said, the popularity of the language is a real issue. Mainstream languages tend to offer an enterprise some assurance that there is a ready supply of programmers that can slide into the driver's seat.

Not to mention the confidence it gives the marketing department when they can say "yes" to the Big Global Client Company, "our project can be easily understood by your programmers". It saves them from saying "Yes, it can be easily understood by your ColdFusion programmers".

Not to chide ColdFusion, or your enthusiasm about it...but you might consider it's popularity before you try to sell it too far up the ladder.

2006-08-25 Reply Admin

TeeSee:
Anonymous:
XHTML 1.1 is not compatible with MSIE (not even the new one that will ship with Vista AFAIK). Not if you send it with the proper mimetype -- without which there is no point in trying to follow the standard anyway, as you are essentially sending invalid HTML with an XHTML doctype slapped on top of it.

IE will render an image/gif as HTML if it looks like HTML. I don't see why it wouldn't support the XHTML mime type.

Anyway, the real WTF is that the OS doesn't store MIME types.

Now, you see, MSIE doesn't actually have a proper XHTML parser. It has an XML parser and it has an HTML parser, but the XML parser doesn't recognise the XHTML namespace, so you won't see any XHTML output by passing it as XML -- go ahead, try it (all the default CSS rules that apply for HTML are ignored, making it nearly impossible to get anything like HTML even if you write your own stylesheet to define all the default values).

MSIE does, however, have a rather excellent tagsoup parser. What is tagsoup? Tagsoup is the charming nickname HTML authors apply to everything that is not standard HTML or XHTML (or standard XML), but kinda looks like it. The most obvious places for examples of tagsoup are GeoCities and every major website, because most web authors don't understand or care about web standards in the first place.

Tagsoup is an attempt at HTML that is not standards compliant, i.e. it does not follow the rules of the doctype it uses, if any, and it's quite possibly not even well-formed.

Now, the problem with MSIE is that its tagsoup parser is so useful, that nobody bothered creating a standards compliant parser for it. The differences become obvious once you start toying around with CSS and compare the results of other browsers -- and I'm not talking about problems caused by the CSS specs not being specific enough about the implementation.

In fact, the HTML tagsoup parser is good enough to interprete even the most mangled HTML. This is where XHTML parsing comes into play.

Yes, most browsers CAN parse XHTML if you send it to them and tell them it's HTML, but that doesn't mean they recognise it as such OR treat it as such. They will treat it as HTML tagsoup, unless they follow a non-recommended practice called "doctype sniffing", which isn't exactly on par with what the standards say to begin with.

That's kind of like saying you understand Dutch because you know German and can "recognise" all the words similar enough and just ignore those that you are not familiar with and fill in the gaps with what words you might expect to be there if it were a German text to begin with.

That it can parse it and output something remotely similar to what you expect doesn't mean it supports it.

MSIE does not understand XHTML. Many browsers do, MSIE does not. Lynx doesn't either, as far as I know, and it will probably take a while until XHTML becomes mainstream in terms of browser support. Until then we'll only have loads of websites sending out tagsoup because they falsely declare their XHTML as HTML (AFAIK even Mozilla treats those as "non-standard" HTML rather than XHTML -- this is what the web standards effectively tell you to do, anyway).

As for the MIME type -- go ahead and open a website using the XHTML mime type in MSIE. You will get a nice file download trigger. If you don't, the website is sending a different mime type (i.e. text/html) that MSIE supports rather than application/xhtml+xml.

Also note that as it is now, MSIE can simply not support that mime type. Without proper XHTML support the only two options would be parsing it as HTML (which is wrong, because HTML parsers don't understand XHTML as anything other than tagsoup) or parsing it as XML (which would be a legitimate fallback (as per the definition of the +xml mimetype suffix), but not what the user or web designer might have intended (as you will, essentially, see the prettified sourcecode rather than a flashy web app).

The main difference is that an XHTML parser has to make sure it's dealing with wellformed XML first. That is essential. It may not have any tagsoup support. A wellformedness error in XML means a parser error, which means a fatal error, i.e. termination of the parser. Open a non-wellformed XML file in any XML-capable browser (MSIE, Mozilla, etc -- just make sure it has the right mimetype/filetype assigned (i.e. application/xml or text/xml and .xml as filename suffix)) and you will see what even the slightest deviation from wellformed XML will result in.

