CodeSOD: Take a Byte of a Nibble

Imagine, if you will, that you have 64-bits of data. From this 64-bits of data, you need to extract a nibble, which contains the value that you care about. Now, I’m sure you’re imagining an integer with some bitmasks to extract the data, which is a perfectly sane approach.

Tomasz inherited some code from his company’s German office. It took the approach of taking the 64-bits and storing the 64-bits in an eight element byte array. Then, it extracted the values from that array with code looking like this:

if ((app.xuc_Special_TRX[EMV_ADK_REFUND_BYTE] EMV_ADK_REFUND_NIBBLE) == EMV_ADK_REFUND_NO)
{
     ...
}

“What’s this?” Tomasz wondered. “This code couldn’t possibly compile… not unless the operator is hidden in the macro…”

#define  EMV_ADK_EMV_ADK_MANUAL_REVERSAL_BYTE         0   ///< byte   for configuration of manual reversal
#define  EMV_ADK_MANUAL_REVERSAL_NIBBLE       >> 4 & 0x0F ///< nibble for configuration of manual reversal
#define  EMV_ADK_REFUND_BYTE                  0           ///< byte   for configuration of refund
#define  EMV_ADK_REFUND_NIBBLE                & 0x0F      ///< nibble for configuration of refund

#define  EMV_ADK_EMV_ADK_RESERVATION_BYTE             1   ///< byte   for configuration of reservation
#define  EMV_ADK_RESERVATION_NIBBLE           >> 4 & 0x0F ///< nibble for configuration of reservation
#define  EMV_ADK_TIP_BYTE                     1           ///< byte   for configuration of tip (gratuity)
#define  EMV_ADK_TIP_NIBBLE                   & 0x0F      ///< nibble for configuration of tip (gratuity)

#define  EMV_ADK_REFERRAL_BYTE                2           ///< byte   for configuration of referral @n not used for contactless
#define  EMV_ADK_REFERRAL_NIBBLE              >> 4 & 0x0F ///< nibble for configuration of referral @n not used for contactless
#define  EMV_ADK_VOICEAUT_BYTE                2           ///< byte   for configuration of voice authorization @n not used for contactless
#define  EMV_ADK_VOICEAUT_NIBBLE              & 0x0F      ///< nibble for configuration of voice authorization @n not used for contactless

#define  EMV_ADK_RFU_MODE_BYTE                3           ///< byte   RFU
#define  EMV_ADK_RFU_MODE_NIBBLE              >> 4 & 0x0F ///< nibble RFU
#define  EMV_ADK_FALLBACK_AFTER_CVM_BYTE      3           ///< byte   for configuration of "fallback to magstripe after start of cardholder verification or early PIN entry allowed" @n not used for contactless
#define  EMV_ADK_FALLBACK_AFTER_CVM_NIBBLE    & 0x0F      ///< nibble for configuration of "fallback to magstripe after start of cardholder verification or early PIN entry allowed" @n not used for contactless

#define  EMV_ADK_IGNORE_CARD_ERROR_BYTE       4           ///< byte   for configuration of "ignore card error after issuer authorization"
#define  EMV_ADK_IGNORE_CARD_ERROR_NIBBLE     >> 4 & 0x0F ///< nibble for configuration of "ignore card error after issuer authorization"

The structure of the surrounding code makes it clear that there's no reason to store this data in an array- the offending developer chose an array over an integer. Further, we know that they know how to use bitmask operations and bitshift operations, so there's no reason to have written this code.

Since this is an array of bytes, each array index contains two values. Thus, EMV_ADK_REFUND_NIBBLE is but a bitshift away from EMV_ADK_MANUAL_RREVERSAL_NIBBLE. Just don’t try and understand what these macros do frrom where they’re used, and you’ll be fine. Oh, and also don’t accidentially mismatch them- if you use the wrong EMV_ADK_*_BYTE with the wrong EMV_ADK_*_NIBBLE you’ll get the wrong data back without any error. If you don’t do those two things, you’ll be fine.

[Advertisement] Manage IT infrastructure as code across all environments with Puppet. Puppet Enterprise now offers more control and insight, with role-based access control, activity logging and all-new Puppet Apps. Start your free trial today!

To read the full article, please visit The Daily WTF

I Just Like To Read

Look at me being intellectual and all.

The post I Just Like To Read appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

The Eclipse In 23 Seconds

Want to see the eclipse but don’t have time? We got you.

The post The Eclipse In 23 Seconds appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Paying Taxes on Technical Debt

In the U.S., individuals are expected to file federal and state tax returns once a year by April 15. The tax forms are quite complicated, and have all sorts of sub-forms and schedules to support and detail the numbers on the main form. The tax code of the U.S. is approximately 74,000 pages of special cases.

For many items, the same data needs to be entered on multiple forms, usually as the starting point for different calculations that depend upon the same information; these are duplicated again on both federal and state returns. It follows that tax preparation software needs to put the relevant numbers in all the places that they are needed.

