For those that sometimes wonder why we harp on what is generally accepted as bad programming techniques, even though they "just work" ... this is why:
https://krebsonsecurity.com/2018/04/...tomer-records/
-tg
Printable View
For those that sometimes wonder why we harp on what is generally accepted as bad programming techniques, even though they "just work" ... this is why:
https://krebsonsecurity.com/2018/04/...tomer-records/
-tg
There are lots of different types of bad habits and I think sometimes "just works" is fine for simple projects by none professionals. I agree that learning "good habits" are imports for people who are going to be programming long term. Are you trying to make a point about bad database design?
I think the point is obvious: get in good habits early, even if you don't think that they are necessary for basic projects, and then you will never have to relearn later or, worse, not relearn and end up creating a disaster like the one linked to. If you always do things "the right way" once you're aware of what "the right way" is then you never have to ask yourself "should I do it the right way this time or can I get away with doing it the wrong way for simplicity" and if you never ask yourself that question then you can never get the answer wrong.
jmc,
maybe the point is obvious to you but not to me. A hobbyist is not going to be designing the software for Panera. A self taught programmer probably has many bad habits but if it achieves their goal of writing a program to organizing their recipes or their monthly bills then I have no problem with it "just works".
Obviously everyone is free to do as they see fit but I've lost count of the number of times where I've seen hobbyist programmers get themselves into a mess because something ended up becoming more than they first expected or they needed to make a change later and it ended up wreaking havoc on most of the app rather than being simple. The problem with "it just works" is that it doesn't just work a lot of the time.
I do not think getting into good habits is the only key here. True you won't program you asp Querystring to be linked to the database select but if we are talking about security then it's not just the data, it's the whole hole in the system.
Encryption,firewalls,User Access,Data Access,Personal information restrictions,Customer details inquiry restrictions,Europe - GDPR regulations and restrictios, Bank restrictions etc.
In most cases you will be forced to hire professionals.
Here we are in the middle of applying GDPR policies and it's very hard to do even with the professionals.And when I say in the middle, I mean we started 3 months ago.
I think most people (like me) ended with a "bad habit" which works but cause no big damage. I'm just not sure how we can know in advance if there will be damage afterwards?
There's no shortcut and learning what not to do really just comes with experience but the best piece of advice would be to learn to accept criticism.Quote:
I'm just not sure how we can know in advance if there will be damage afterwards?
I don't think anyone would expect a casual hobby programmer to spend large amounts of time studying up front and we all understand that people will do bad things just because they don't know any better. But it's amazing how often you see someone post bad code on this forum and then get aggressive when someone points out the problems. Doing something wrong because you lack experience is entirely forgivable. Continuing to do the wrong thing when you've already been told it's dangerous, that's unforgivable whether you're a professional or a hobbyist.
The example doesn't sound so much like an example of a bad habit as one of bureaucratic intransigence (thank Google for spell check, as I munged both of those words). Sure, they shouldn't have been leaking data, and that was an avoidable screw up, but the real issue is that it wasn't fixed after it was identified. There once was a simpler time, when people were free with data because nobody would abuse the system (virtually nobody even HAD the system)). Somebody made an API that handled all kinds of things. Later on, people realized that not all kinds of things SHOULD be handled through the API. The mistake is that they should have realized it sooner, since those halcyon days ended decades back, and once realized, they should have acted with alacrity. Instead, they acted with...whatever...
Now I know how Doctor McCoy feels in Star Trek,
bureaucratic intransigence, halcyon days, acted with alacrity
My God Jim, I'm a programmer, not an English teacher!!! :):):)
Sometimes when you're a "cowboy coder", you can't help it. You're running doing everything yourself and sometimes only have the time to just "get it done" before moving onto the next emergency. You plan to go back to make it nice, but that time never comes, because you don't have the time. This is especially true when you started out learning all by yourself. Unfortunately I've had to do a lot of "just works" code, but you know, it does work and I do get paid. But I so wish it was a lot nicer and I'll never give up hope that I'll go back and make it right. Yeah right :/
In situations like that, the issue is the same but the responsibility just rests one level higher. That said, while it's those who won't give to the time or resources to do it properly who are at fault if something goes wrong as a result, they're likely not the ones who will suffer the consequences because they are the ones who have access to those doling out those consequences and will assure them that it was your fault for not doing the right thing rather than their fault for not enabling you to do the right thing.Quote:
Originally Posted by CrazyDude
Won't and can't are two different things. I'm talking about a "can't" situation, or at least the feeling that you can't. Running your own company as a developer and doing everything is very hard. If was easy, everyone would be doing it.Quote:
Originally Posted by jmcilhinney
Of course to me, the Panera Bread thing isn't really "just work"ing, because if it worked, you wouldn't have that problem. Maybe I'm getting it confused with what I'd call spaghetti code.