Letting MSIE parse XHTML as HTML even if it is explicitly sent as XHTML (i.e. per mimetype) would be fatal to XHTML and, by extension, XML. XML is a lot stricter than HTML in terms of syntax. Ignoring the strict ruleset defeats the purpose of XML and the reformulation of HTML within the XML ruleset (i.e. XHTML).

The best current practice if you want to work with XHTML in a Real World environment of a web application is to convert the XHTML you generate to HTML in another step if the browser doesn't advertise its XHTML support explicitly. Leaving that additional layer out is fine, but then you're shutting out all non-XHTML browsers without providing a fallback (i.e. MSIE, which is still the most widespread browser). An alternative is working with multiple sets of templates, one for XHTML and one for HTML, which saves you the overhead of buffering the output before converting it, but introduces the overhead of having to maintain two very similar sets of templates (which will probably not make much sense until the advent of XHTML 2.0, which has very different elements and little similarity with the old HTML).

Another approach is only generating XML output and parsing that server-side with XSLT so you end up with an HTML or XHTML output. That only means you have to maintain the XSLT stylesheets, but introduces the overhead of having another proprietary XML dialect and requring XSL transformation as additional layer (if the XHTML output was created with the limitations of HTML in mind, e.g. no empty elements that require a closing tag in HTML (<li/> is fine, <script/> is not) you could have a very simple, but error-prone, transformation algorithm which works with one or two simple search-and-replaces -- replacing xml:lang (preferred in XHTML) and the like with lang (preferred in HTML, but deprecated in XHTML 1.1) and removing the trailing slashes from empty elements, plus a slight manipulation of the header to change the doctype and remove the namespace).

Most web designers have the same idea of HTML that was common in the 1990s, but want to use "XHTML" because it's more buzzword compliant. The result is usually HTML tagsoup that kinda looks like XHTML if you close both eyes and imagine an elephant. Same tale as for the use of stylesheets, really. It's all too common to see inline styles in production environments (intended for tweaks and discouraged for recurring cases) or having table layouts with font tags all over it prettified with a few classes. Not to mention how many effects tend to be created with crufty JavaScript fragments where one or two lines of CSS could provide the same effect without relying on proper JavaScript support -- and let's not forget the proprietary CSS additions introduced by MS, Netscape and, intended for XUL and testing only, Mozilla.

CAPTCHA: awesomeness -- petition to add "hawtsomeness"

Some Idiot · 2006-08-25 Reply Admin

olddog:
Anonymous:
olddog:

It's fun to revisit the reason why I didn't choose ColdFusion a long time ago. The price tag. Currently $5,999.00 USD. Although - all the Adobe bling is cool, that's a high price tag for something that isn't generally reguarded as an enterprise solution. None the less, Adobe is creating an impressive toolbox. Probably the best purchase was Macromedia.

It's hard to imagine that the Adobe toolbox would eclipse MicroSoft in the enterprise arena. I think that still puts ColdFusion in the "specialty" category along with PHP.

To me, the first criteria when choosing a platform for project development is simply: do I (A) need the expense of an on-going "enterprise solution" - or is this (B) a short-lived disposable pet project, likely to be discarded?

If it's (B) I'll save the money and use PHP.

Like I mentioned before, the standard edition is only $600-$1200, and there are free alternatives out there like BlueDragon and Railo. For an enterprise app, CF is not that expensive at $6000, how much is websphere again?

It sounds like you're fairly well set on using ColdFusion and nothing but ColdFusion. Heck, if the tool works, keep it in the toolbox.

The thing about enterprise systems is that they have to play well with other enterprise systems, and be understood by future programmers. That said, the popularity of the language is a real issue. Mainstream languages tend to offer an enterprise some assurance that there is a ready supply of programmers that can slide into the driver's seat.

Not to mention the confidence it gives the marketing department when they can say "yes" to the Big Global Client Company, "our project can be easily understood by your programmers". It saves them from saying "Yes, it can be easily understood by your ColdFusion programmers".

Not to chide ColdFusion, or your enthusiasm about it...but you might consider it's popularity before you try to sell it too far up the ladder.

And seven pages later they're STILL debating CF vs PHP et al..... .SHEEEESH! Don't you people have girlfriends?

And besides, everyone knows the only truly powerful web development language is ASMIL

ammoQ · 2006-08-25 Reply Admin

 END OF COLDFUSION FLAMEWAR

Any posting mentioning ColdFusion below this line will be mercilessly deleted. Please start a new thread in "General Discussions" if you want to go on with that topic.

powerlord · 2006-08-25 Reply Admin

smbell:
Nope.