Why? Because if it doesn't, the preparer needs to manually copy numbers to each of several places, leading to all sorts of omission/accidental editing issues. Just to make it needlessly complicated interesting, in many cases, the numbers need to be transformed via some formula before copying, and the formulas vary from form to form, and from state to state. Complicating this process is the fact that tax forms stating your earnings from employers and financial institutions can be re-issued with new values if tax laws are changed too close to the end of the year. This means that new numbers need to be entered, propagated, calculated and checked on your tax forms, usually after they were initially prepared.

If you're preparing your own tax returns, then they probably aren't all that complicated, and there isn't too much copy/pasting to be done. If you have multiple businesses in different states/countries, multiple properties, use multiple banks/brokerages, etc., then there are many, many forms and worksheets detailing the same information, leading to a whole lot of copy/pasting of data. When the complexity of what must be prepared gets beyond a certain point, you go to a professional preparer who will just enter your information once, and the very expensive professional tax software will put the numbers on all the relevant forms automatically. This way, it only takes a few minutes to enter the data, hit calc and a mountain of completed tax forms spews forth from the printer.

Julie is a highly experienced accountant, and was partnering with a large, national chain of tax preparers that used their own in-house tax preparation software. They had a large IT team of several hundred assorted developers and support staff. Each year, they'd wait for Congress to decide on changes to the tax laws, and then begin the process of implementing those changes in their software so that they could get it to the accountants in time for tax season.

Unfortunately, Congress doesn't take programming time into account when they bicker back and forth over changes to the tax law. Last year, Congress passed a whole slew of changes at the very last minute, leaving insufficient time to implement all the changes in the software (at least not without the usual magic happens here programming of experienced developers). The solution that the blockhead managers came up with was to only implement part of each change prior to distributing the software. They called this "being agile".

When Julie started to prepare tax returns, she realized that the inputs to the same calculation were different on different forms. The numbers were not being propagated to the places that needed them, or worse, were being propagated incorrectly. Additionally, some calculations only performed the first 10 steps of a 12 step form. Upon raising bugs, she was told We know about these issues and have no plans to fix them!

Wait, manually propagating numbers and checking every calculation defeats the purpose of using the software in the first place; the numbers can't be close, they have to be exact and consistent across forms!

The debate about the importance of exact and correct calculations went back a forth and while until it was escalated sufficiently high to warrant an official response:

Our software is only intended to guide you in the general direction of preparing tax returns. It only needs to be reasonably functional, not "useful".

Julie, at this point, was desperate, so she contacted an insider at the company. "Is there *any* chance this is going to be working in time for tax season?"

"Oh, man… noooooo," her contact said. "A lot of the developers are on contract, so somebody ran the numbers comparing the hours of development time against paying penalties from audits. They figured out that they could do about… 90% of the changes. It's cheaper to just pay the penalties later."

Julie is no longer partnering with this conglomerate.

[Advertisement] Application Release Automation for DevOps – integrating with best of breed development tools. Free for teams with up to 5 users. Download and learn more today!

To read the full article, please visit The Daily WTF

The Sun Is Just Another Lightbulb

How many construction workers does it take to replace a lightbulb?

The post The Sun Is Just Another Lightbulb appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Microsoft Paint Is Essential Software For Every Artist

And this is why – how cool is this!?

The post Microsoft Paint Is Essential Software For Every Artist appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Representative Line: Changing With the Times

Melody got tapped to do a code review on a pull-request from a veteran team-member. It was… an interesting PR, in that very, very little changed. The code was terrible before anyone touched it- for example, the C-file started with 355 lines of variable declarations inside of the main method.

It was, in fact, down around line 354 where Melody noticed the change.

-int right_now_month = 6; // TODO: look up based on current state
+int right_now_month = 7; // TODO: look up based on current state

Out of morbid curiosity, Melody went back through the history, and sure enough, once a month, there was a PR that involved incrementing right_now_month.

[Advertisement] Incrementally adopt DevOps best practices with BuildMaster, ProGet and Otter, creating a robust, secure, scalable, and reliable DevOps toolchain.

To read the full article, please visit The Daily WTF

Give Me Attention!

Please, just look at me please!

The post Give Me Attention! appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

In Your Face!

The most vulnerable part of the human body maybe… Ouch!

The post In Your Face! appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

I’m The Boss Around Here

Hi, sorry, but uhhh, you’re in my bag. WHAM.

The post I’m The Boss Around Here appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

This Eclipse Coverage Was Amazing!

You don’t see this level enthusiasm everyday…

The post This Eclipse Coverage Was Amazing! appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Accepting Student Loans

It’s a bond for life!

The post Accepting Student Loans appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Dog Throws Tantrum When He Doesn’t Get His Gravy

However entitled you think you are to your gravy, you probably don’t throw a tantrum like this.

The post Dog Throws Tantrum When He Doesn’t Get His Gravy appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Error'd: The Sky's the Limit!

"Oh boy! I wonder how they'll top this for the end-of-week bonus prize?" writes Zak.

 

"Um,...no? I think?," wrote Peter S.