That's a different situation to the one I was envisioning. I was thinking more about people responsible for development within a company that hasn't hired a dedicated developer or something like that. Of course, if you don't have time to do everything then maybe you're trying to do too much. I'm certainly not saying it's easy but many small-business people have unrealistic expectations of what they can achieve.Quote:
Originally Posted by CrazyDude
I think the biggest issue with things just working is that it may be that the software achieves the stated aim but not enough thought was put into whether that stated aim is enough and so it also does or doesn't do other things that are also important. Security is often the first thing that gets ignored because it takes time and effort for no direct return. People think "I want person A to get their data" and if the product just works in doing that then it's considered a success, but it's almost as important that person B can't get person A's data. Achieving the stated aim while avoiding that unwanted side-effect takes more than the product "just working". That's not to say that even doing your best to maintain good habits will guarantee avoiding such situations, but it does make it more likely.Quote:
Originally Posted by CrazyDude
Right, I get it now. And your last sentence really stings. :)Quote:
Originally Posted by jmcilhinney
Yeah, I probably overthink the security thing myself, but I do think security gets missed in a lot of companies where you have multiple people. I do agree though, one should adhere to good programming techniques as much as possible.Quote:
Originally Posted by jmcilhinney
For me too. I was self-employed for a while and, frankly, I've no real desire to do it again. It has it's upsides but, for me, they are out-weighed by the downsides.Quote:
Originally Posted by CrazyDude
I can relate. I have a goal, to make a popular product/technology that eventually goes high revenue and I can just retire. :)Quote:
Originally Posted by jmcilhinney
There are some major problems that plague our industry and lead to an inundation of terrible software.
One root: the person who suddenly realizes they need to hire a developer has no clue how to find a good one.
Another root: there is no such thing as a "licensed" developer. I have to jump through tons of hoops to perform surgery, but as far as I can tell there is no formal process to prove I'm capable of writing software for a medical instrument. Only licensing requirements that the instrument works, and I highly doubt that includes testing for resilience against malicious software attacks.
Another root: it's still very common for a career path to be "I'm a paper pusher" -> "I know a little Excel" -> "Sure, I can make some VBA forms" -> "Uh sure I'll do the payroll system for the entire company". No formal training means even less than zero percent chance of security being a consideration.
So put it all together: 90% of software is developed under these circumstances:
- The hiring manager has no clue how to tell a good developer from a bad one.
- The hiring manager DOES understand the budget.
- Experienced developers are few in number and will deliver a realistic schedule and somewhat pessimistic budget.
- Yokels are numerous and will deliver an impossible schedule and budget because they don't know better.
- Hiring managers will take the clear choice: yokels, because if 10 different people had similar low estimates that has to be the correct one, right?
- When it all catches fire and the ship sinks, they'll all say, "How could I have known?" and they're right.
You get what you pay for, and capitalism encourages us to take the lowest bidder with no other considerations. I don't think followers of the Church of the Invisible Hand will ever understand how you can pay a man poorly and not get exceptional service.
You can pay a man highly and still not get exceptional service.Quote:
Originally Posted by Sitten Spynne
It is called public sector.
Quis custodiet ipsos custodes?
Our problem is that we don't have an independently funded governing body. So our "licenses" are basically qualifications/certifications that are either given out by self appointed bodies who are motivated to shift as many of them as possible, regardless of quality as this is their income stream or vested interests (Microsoft, Oracle etc.) who are motivated to design certifications which are as much about creating a culture around their own platforms as about determining the quality of the subject.
If we want a "license" that's meaningful we will have to fund a body through government or through a broad enough church of vested interests such that no one can hold a dominant voice.
That's not The Invisible Hand or a free market. The government only gets to choose from a list of blessed vendors, and their selection process has nothing to do with capitalism: they are law-bound to take the lowest bid unless they go through expensive processes to discredit the bid and, in the process, open themselves up to lawsuits. The contractors understand this is the game, so there are tacit agreements to structure fluff and filler all over the contracts for "reasonable" expenses.
Anecdotal example:
I know a friend that does photography for a government organization.
A job appeared for photographing some equipment for a public campaign. His company submitted a bid for a relatively modest sum: three photographers using the current cameras working for 30 days within facilities already owned and operated by the organization.
A major company with billions of dollars in contracts also submitted a bid. This one exceeded theirs by 100x. It included building new facilities, a manager, his secretary, a layer of four middle-managers, their secretaries, a team of more than a dozen photographers, and new equipment for every photographer.
Feedback on the bids? The small company was outright rejected, because bidding so low caused the inspection process to decide "they weren't serious about the bid".
Another anecdote:
A very important infrastructure improvement to one of Austin's most important roads was approved 5 years ago. Austin has very treacherous terrain, and many areas have lots of undiscovered caves that sometimes harbor endangered animals. So any major construction project in Austin has to account for delays and costs associated with interruptions while waiting on new environmental impact assessments.
The bids came in, and plenty of experienced contractors had impressive ones. An out-of-state company bid half the schedule and half the money. They had no clue about the Austin terrain. They hadn't accounted for finding caves. They won the bid, with a 2-year schedule.
It's 5 years later and they're still working on it. The lanes of the road opened 3 years late. "Unexpected delays" due to... encountering caves were a big cause. There were also lots of other unexpected factors, like "it gets too hot in Austin summers to use the asphalt we had sourced". Gee, who could've predicted that?