What I meant was:

int x = 2; x = x++ + 3; System.out.println(x);

It's not about the post vs pre increment, it's about the x++ being a lost operation. What happens is the x is resolved to 2 and added to the 3 to make 5. Then the x is incremented to 3. Finally the value 5 is assigned to x (the ++ is lost).

While I see the point you're trying to make, if I were your boss and saw x = x++ + 3; instead of x += 4;, I would seriously reconsider whether you're qualified to be working for me as a programmer.

2006-08-25 Reply Admin

Sean:
Anonymous:
Simple, ban the Irish and the Scots.

And the Vulcans.

And Pacific Islanders (a lot of Polynesian languages use an apostrophe to represent a glottal stop. Hawaii as a well-known instance is of course really Hawai'i).

Oh, and you don't have to ban the Irish if they're not using the anglicised versions of their names: In Irish that "O'" is a capital O with an acute accent on top.

Last last lasty thing: there's more to this escaping than just avoiding injection attacks: if you insert a string containing an apostrophe between single quotes in a dynamic SQL query, you'll get an error because you now have unbalanced single quotes (that's why your typical injection attack might have something like "' or 1 =1;--" if it's targetting SQL Server, for instance, because you want to comment out the final quote in that case). I came across a funny error a while ago in our timesheeting application, where someone had dutifully escaped single quotes in the the input...but unfortunately, they did this in strings that were actually parameter values for a stored procedure. So Mr O'Connell ended up on the database as O''Connell. Idiots.

nsimeonov · 2006-08-25 Reply Admin

Speaking of nice users escaping stuff - I know of a bank where they are entering the company or account holder's names when they do a search in uppercase putting % instead of spaces. So if they have to search for Jon Doe they would enter: %JON%DOE%... and this is a bank... they just cry for sql injection attacks...

olddog · 2006-08-25 Reply Admin

mod's note: removed non-related quote

Typically, I eliminate puncuation marks during validation and ( UPPERCASE ) all names before inserting into a database. This makes for easy comparison and handles the caps-lock key issues.

O'Mally becomes OMALLY
D'Augustino becomes DAUGUSTINO

I generally keep two fields for each name. One as the original, the second as formatted. The formatted for comparison, the original for display.

How do you handle name validation?

ammoQ · 2006-08-25 Reply Admin

olddog:
Typically, I eliminate puncuation marks during validation and ( UPPERCASE ) all names before inserting into a database. This makes for easy comparison and handles the caps-lock key issues.

O'Mally becomes OMALLY
D'Augustino becomes DAUGUSTINO

I generally keep two fields for each name. One as the original, the second as formatted. The formatted for comparison, the original for display.

How do you handle name validation?

I've made similar systems, but the second field contained a phonetic ("sounds-like") code of the name, for exented search possibilities.

olddog · 2006-08-25 Reply Admin

ammoQ:

I've made similar systems, but the second field contained a phonetic ("sounds-like") code of the name, for exented search possibilities.

I've never taken it that level. What is that... Soundex?

jfuex · 2006-08-25 Reply Admin

Anonymous:
Wow, they were lucky that it wasn't Mr O'Drop Table who applied there.

Note: I know that this won't work in a query, but imagine it does.

Of course that problem assumes another WTF, running the user code as an admin user because there is no possible way any user could ever execute arbitrary SQL on the database server.

ammoQ · 2006-08-26 Reply Admin

olddog:
ammoQ:

I've made similar systems, but the second field contained a phonetic ("sounds-like") code of the name, for exented search possibilities.

I've never taken it that level. What is that... Soundex?

I've made my own function, roughly similiar to soundex, but adapted to the German language, with extra consideration for Bohemian names; here in Austria, many people have names that originate from Boehmia; sometimes, they are transcribed to German notation, sometimes not. For example, the names "Svec" and "Schwätz" sound identically. I'm not a linguist, but that function works well.

2006-08-28 Reply Admin

I got an official SSN with the first three digits being 929 as an exchange student in 2003, valid for a single year.

nsimeonov · 2006-08-29 Reply Admin

Anonymous:
You can keep procs in subversion. I wrote an article about how to do it
<a href="http://uberconcept.com/articles/SQLServerVersionControl.htm">http://uberconcept.com/articles/SQLServerVersionControl.htm</a>

Your article doesn't help at all. We all know we can keep some text files in source control systems. We all know we can script the database and as you say "It is relatively simple write a script to pull out a listing of all changes that have been made between any two committed versions." ... well if it's relatively simple why didn't you bother publishing such a script for MSSQL or MySQL for example? I took a couple of minutes to read your "article" and it sounds like an ad for SVN.