 

Sean C. wrote, "It would seem that my disks got decrypted over 5 million years ago... Now that's what I call reliable hardware"

 

"I’ve watched the whole series a few times, and I’m pretty sure Scruffy never said anything like this," writes Vincent.

 

Bjorn E. writes, "Started Word, logged into Office 365 and the was greeted with this message instead."

 

"I didn't see any specials that I liked, so I packed up and went to Burger King instead," wrote Rob H.

 

[Advertisement] Release! is a light card game about software and the people who make it. Play with 2-5 people, or up to 10 with two copies - only $9.95 shipped!

To read the full article, please visit The Daily WTF

Those Long Legs

They are so convenient!

The post Those Long Legs appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

The Vlogging Cat

As entertaining as human vloggers are annoying.

The post The Vlogging Cat appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

The Security Audit

We do our best to anonymize submissions, but there’s always a chance that some dangerously identifying detail slips through. Every once in a while, a submitter contacts us to ask for a modification. More rarely, a submitter’s employer contacts us.

Our rule is to make edits more or less as requested, then move on without comment. There’s nothing about an article so sacrosanct that it’s worth going to war over.

However, we recently got a request that was itself too much of a WTF to pass up.

An old Errord—practically antique—contained a picture of a freaked-out Windows login screen, submitted by someone we’ll call Johnny. The post contained Johnny's name, username, and an Active Directory Domain. It did not identify the company Johnny worked for. But the company—we’ll call them “Lagomorphic Cogitations”—recently performed a security audit and sent us a message:

To: inbox@worsethanfailure.net
From: hunter.jacobs@LagomorphicCogitations.com
Subject: Request for Article Picture Removal (Information Disclosure)

I am reaching out to you about an article posted in 20XX, specifically, the last two screenshots by Johnny in http://thedailywtf.com/articles/someolderrordiwontname.

Gathering an employee’s first name and last name, coupled with the corporate email convention of [First Name].[Last Name]@LagomorphicCogitations.com may allow attackers to gather a list of possible targets for phishing attacks. If the article can be edited to remove the last section from Johnny it would be greatly appreciated as we are looking to limit our exposure of cooperate information. Thank you!

-Hunter Jacobs

We did some basic due diligence, confirming the email looked authentic and that someone with this name worked on Lagomorphic Cogitations' security team. I also happen to know Johnny, and confirmed with him that he'd left that job over five years ago, and yes, that particular submission came in during his tenure there. We removed the offending image. Frankly, we didn’t do much else. It’s a minor edit to an old Errord, and we’re not that concerned.

There’s a fair bit to unpack here, though. After all, our article made no mention of Lagmorphic Cogitations. To find it, they must have been searching employee names—not just current employees, but also ex-employees. (A quick check on LinkedIn shows me 45,000 people who work or have worked for Lagomorphic Cogitations.)

After that incredible slog, someone then had to click on the article, look at the image, recognize the Lagomorphic Cogitations domain, then contact us directly to request a removal. Even with modern technology, there’s only a small degree of automation that could've been involved in this process.

If nothing else, this gives us a sense of how much effort Lagomorphic Cogitations puts into these audits. Unfortunately, their attempt to prevent information disclosure has led to, well, more of it, hasn’t it? Before we received their email, we didn’t know Johnny had ever worked for them. We didn’t know that screenshot was their logon. Heck, we didn’t know their email address pattern, even if [First Name].[Last Name]@LagomorphicCogitations.com is pretty easy to guess.

Now we know all of those things.

Based on my own personal experience in these kinds of environments, I have a hunch about what happened. Lagomorphic Cogitations almost certainly didn’t perform this audit themselves; this was an outside contractor thing. They handed the contractor a check, and a few months later, the contractor came back with a spreadsheet listing “potential security risks.” The security company looks better the more they find, and they’re also not being paid to do more than provide a high-level triage, so this spreadsheet contains anything and everything they could possibly dig up.

From there, the executive who commissioned that study handed the spreadsheet to a pool of middle managers and said, “Deal with these.” The spreadsheet filtered down the hierarchy until it landed on the desk of poor Hunter, who just followed the policy he was given: Tell them to take it down because it’s an information disclosure. If they don’t, escalate.

After we took down the image, Hunter changed the background of the row in his spreadsheet to green. Then he moved on to asking a Facebook group to remove a picture of a cute bunny, because it happens to be owned by an old employee and its name might be part of their password.

At the end of the quarter, Hunter’s boss will brag to the executive board about how his team has resolved 3,421 security issues identified by the audit. The board will nod sagely and pat themselves on the back for writing that check.

[Advertisement] Manage IT infrastructure as code across all environments with Puppet. Puppet Enterprise now offers more control and insight, with role-based access control, activity logging and all-new Puppet Apps. Start your free trial today!

To read the full article, please visit The Daily WTF

This Week’s Most Epic Fails

Your weekly dose of dumb people messing shit up.

The post This Week’s Most Epic Fails appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Pretty Fucked Up

This weekend is going to be good.