It only took a few months for them to exceed something neat I wish I could get on my credit cards: they hit the contractual cap on penalties for being late. Suddenly, they had zero motivation to finish on time.
It's still ongoing. The current setback is they failed to do analysis for how tall the sound barriers between the road and neighborhoods should be. So they built them taller than their initial analysis. Which caused the walls to crack from exceeding their rated weight.
They were hired because we, by law, force our public officials to accept the lowest bid. As a culture, we cannot fathom that paying more for a job might get us more reliable things.
You poor poor people.
Apparently you do not know anything about Greek bureaucracy.
Some examples:
BBC wanted to do a TV series about Greece. They wanted to "hire" our ancient temple in Sounio location for a couple of hours a day for shootings. This would of course promote Greek and raise tourism. They got rejected because at the film shooting times there may have been 10-15 tourist that they would have been "annoyed" with the noise of the crew.
We have our ex main Athens airport here that is deserted because we build a new one (and still after 20 years we haven't got back the VAT the contractor owns). A big plan was introduced to make this the biggest theme park in all of Europe. The Greek Riviera if you like, with thousands of parks, yachts marinas, shopping malls,Cinemas,apartments etc. This would give jobs to 50.000 people. Some public agency found or claim they have found, ancient ruins (be aware that the place they claimed has ancient stuff is now a junk yard and nobody cares about it) so the project is postponed for 8 years now and still going...
We have probably the biggest supplies of lignite (a kind of coal) in all Europe. We use this for our power plants. The government is forcing the power company to sell to some small private power companies electric power cheaper than the amount needed to create the electric power. Every summer we have a shortage. Ahhha, ahhaaa, you've guessed it. The public power company would buy back it's own electric from the smaller private companies 2 times more expensive than what the company sold it to begin with.
Now. We are not allowed (we pay a fine) to produce more than a limit, power from lignite. Although Germany want to buy our power plans and ALL OF THE LIGNITE MINES. I wonder why.
The government(sold out dogs) agree. We have protest and riots.
Ah. A road example. Not much. The contractors that where hired to build roads for the main network haven't delivered yet. But it's only, ehhh, 30-35 years overdue?No caves they just get the money and do not care.Politicians(sold out dogs born by cats) get their "cut" Regardless, the contractors have set up toll stations and get fees for roads that are not finished. The also raise the fees and put up tolls here and there. Now traveling from Athens to Thessaloniki (a 500km drive) is 2 times more expensive due to toll stations than getting a plane (we do not use plains that regularly here if you are thinking of USA. We use boats thought as we are a sea nation mostly).
OK an anecdote from me. Long time ago (in a building far far away) I was working in the public sector in the ministry or labor. We where not working on the main building so some day I got a call to set up a network in the main 15 floors building. They main administrator greeted me and we started working etc...At some point he had to leave for a couple of minutes because the minister was here...Well and he had to park the limousine. Because the lead admin was also the lead doorman!
Finally from my days in the ministry. almost everyone showed up late for work. Back then presence and time was written in a paper by the door.First, whoever got there first was also signing for people that were not there. Second, as the list grew, the signatures where stacked, in smaller and smaller letter in between the correct attendance time rows.
So you would see 20 signatures in a very small row, like so:
Time of arrival:
8:00
10 signatures
8:30
10 signatures
9:00
5 signatures
So everyone was here from 8 to 9 but I never show a soul before 10:30.Hmmm, whenever I was there before 10:30 to explore..So that aheem, ehhhm, would have beeen, ahhmm, about 5 times in 2 years?!....Ehhhm, well, yes...
In the UK, there's the British Computer Society (BCS). https://www.bcs.org/Quote:
If we want a "license" that's meaningful we will have to fund a body through government or through a broad enough church of vested interests such that no one can hold a dominant voice.
Pfft, yeah, You've got LOADS of them :)Quote:
Some public agency found or claim they have found, ancient ruins
Yeah, I was a member for 3 years. It was actually a condition of my degree that I had to join. There was no good reason for this except that one of our lecturers was something to do with them. A more pointless group of gas bags I have rarely met. I don't think they hand out any certs do they? And if they do, absolutely nobody cares.Quote:
In the UK, there's the British Computer Society
I was going to make fun of burning lignite, but pointing out that Greece probably has some kind of artifact absolutely everywhere is also an option.
Yeah. The're everywhere!
British Museum, Paris, Nazi homes, Collector's homes, US .
Thanks for clearing out our back yard from this junk :o
If you don't mind we would like the Parthenon sculptures back. Cough cough Funky, cough . :p
Yes, the BCS does issue recognised professional qualifications. https://www.bcs.org/category/5677Quote:
I don't think they hand out any certs do they?
How long ago was this? They are now a charted institute.Quote:
A more pointless group of gas bags I have rarely met.
This would have been around the millennium (I seem to remember I finished my degree in 2001... but I've been drunk since then so there may be rounding errors). If I remember right they were chartered back then but don't quote me on it.Quote:
How long ago was this?
You've been drunk for seventeen years straight:eek::eek::eek2: That can't be good for your health!Quote:
Originally Posted by FunkyDexter