Another statement that bugged me: "Between subversion and CVS, SVN seemed to be the better system" ... well, would you bother explaining why? Right now it sounds like "it's better, trust me", well without any in-depth analysis I really can't take someones word for truth without the proper proofs.

Oh and this one : "In addition I had not heard of many negative experiences of people moving from CVS to SVN" just made me say "WTF, so you heard some... well, would you care sharing us what are the possible problems that you know about and how (if ever) they got solved"?

No offense, just pointing out the obvious...

ammoQ · 2006-08-30 Reply Admin

nsimeonov:
Another statement that bugged me: "Between subversion and CVS, SVN seemed to be the better system" ... well, would you bother explaining why? Right now it sounds like "it's better, trust me", well without any in-depth analysis I really can't take someones word for truth without the proper proofs.

Oh please, the web is full of comparison between CVS and SVN.

http://en.wikipedia.org/wiki/Comparison_of_revision_control_software

ammoQ · 2006-08-30 Reply Admin

Anonymous:
You can keep procs in subversion. I wrote an article about how to do it
http://uberconcept.com/articles/SQLServerVersionControl.htm

Of course it's technically possible but the hardest part is to motivate your fellow programmers to do it. I'm working with companies that use Oracle, and it seems that most programmers writing PL/SQL stored procedures do that with TOAD directly from/into the database, without ever having source files on their hard disk. No versioning, conflicting changes etc... you name it.

masklinn · 2006-08-30 Reply Admin

nsimeonov:
Another statement that bugged me: "Between subversion and CVS, SVN seemed to be the better system" ... well, would you bother explaining why? Right now it sounds like "it's better, trust me", well without any in-depth analysis I really can't take someones word for truth without the proper proofs.

There are plenty of articles on that one (including the design docs of subversion, since it's basic goal is to be "a better CVS).

The main advantages of SVN over CVS are:

SVN versions trees/directories, which means that deletes/renames/copies/moves are actually versioned
And most commands (commit, update, delete, diff, status, info, log) work perfectly at the directory level
svn status is much more useful than cvs' status, by the way (if you status a directory it defaults to a recursive listing of all the non-versioned/missing/deleted/added/modified files and directories). This also means that CVS users must forget about using the commit operation to poll the current state of their working copy
And since SVN branches & tags are mere copies, this makes them easier to track and use than in CVS
SVN also has a much better handling of binary files than CVS, it's able to do binary diffs to store them to begin with
And it uses some basic algorithms to try to detect whether a file is binary or text, but if it's not sure it defaults to binary (you can set content-types to hint these informations at SVN by the way). It doesn't do newline-remplacement or keyword expansion unless you activate/expressly ask for it either
It should also be noted that SVN's commits are atomic, either everything is committed or the whole transaction is rollbacked, but the repository is never left in a half-committed state.

As for negatives experiences of moving from CVS to SVN, never heard any myself beyond users having to reconfigure their muscle memories to the new CLI commands.

nsimeonov · 2006-08-30 Reply Admin

masklinn:

There are plenty of articles on that one (including the design docs of subversion, since it's basic goal is to be "a better CVS).

.............

That should be part of the article, or at least a couple of links, that was my point.

ammoQ:
Anonymous:
You can keep procs in subversion. I wrote an article about how to do it
http://uberconcept.com/articles/SQLServerVersionControl.htm

Of course it's technically possible but the hardest part is to motivate your fellow programmers to do it. I'm working with companies that use Oracle, and it seems that most programmers writing PL/SQL stored procedures do that with TOAD directly from/into the database, without ever having source files on their hard disk. No versioning, conflicting changes etc... you name it.

Well said, initially I wanted to make this point, then read the article and got bugged by some statements and forgot where I started from. Unless you provide a tool to work with the database that will keep track of the changes, you will have to create scriptis of the entire database and later compare them to extract changes somehow (if ever possible)...

In any case the article is less worth next to nothing IMO without those notes and examples. In theory we all know we better keep scripts of all changes we do on the database, but unless the company introduces penalties for not doing it (and I didn't hear about any company doing this) - most people don't do it. I personally prefer reading create table scripts to understand the structure of a database rather than using a visual tool like toad or enterprise manager and diagrams are nice for less than 15 tables, more than that they just add to the confusion.