The post Pretty Fucked Up appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

New Squirrel Documentary Breaks Records

Squirrel footage attracts record-breaking crowds of dog.

The post New Squirrel Documentary Breaks Records appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Know Your Place

I am your captain now.

The post Know Your Place appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

CodeSOD: The Story of Things

Every line of code tells a story. It never just… appears. Someone made and crafted that code. There’s a story, and an explanation for how that code could be. The world, even the bad, awful corners of it, makes sense and can be understood.

For example, Luke sends us this block.

    /**
     * Format a string as a phone number mm/dd/yyyy
     */
    public static String formatPhone(String phone) {
            String s = "";
            if (phone != null) {
                    s = phone.trim();
            }
            return s;
    }

I imagine, the thinking went like this: “I need to write a function to format a phone number, so I’ll copy the code for the function to format dates, and I’ll replace every instance of date with phone. Oh, wait, the comment is unclear. I’ll make that phone number”

Similarly, this Anonymous PHP code tells its own story:

    if(!$this->auth_model->in_group('Manager')) {
        $data->userLevel = 1;
    } else {
        $data->userLevel = 3;
    }
    if($data->userLevel == 3) {
        redirect('index', 'refresh'); //In CodeIgniter, this triggers a 301 redirect to another page.
    }

The story, I imagine here, was a case of conflicting terminology. Once upon a time, someone came up with the idea of “User Levels”. Someone else thought that was needlessly cryptic, and wanted to give them names. Then this developer got confused, and decided to translate everything back into user levels. This particular if block appeared dozens of times in the code, and it was the only place that userLevel was eveer used. Our anoymous submitter ripped them out.

Finally, a different Anonymous contributor found this block:

def formatDate(date):
    date = time.strptime(str(date), '%Y-%m-%d')
    date = str(date.tm_year)+'-'+str(date.tm_mon)+'-'+str(date.tm_mday)

Now, the developer responsible for this knew that they needed a date in a Year-Month-Day(%Y-%m-%d) format. So they started out by taking a date object, and converting it to a string, using str(date). This converts it into a %Y-%m-%d format. They then parse that into a date object- specifically a struct_time, using time.strptime. Once they had that, they could then use the various properties of the struct_time to build a %Y-%m-%d format.

I take back what I said. The world is a chaotic, disordered place, effects may proceed without cause. Sense is nonsense, and paradoxes are the only form of truth. There’s no explanation for this code, or for… anything, is there?

[Advertisement] Release! is a light card game about software and the people who make it. Play with 2-5 people, or up to 10 with two copies - only $9.95 shipped!

To read the full article, please visit The Daily WTF

Dog Advertising A Burger Bar In China

Does he even now his friends are on the menu there?!

The post Dog Advertising A Burger Bar In China appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

A Wild Sinkhole Appears!

Driving a scooter can be fun, but you have to watch the road at all times!

The post A Wild Sinkhole Appears! appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Bratty Baby Raccoon

Raccoon family has the time of their life.

The post Bratty Baby Raccoon appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Inside A $3000 Japanese Hotel Room

Such style and class, and only for 3000 pop!

The post Inside A $3000 Japanese Hotel Room appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

It’s Got The Flying Doors!!

No, not the car…

The post It’s Got The Flying Doors!! appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Time To Transfer

When people think about government, they usually think about a President or Prime Minister, Senators, MPs, or what have you. But government isn't just a handful of people at the top of the food chain: there's government all the way down to the city level, quietly making the country run. Driver's licenses have to be issued, as do pet licenses. Buildings have to be inspected and certified. All those elevator certificates get printed up somewhere. Increasingly, these small functions are being computerized—in bits and pieces, in incompatible systems—and hooked up to the Internet.

Lisa was the lead engineer for one of these public websites. At its core, it took in personally identifying details and spat out some sort of official document. This meant they had to deal with the PII issues that come with taking people's information: encrypting and salting the data, securing the database backend, et cetera.

One of the pieces in this chain was a separation of data: until the user had paid for the document, proving their identity (or at least their possession of the credit card for the person they claimed to be), their data sat in a frontend database accessible to the Internet. After payment was taken, the data was sent to a more secure database in the backend and removed from the potentially hackable frontend. The frontend ran in a VM that could only make an outgoing connection to the database. It could receive incoming connections and respond, but not initiate them. Basic security for this type of system.

There was one issue, however, that Lisa struggled to track down. It seemed that a small percentage of users, fewer than 1%, were getting an error page immediately after payment. Their application was fine; payment was received, and their document was sent to them along with a confirmation. But they saw an error page suggesting they hadn't completed their transaction.

When Lisa managed to catch the issue in the act, she was able to reconstruct the sequence from the logs:

• The user entered their card info
• The payment processor accepted the payment
• The application marked the record as paid
• The application responded with the redirection back to the confirmation page
• The transfer service kicked in and moveed the data
• The user landed on the confirmation page—and the record was no longer there to display.

