News for hackers. Stuff that matters.
Re:"@" on Twitter by CGamesPlay on Friday April 27, 2018 @10:53PM (#16945841)
A similarly lulzy but much more sinister-looking bug happened at Facebook, where an index into an array of users was mistakenly treated as a user id, so the message intended for user 4 in the array ended up going to the user with ID 4, aka zuck.
Re:"@" on Twitter by V-eHGsd_ on Saturday April 28, 2018 @12:56AM (#16946125)
another facebook doozy was their "view my profile as <user>" feature. Apparently for some time after that it was released, when you used it view your profile, you could interact with facebook as <user>; including chatting as them, reading their messages, etc.

but then, I've had my share of turrible bugs too, so i'm not here to poke fun.

Re:"@" on Twitter by weberc2 on Friday April 27, 2018 @11:59PM (#16945995)
That sounds like a pretty PHP-specific bug.

Downvoters: most programming languages don’t silently convert strings (i.e., usernames) to array indices. Even Python doesn’t do this. While this particular bug probably wouldn’t be possible in most other languages, I’m only commenting because it’s rare and amusing to see bugs that are so language specific. I’m not making a generic “lol PHP” joke.

Re:"@" on Twitter by kemitche on Saturday April 28, 2018 @12:12AM (#16946021)
Both array indices and user IDs are numbers.

And it's certainly possible in Python to accidentally use a map as a list or vice versa, if the map has integer keys.

Re:"@" on Twitter by agency on Saturday April 28, 2018 @12:14AM (#16946026)
JavaScript does.

  var arr = ["one", "two", "three"];
  arr["2"] === "three"; // true
Re:"@" on Twitter by marcins on Saturday April 28, 2018 @06:04AM (#16946932)
JavaScript object property keys are always strings, so technically it’s `arr[2]` that has the 2 coerced to a string.
Re:"@" on Twitter by Zalastax on Saturday April 28, 2018 @01:49PM (#16948729)
It's true that object keys are strings, but the array and object situation of JavaScript is quite confusing. Arrays are indexed by numbers, but still accept string indices, leading to behavior like this: https://stackoverflow.com/q/9526860
Re:"@" on Twitter by Legogris on Saturday April 28, 2018 @03:12PM (#16949028)
Actually, that is incorrect. Arrays are different in JavaScript. I don't have time to look up the exact reference, but to get an idea: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

> Arrays cannot use strings as element indexes (as in an associative array) but must use integers. Setting or accessing via non-integers using bracket notation (or dot notation) will not set or retrieve an element from the array list itself, but will set or access a variable associated with that array's object property collection. The array's object properties and list of array elements are separate, and the array's traversal and mutation operations cannot be applied to these named properties.

Re:"@" on Twitter by ipsum2 on Saturday April 28, 2018 @12:13AM (#16946025)
I've been bitten by this bug before, PHP's associative arrays are pretty strange compared to other languages.
Re:"@" on Twitter by osrec on Saturday April 28, 2018 @01:22AM (#16946185)
I find it easier to think of them as an "ordered" hash map rather than an array...
Re:"@" on Twitter by igravious on Saturday April 28, 2018 @05:39AM (#16946854)
http://php.net/manual/en/language.types.array.php

First sentence, “An array in PHP is actually an ordered map.”

Re:"@" on Twitter by pmarreck on Saturday April 28, 2018 @09:19AM (#16947511)
I just read at least half that page and this idiotic design confirms exactly why I feel PHP should be considered harmful
Re:"@" on Twitter by osrec on Saturday April 28, 2018 @03:43PM (#16949130)
I don't think it's harmful. You just need to know what you're doing. PHP gets a bad rep round here unfairly. It's actually a very useful language which has proven itself over and over again in the wild. I wonder what you think of JavaScript?
Re:"@" on Twitter by pmarreck on Sunday April 29, 2018 @10:28PM (#16955246)
It's harmful exactly because it's ridiculously complex. And because it forces a Map/Dict to conform to an Array/List protocol, making it actually worse than both (it loses the O(1) or O(N) access time of the array/list, plus adds a bunch of complexity)
Re:"@" on Twitter by igravious on Monday April 30, 2018 @01:39PM (#16960596)
Disagree, it doesn't force anything to be anything else. It is what it is and it's pretty intuitive. PHP never claimed that arrays behave O(C) when accessing members†. It actually reduces complexity because there's only one container type. "Harmful" is ridiculous hyperbole, that's how the language is designed, you may not like how it's designed but not liking something doesn't make it harmful.

† btw, have you seen this? https://stackoverflow.com/questions/2473989/list-of-big-o-fo... pretty detailed investigation of big-O for PHP arrays

Re:"@" on Twitter by igravious on Sunday April 29, 2018 @08:05AM (#16951680)
Funny, that was one of the features I really liked about PHP back in the day.
Re:"@" on Twitter by chrfrasco on Saturday April 28, 2018 @12:13AM (#16946024)
Python doesn’t do any implicit coercion (apart from ints and floats etc), right?
Re:"@" on Twitter by ben509 on Saturday April 28, 2018 @12:11PM (#16948268)
It depends what you mean by coercion. For instance:

  class Foo:
    def __getitem__(self, x):
       return x

  i = iter(Foo())
  print(next(i))
  print(next(i))
That works because any object that provides __getitem__ "implements the iterable protocol."[1] I bring up __getitem__ because people familiar with Java are scratching their heads, "not only did you not declare any interfaces, this is just a convention, but there's also an __iter__ method. Huh?"

But interfaces are just one way to declare a type. The question is, did it convert it to a new type?

Well, what type was it before? If you want to talk about LSP[0], you're a bit stuck here since you can't prove anything about a method in python. (And here, we declared its type, and we said nothing about it being iterable or a sequence.) You have to run it because you don't know that a. Foo has __iter__ or __getitem__, b. that they accept the arguments you're going to pass, c. let alone that they're designed to, d. that the object won't simply delete them halfway through.

All that iter() is going to do is look for those methods and make assumptions that if you wrote __getitem__ that you meant it. At which point maybe LSP works, after all, you'll prove that it has that property by running the code and fixing it if it breaks.

But... python nevertheless will nevertheless construct this proxy to use your class based on inspection, which seems an awful lot like coercion to me.

[0]: Quoth Wikipedia: Let 𝜙(𝑥) be a property provable about objects 𝑥 of type T. Then 𝜙(𝑦) should be true for objects 𝑦 of type S where S is a subtype of T.

[1]: https://docs.python.org/3/glossary.html#term-iterable

Re:"@" on Twitter by jwilk on Sunday April 29, 2018 @05:15PM (#16953949)
In Python 2, bytes can be coerced to unicode:

  >>> b'egg' + u'spam'
  u'eggspam'
Unlike the example with bool+int, this can't be justified by LSP.
Re:"@" on Twitter by icebraining on Saturday April 28, 2018 @01:31AM (#16946208)
Well, booleans are integers, so you can do:

    >>> True + 1
    2
Re:"@" on Twitter by chrfrasco on Saturday April 28, 2018 @02:41AM (#16946387)

  fizzbuzz = lambda n: [print((“fizz” * m % 3 == 0) + (“buzz” * m % 5 == 0) or m) for m in range(n)]
Not sure if this is great or terrible
Re:"@" on Twitter by ubernostrum on Saturday April 28, 2018 @02:22AM (#16946337)
That's not "coercion", though. That's Python obeying the LSP, because bool is a subclass of int.