2006-08-30 Reply Admin

Saarus:
Anonymous:

<snip>
is an impertive programming language that just has a weird syntax. It also has some declarative elements
<snip>

WTF is an impertive language? Is this some language used to direct perverted imps in some infernal machine?

I'm sorry,but I'm still stuck here. Did he mean imperative? imperious? declarative? impertinent? imputative?

I don't see how any of those apply to a programming language.

You keep using that word ... I do not think it means what you think it means.

ammoQ · 2006-08-30 Reply Admin

nsimeonov:
In any case the article is less worth next to nothing IMO without those notes and examples. In theory we all know we better keep scripts of all changes we do on the database, but unless the company introduces penalties for not doing it (and I didn't hear about any company doing this) - most people don't do it.

Well, I've introduced a very simple penalty for not keeping sources in files: I do it. So, when there are conflicting changes, guess who immediately loses his work and who doesn't. ;-)

I personally prefer reading create table scripts to understand the structure of a database rather than using a visual tool like toad or enterprise manager and diagrams are nice for less than 15 tables, more than that they just add to the confusion.

Yes, it takes a lot of time and work to reengineer usefull ERDs out of a non-trivial database. Relatively good for this job is (at least in my experience) Aqua Data Studio (a generic database frontend written in Java) but maybe there are even better dedicated tools.

ammoQ · 2006-08-30 Reply Admin

Anonymous:

I'm sorry,but I'm still stuck here. Did he mean imperative? imperious? declarative? impertinent? imputative?

I don't see how any of those apply to a programming language.

The word is of course imperative. Most common programming languages are imperative. The opposite are declarative programming lanuages, e.g. functional languages (Lisp, Haskell etc.) and logical languages (Prolog etc.)

DrCode · 2006-08-30 Reply Admin

Anonymous:
I have sort of a problem with stored procedures. You can't keep them in subversion. At least it's not easy. With coldfusion, you can create parametized queries, which come very close to stored procedures, and can be stored in an svn repository.

Wow, that really amazes me. Where I work we have all of our stored procedures in a directory in our source repository, and every script has to be run by the DBA for us, even in Dev, before we can migrate it to any other environments (Test, QA, Prod). Actually, we can update our own sprocs in Dev, for testing purposes, but we still have to submit the final script to the DBA, and check it into source control, before we can move on. This is actually exactly what I was doing this afternoon.

(We had to fight over even that, which is a bit of a WTF in itself; originally, they didn't want us to be able to touch them at all in Dev, but that would mean the DBA running scripts that were completely untested, which would lead to a lot of round-and-round between the developers and the DBAs while getting the scripts debugged. After a bit of this, and some prodding from our side, they relented.)

I just can't imagine that anyone would want anything running on their database without having a versioned script somewhere so they could review it, look at the change history, redeploy it if need be, etc., etc.

Of course, we're stuck using Merant PVCS as our source control software, and that's the real WTF.

2006-08-31 Reply Admin

Anonymous:
Saarus:
Anonymous:

<snip>

is an impertive programming language that just has a weird syntax. It also has some declarative elements
<snip>
WTF is an impertive language? Is this some language used to direct perverted imps in some infernal machine?

I'm sorry,but I'm still stuck here. Did he mean imperative? imperious? declarative? impertinent? imputative?

I don't see how any of those apply to a programming language.

You keep using that word ... I do not think it means what you think it means.

Oh God. I just want to kill myself. I learned the difference between imperative and declarative programming languages in my first lecture in my first CS course. What the hell were you doing?

2006-08-31 Reply Admin

Anonymous:
Anonymous:
Saarus:
Anonymous:

<snip>

is an impertive programming language that just has a weird syntax. It also has some declarative elements
<snip>
WTF is an impertive language? Is this some language used to direct perverted imps in some infernal machine?

I'm sorry,but I'm still stuck here. Did he mean imperative? imperious? declarative? impertinent? imputative?

I don't see how any of those apply to a programming language.

You keep using that word ... I do not think it means what you think it means.

Oh God. I just want to kill myself. I learned the difference between imperative and declarative programming languages in my first lecture in my first CS course. What the hell were you doing?

I'd have to guess "your sister."

2010-05-07 Reply Admin

no, then Mr. D'Amico and others might have an issue

2024-01-31