In other words, a timing issue. So far, this was just a run-of-the-mill everyday problem. Race conditions happen all the time, after all. The problem was, Lisa had already fixed this race condition: the logic indicated that the system would wait at least 5 minutes before moving the data from the frontend to the backend, to allow for the confirmation page to be generated.

So, what gives? Lisa wondered.

The logic was still in place. In fact, the logs showed that the data hadn't been moved until 5 minutes after it was marked to be moved. But the confirmation page had generated in mere seconds. How could this possibly have occurred?

"It just doesn't make sense," she complained to her coworker.

"What time is it on the server right now?" he asked with a frown.

And that was it: the transfer service was 6 minutes off from the frontend box. As soon as it was marked eligible for transfer, the backend box would move the data. If the periodic service ran right when the row was generated, the user would get an error.

With a groan, Lisa put in a ticket to have both boxes sync to a time server.

[Advertisement] Release! is a light card game about software and the people who make it. Play with 2-5 people, or up to 10 with two copies - only $9.95 shipped!

To read the full article, please visit The Daily WTF

Life Isn’t Always Easy, Don’t Expect Too Much

Life is definitely not what you expect of it.

The post Life Isn’t Always Easy, Don’t Expect Too Much appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

The Inside Of A Pimple (Gross!)

In case you wanted to know what a pimple really looks like…

The post The Inside Of A Pimple (Gross!) appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Relaxing Horror Massage

How to chase away a cute girl that wants to sit next to you.

The post Relaxing Horror Massage appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Gravestone Speaks Truth

So get out there and live!

The post Gravestone Speaks Truth appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Gordon Rents A New Apartment For Struggling Owners

Sure, Gordon is all cursing and yelling, but the guy has a heart too.

The post Gordon Rents A New Apartment For Struggling Owners appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

CodeSOD: An Emailed Condition

For a change of pace, the code in this CodeSOD isn’t the real WTF. Our Anonymous submitter works for a company that handles meeting scheduling for corporate customers. This entails shipping off loads of HTML-emails, and that means using a relatively terrible WYSIWYG editor that generates code like this:

<p class="MsoNormal"><strong style="color: #003877;">Meals</strong></p>
<p class="MsoNoSpacing">
<span style="font-size:9.0pt;font-family:" verdana",sans-serif;="" mso-fareast-language:en-gb"="">
All breakfasts and lunches will be served in Food Capital on the ground floor of the hotel.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
</span></p>
<p class="MsoNoSpacing"><span style="font-size:9.0pt;font-family:" verdana",sans-serif;="" mso-fareast-language:en-gb"="">
We look forward to hosting you for the following dinners:
<o:p></o:p></span></p>

Yes, awful, but no worse than any other WYSIWYG email editor, right? Well, take a look at this particular sample:

<p class="MsoNoSpacing">
<span style="font-size:9.0pt;font-family:" verdana",sans-serif;="" mso-fareast-language:en-gb"="">Dietary Requirements: </span>
<!--[if supportFields]>
<span style='font-size:9.0pt;font-family:"Verdana",sans-serif;mso-fareast-font-family:"Times New Roman";mso-bidi-font-family:Arial;mso-fareast-language:EN-GB; mso-bidi-font-weight:bold'>
<span style='mso-element:field-begin'></span>
<span style='mso-spacerun:yes'>&#160;</span>
MERGEFIELD Dietary_Requirements
<span style='mso-element:field-separator'></span>
</span><![endif]-->
<span style="font-size:9.0pt;font-family:" verdana",sans-serif;="" mso-fareast-font-family:="" "="" times="" new="" roman";mso-bidi-font-family:arial;mso-fareast-language:en-gb;="" mso-bidi-font-weight:bold"="">
*/field1/*</span></p>

This particular block came to our submitter’s attention when they received a report that it was crashing computers. This was surprising, in part because after rigorous and thorough testing, our submitter couldn’t replicate the error.

That is, until they followed up and asked the important question: “What email client are you using?”

“Outlook,” came the reply.

Obviously, they’d already tried to replicate the error in Outlook. “Which version?”

“2007. Why, does that matter?”

As it turns out, the decade old email client really doesn’t like conditional comments- things like the <!--[if supportFields]-->. In fact, it hates them so much, it was crashing the users’ computers.

[Advertisement] Infrastructure as Code built from the start with first-class Windows functionality and an intuitive, visual user interface. Download Otter today!

To read the full article, please visit The Daily WTF

Dude Gives Southern Accent His Best Shot

Nailed it or failed it?

The post Dude Gives Southern Accent His Best Shot appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Casually Explained: The Solar System

Solar system complicated? Not with this guy.

The post Casually Explained: The Solar System appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Raccoons Training Their Biceps

Who knew raccoons use their environment to better themselves?

The post Raccoons Training Their Biceps appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Fear Of Heights Can Be Very Cute

For a bystander at least, for the guy himself… Well, not so much.

The post Fear Of Heights Can Be Very Cute appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Trump Racism

Didn’t like his purple sleeves, that’s all.

The post Trump Racism appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Brain On Drugs

Your brain can be a bloody weird place.

The post Brain On Drugs appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Error'd: Ride the URL Line

Michael R. wrote, "So, https://TfL.Gov.UK...does that bus go on the 'Information Superhighway'?"

 

"BREAKING NEWS: The LA Times web edition demonstrates their solid understanding of single-column layout," writes Mitch T.

 

Michael wrote, "Why buy 5 for £5 if you can have 5 for £6?"

 

Adam K. writes, "So close! Only 734 petabytes short for copying this file which is already on my laptop disk..."

 

"Needless to say, I declined to respond...and they're missing an apostrophe," wrote Steven.

 

"I was trying to add German language options to Windows 10, but, apparently, one of my ancestors already did it four hundred years ago," writes Marcus O.

 

[Advertisement] Infrastructure as Code built from the start with first-class Windows functionality and an intuitive, visual user interface. Download Otter today!

To read the full article, please visit The Daily WTF

Bush Pig Loves Soccer

Are we looking at the new furry Lionel Messi here?

The post Bush Pig Loves Soccer appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Angered Couch Monster

Angry dog rips couch to pieces!

The post Angered Couch Monster appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Monkey Haircut

This barber goes apeshit!

The post Monkey Haircut appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

You Deserve This, Bitch

That’s karma for you, my former friend.

The post You Deserve This, Bitch appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Daddy’s Home!

Have you ever seen an animal that is not a dog so excited for his daddy to come home?

The post Daddy’s Home! appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Sponsor Post: Featurette: Hired!

As you know, Hired has been sponsoring the site for the past few months. I went “behind the scenes” to have a brief chat with Michael Mitchell, a full stack web engineer focused on their “Candidate Experience” features.

To ease in, I started with the only truly important question about life at Hired: how’s the coffee. “It’s amazing,” Michael replied. “We have an operations coordinator that worked at a few large coffee roasters, so she takes care of coffee and makes large batches of cold-brew for the office.” That last is an important one- I’ve had too many cups of “iced” coffee that were just, well, hot coffee with ice in it.

Michael was an electrical engineer before becoming a web engineer; while high voltage might kill you, NPM will make you wish you were dead. “I’m partial to the story Overpowered,” Michael said. While he never used angular momentum to destroy a hard disk drive, he did build the automation for an industrial packaging line. That automation was entirely run through a single Arduino.

“I wasn’t a complete idiot,” Michael said. “All of the safety critical systems were hardwired in a fail-safe manner, and didn’t depend on the Arduino.” It operated for years without incident, and as the line grew, that Arduino ended up running a multi-million dollar business. Eventually, the support contract for the line went elsewhere, and the company taking it over wanted to know what that tiny little board running the line was, and how they could interface with it. “I told them to rip it out and replace it with a PLC, because they really didn’t want to hear the answers to those questions.”

Michael isn’t in the business of hacking together millions of dollars of business on hobbyist equipment. Their current stack- mostly Ruby/React.js, with Postgres on the backend, and a bit of Scala/Python data-science for matching/ranking- doesn’t have any of those kinds of hacks. “Our code review process is fairly well enforced- culturally, not through tools. Probably, the most horrific stuff I’ve done is commit some pretty tortured CSS.”

Despite that, there are lots of growing pains. When Hired was in its early startup phases, it was “move fast and break things,” but as their customers grew, they needed to shift gears. “When you have large client teams relying on your product, moving a button can break an entire HR team’s workflow.”

The upshot is that Michael works with a strong team. “Everyone here is incredibly collaborative and easy to work with.” How do they build the right team? Using Hired, of course! At least half of the engineering team were placed through Hired. “The founders started Hired because they had issues hiring good talent for their previous companies. The company was practically founded to dog-food its own product.”

Speaking of, Michael’s team is tackling a lot of work- in addition to two web engineers, they have two mobile engineers and a single designer. Five people supporting web, iOS, and working on delivering an Android app. “That’s with only four engineers, so I’d say our bottleneck is mainly engineering resources. We’re currently Hiring!”

Hired was also Michael’s chance to dodge a bit of a bullet. When he was last job hunting, he was shopping around, and interviewed with another startup. The CEO may have been the subject of many an article here: the “I know better than you, and you’re lucky I’m even talking to you,” sort. Michael explains:

There were some other red flags I picked up on. He disliked developers who negotiated salary, instead of valuing the “experience” and “opportunity to work hard”. When it came time for the “sell dinner”, he pushed fairly hard to close, and asked, “What would it take for you to accept this job, right now?” I mentioned that I was considering other offers, and his face just dropped. We quietly finished dinner, and I never heard from him again… but I heard about him. One of his engineers got a job through Hired. The engineer said one of the reasons he was looking for a new position was because his previous company ran a bit like a sweat shop. I dodged a bullet there, and Hired was able to get that engineer into greener pastures.

Speaking of bad interviews, I asked Michael what he saw as some of the “don’ts”. “The biggest mistake,” he said, “is not having a well structured interview process.” What you don’t want to do is rely on gut instincts and personal biases about what a “good engineer” looks like.

Hired uses standardized criteria, and gets the entire team involved in the interview loop. “Our candidates are well screened, so we rarely have a ‘worst candidate’ contender,” Michael said. Their worst example was one candidate who, while they technically fulfilled one of Hired’s coding challenges, their solution wasn’t clean or robust enough for Hired’s standards. When the candidate was told that he wouldn’t be progressing, he proceeded to argue with the hiring manager. “He told her that he had finished the problem, so they shouldn’t be kicking him out, then pleading to know what he did wrong, and getting extremely upset and losing composure. We had an open plan office at the time, so I ducked behind a desk when he was walked across the office and out of the building.”

Hired’s core selling point, and the main reason that they do what they do, is to “flip the script”. “Instead of candidates searching through a list of jobs, candidates list what they’re interested in or good at, and potential employers send them interview requests. As a candidate, jobs come to you. As an employer, you get to reach out to high-intent, pre-screened candidates and get a go/no-go answer in 24 hours or less.”

And if someone doesn’t use Hired? What’s the best advice for a job-hunter?

Know what you’re worth. I don’t care if you use Hired, one of our competitors, or just reach out directly, but the market moves quickly in tech and if you haven’t looked around in a while you’re doing yourself a disservice. I’m not advocating for random job hopping, but you should definitely test the market every now and then and keep a look out for smart moves.

Finally, as per my tradition, I gave Michael a chance to tell us his favorite stupid joke: “What’s the best thing about telling UDP jokes? I don’t have to care if you get them.”

Michael got his job through Hired, and you can too. Join today!

[Advertisement] Otter allows you to easily create and configure 1,000's of servers, all while maintaining ease-of-use, and granular visibility down to a single server. Find out more and download today!

To read the full article, please visit The Daily WTF

Why Time Travel Wouldn’t Work For Everyone

Time travel is definitely something I see myself doing anytime soon, but it’s not for everyone…

The post Why Time Travel Wouldn’t Work For Everyone appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Blitzball Trick Shots

These trick shots are insane!

The post Blitzball Trick Shots appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Romance Is Dead

Food is always a girl’s number one priority.

The post Romance Is Dead appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

It’s Always Food

Why is food so goooood??!

The post It’s Always Food appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Be Careful What You Watch When The Broadcast Is Live

Or at least make sure nobody can look on your screen!

The post Be Careful What You Watch When The Broadcast Is Live appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

CodeSOD: Object Relational Mangling

Writing quality database code is a challenge. Most of your commands need to be expressed in SQL, which is a mildly complicated language made more complicated by minor variations across databases. Result sets often have a poor mapping to our business logic’s abstractions, especially in object-oriented languages. Thus, we have Object-Relational-Mapping tools, like Microsoft’s EntityFramework.

With an ORM, you use an object-oriented approach to fetching your objects, and could write something like: IList<HJFRate> rates = db.HJFRates.where(rate=>rate.typeOfUse = typeOfUse) to return all the rows as objects. There’s no concern about SQL injections, no need to process the result set directly. While ORMs can generate poor SQL, or create really inefficient data-access patterns, their ease-of-use is a big selling point.

Which is why Bob Zim was surprised to find this EntityFramework code in a C# web-service:

public ActionResult GetHJFUseTypeInfo(string HJFtypeOfUse)
{
    String query = "SELECT * FROM [dbo].[HJFFeeRateSchedule] u WHERE u.typeOfUse ='" + HJFtypeOfUse + "'";
    System.Data.Entity.Infrastructure.DbSqlQuery<HJFFeeRateSchedule> selectedUse = 
        db.HJFRates.SqlQuery(query);

    string TypeOfUse;
    decimal unitValue2016;
    decimal unitValue2017;

    TypeOfUse = selectedUse.FirstOrDefault().TypeOfUse;
    unitValue2016 = selectedUse.First().FieldUnitValueRate2016;
    unitValue2017 = selectedUse.First().FieldUnitValueRate2017;

    List<decimal> HJFUseTypeValues = new List<decimal>();
    HJFUseTypeValues.Add(unitValue2016);
    HJFUseTypeValues.Add(unitValue2017);

    return Json(HJFUseTypeValues, JsonRequestBehavior.AllowGet);
}

Pretty much everything here is completely wrong. The obvious issue, blinking like a neon sign, is the obvious SQL injection vulnerability. A vulnerability that, as implied by my “ORM 101” segment above, is completely unnecessary.

Keep in mind, further, that selectedUse is a query, not a data object. Each call to .First() re-executes the query, meaning this takes three round trips to the database. Also, mixing .First() (return the first result or error if there isn’t one) and .FirstOrDefault() (return the first result or a safe default value, typically null) is a bizarre choice.

Then, of course, we actually return the data, not as an object, but as an array of decimal values. Judging from the names of some of these fields, it looks like this code may have to change in 2018.

It’s a lot of bad to cram into one handler for an HTTP request, which brings us to our last problem with this code: controllers shouldn’t be doing data access directly. Normally, breaking that rule is worthy of a slap on the wrist, but in the context of this pile of everything is wrong, it might as well be brought up.

Bob adds:

This code was written by the senior dev on the project as well. He doesn’t work here anymore so I can’t ask him what his reasoning was.. but I did send him an email with the text “WHY!?!?!?” and a screenshot of this code. No response.

[Advertisement] Universal Package Manager - ProGet easily integrates with your favorite Continuous Integration and Build Tools, acting as the central hub to all your essential components. Learn more today!

To read the full article, please visit The Daily WTF

Train Crushes Truck

PSA: Don’t get stuck on the railway, people.

The post Train Crushes Truck appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Robots Will Steal Your Job

Maybe you think that’s nice, but enjoy it while you still can.

The post Robots Will Steal Your Job appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Scrooge McDuck’s Net Worth Solved

The net worth you’ve always wanted to know, but never could find an answer for!

The post Scrooge McDuck’s Net Worth Solved appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Your Cat Knows

And it probably doesn’t care anyway.

The post Your Cat Knows appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Sup Bro

When your cat is the coolest bro in your house.

The post Sup Bro appeared first on Viral Viral Videos.

To read the full article, please visit Viral Viral Videos

Cut Short

Marcus worked on a small networking team responsible for keeping a series of UK-based garages interconnected with the world-wide web. Seymour, the Team Leader (in title only), knew far less about networking than Marcus, but that didn't stop him from acting like the big shot. Seymour was working a cash register at the original garage several years ago when the owner asked him, "You're a young guy, right? That means you know how the internet works. What can we do to make this place internet-friendly?" After taking a Networking 101 course, Seymour managed to get the garage online, when enabled it to monitor gas prices and perform credit card transactions. This made Seymour a hero to the owner, and earned him the title, "Networking Team Leader" before he even had a team.

Eventually the garage grew from a single location into a chain. When each new location opened, Seymour made it "internet-friendly", using the same techniques he learned at the original store, which usually involved sloppy cable runs and the cheapest router he could buy. When it came time to do more than just have the ISP arrive to show where Seymour to plug in the network cable, he was completely lost. Having multiple locations networked together was really advanced stuff, so he convinced the owner to hire some help.

Enter Marcus, who was willing to be hired on as Seymour's subordinate while realizing he would be the de facto brains of the networking team. It didn't take long for Marcus to realize he had his work cut out for him to get things in order. There were several hack-y solutions put in place that Marcus was able to improve upon, but in the end he got no credit for it because Seymour was there to take the accolades.

CC BY-SA 3.0, Link

Seymour's technical knowledge was only matched by his work ethic. He enjoyed leaving their humble office two hours early to perform things like phantom "receipt printer connectivity troubleshooting" at an undisclosed garage location. Marcus knew he was really just heading to the pub but didn't say anything because it was better without Seymour around.

One Friday, a call came in that a garage's network connection kept dropping. Seymour surprisingly volunteered, leaving out the detail that it was next to his favorite watering hole, the "Bee and Barb". "I'm on it!" he said, springing up and grabbing his coat. "Have a good weekend, Marcus. Don't work too hard!"

Marcus rolled his eyes and went back to work. An hour later he got a frantic call from Seymour. "Marcus! I need you to get over here, stat! Bring the network cabling toolkit, I forgot it there. This place has some bad cabling, I don't know who has been touching it, but it's a disaster! Oh, and I won't be here when you arrive. I, uhh, got another call, I need to go!"

Marcus knew Seymour volunteering to work on something on a Friday afternoon was too good to be true. On the way to the garage, he just happened to spot Seymour's car outside the "Bee and Barb". Maybe he could at least get a free pint out of Seymour after he fixed this network cable.

Marcus went in the front door and asked the clerk if someone fitting Seymour's description had been working on the internet cabling and where to find it. "Sure was. It seemed like a struggle. He kept cutting bits of it off and using profanity. Eventually he stormed off and just left it hanging there," the clerk motioned towards the back corner, where bits of blue cable were strewn around a disconnected router.

He followed the trail of shredded cabling to just behind a large, difficult to move store display. There he spotted a tiny 1.5cm nub of network cable sticking out from behind the display. Beside them was a forgotten crimping tool, and discarded 8P8C connectors. Obviously, Seymour had been screwing up with fixing the cable. With each failed crimp, he would cut off a section and start over. He had botched it so many times that this was all that was left for Marcus to work with.

Marcus knew he only had 1 shot to put a new end on this cable before it would become necessary to run a new one- alone, and with a gigantic store display to be moved. With the deliberate care one would use to disarm a bomb, Marcus managed to crimp a new end on to the cable and jam it in to the router as it hung close to the wall. The garage's internet was restored. Marcus quickly packed up and walked on over to the pub, where he planned to confront Seymour over a few pints.

[Advertisement] BuildMaster integrates with an ever-growing list of tools to automate and facilitate everything from continuous integration to database change scripts to production deployments. Interested? Learn more about BuildMaster!

To read the full article, please visit The Daily WTF