Each in caps 5 times with the same word with a period and space after each word and newline at the end is what I have found so far.

Can anyone find others?

Edit: added words that work found in other comments, and found more.

https://stackoverflow.com/questions/592322/php-expects-t-paa...

If PHP support has to handle the same stupid question about the meaning of a very unnecessary term that's confusing people and causing more support requests than anything else... then it made sense to change it.

I'm glad I read the blog post; it clears up a LOT of thoughts I had about the error... calling it childish seems off. Maybe you had a dog in the fight at some point?

No! But read the part where Rasmus Lerdorf "beams into" the conversation and his opinion is dismissed with "let's take a vote".

I mean, if you wanted a language that wasn't intentionally designed by Rasmus Lerdorf, you kinda picked the wrong one. This is what I was referring to.

One can like or dislike PHP for a variety of reasons, but surely being put off it for life because a non-English string is exposed to the end user is a bit much.

People are often defensive about PHP, but at the end of the day we choose our tools. I wrote a significant amount of PHP for a brief period and out of maybe 20 or so languages I've used professionally I found it by a wide margin the least pleasant to work with. Supposedly it has improved a lot, and I'm glad if so. But I have no desire to use it again, and am unlikely to ever have a reason to.

"Although", "Besides", and "Moreover" also trigger the behavior.

Edit: Got unbored. Discovered that "Firstly", "Secondly", "Thirdly", and "Fourthly" trigger the bug, but "Fifthly" and above do not.

Edit 2: The first word can actually be any of the "problem" words -- "Also. And. And. And. And." also has the issue.

I did not expect them to weaponize it, but Skynet does as Skynet does.

Though, when I worked on Google's indexing system, some researchers were having machine learning generate regexes to run on every page in the visible web... and mis-implemented the feature to re-compile the regex to DFA (which re2 effectively lazily converts to NFA via memoization) for every single page load. The speed of the indexing system dropped in half one day, and <Edit: Name Witheld> dug into it. <Name Withheld> took the gperf graph showing the giant node for regex compilation and wrote a savage meme "Your mother doesn't work here. Optimize your own code.", and sent it out to the researchers in question and also the indexing team. Maybe 6 months earlier, I cut into the same researchers for writing and approving C++ header file changes that defined (and leaked) macros "DO" for "{" and "OD" for "}" so that they could write C++ a bit more like Bash. As I remember, the macro leak for DO caused compilation errors in SpiderMonkey, which I fixed. After fixing the breakage, I just left an extra comment on the code review "Really? Leaking DO and OD macros to avoid typing curly braces?" without emailing any lists. They were really embarrassed removed DO and OD within a couple of days, and <Name Withheld> didn't know that I had laid into them a bit 6 months earlier.

(I had implemented some very coarse-grained super-lightweight type-based data flow analysis into SpiderMonkey, which is why some of the Google headers were being included while compiling SpiderMonkey.)

For my part, I once made a bad assumption about how the Google SAX-style parser handled callbacks for zero-length XHTML start-stop tags. I presumed that <title/> would get a callback with the end-of-open-tag and start-of-close-tag pointers being equal, at the character after the close of the tag. Instead, the parser called the callback with the start-of-close-tag pointer after the start-of-close-tag pointer. (I had misinterpreted the API as passing pointers to the start and end of enclosed content.) I had test cases for un-closed <title> tags and <title></title>... but when my code hit production, the few pages (fewer than 1 in a million) that expressed an empty title as <title/> caused my code to try and construct a string with negative length and crashed that portion of the indexing system. I was right to feel very embarrassed for my oversight.

I remember the savage meme so clearly because it was quite out of the norm, and I felt bad for the guys since they were so quick to fix things even when not publicly shamed. (Only the author and reviewer got notified when I left a comment on their code review.)

I had thought of the case for <title/> but basically out of laziness talked myself out of writing a separate test case for it, presuming the test cases for a zero-length title and an un-closed title covered the corner cases. (The entire document was guaranteed to be converted to valid UTF-8, perhaps with invalid character substitution characters, by that late in the Content Converter pipeline.)

So, as soon as someone asked me if I had changed the title parsing code, I was 50% sure of which corner case I had screwed up before looking at any code. It took me about 30 minutes to submit a code fix with updated test cases. I think less than 1 billion documents had been processed, resulting in less than 1,000 pages missing updates due to my bug.

About 4 years ago, I was managing a guy right out of school who pushed a minor bug that broke real-time risk calculations for a major multinational financial institution in the middle of the European trading day, prior to the NYC open, and people were yelling over email that they were trading blind. Someone had committed an important change right after his, so a simple rollback was highly sub-optimal.

Remembering how I felt years ago, I reassured the new guy that people were yelling over email because it was important, not because they were mad at him. I told him that I thought he was the most familiar with his change and the most capable person to fix it, and that he should do his best to calm down and focus, but he should let me know if he needed help, and I would do my best to calm folks down. I told him he would probably remember that mistake the rest of his life, but nobody else was going to remember it a week later. He had the bug fix in production in under an hour.

He sent me an email from home that night worried that he had let the team down, and I reiterated that he was going to be the only one who remembered the mistake longer than a week. The post-mortem follow-up was just to reiterate to authors and reviewers the importance of corner-case tests, and nobody brought it up later.

I really only remember it because my manager sent me an email that night praising how well I handled the new guy's first big production bug.

This is outstanding advice, and very well put. I shall be borrowing it, thank you!

I've definitely written more than one bug where post-mortem estimates were over $10,000 in losses.

August 20, 2013, I finished a code change (in Hong Kong) to Goldman's global algorithmic trading system and sent it out to a colleague in Europe to review. A friend of mine was a machine learning person in our Tokyo office and was in town for work, so a bunch of us had dinner and a small number of drinks. I stopped by the office on my way home to check if the change had been approved. It had, and I hesitated a bit to put it in production, because I had a couple of drinks and it was late at night. However, rationalized that I had written all of the code while awake and without a drop of alcohol, and pushed the change into production.

I woke up the next morning to read news [1] that Goldman had lost up to 100 million dollars in an automated trading problem within 1-2 hours after I pushed my change. I couldn't see how my change could possibly have caused that error, but was still a bit panicked until I reassured myself that my cell phone would have been called once a minute until I woke up if I had made a change that caused a loss of that magnitude.

I went into the office and saw that a chat window I had open with a friend in the NY office showed "presence unknown". An email sent to them bounced. So, I walked over to the derivatives (Flow) Strats desk, sat down in an empty chair next to one of my friends, and just quietly said "... so " and the name of my friend in NY. My friend on the Flow desk's eyes got wide and he said "how did you know?". I actually didn't know until the Flow Strat's reaction confirmed my guess.

My friend in New York was actually very careful, but he had been working under time pressure late at night and pushed a bug into production. He'd been more responsible than I had the night before. I got really lucky, and he got really unlucky. He's actually a really solid engineer. He caught plenty of very subtle bugs in other people's code, at least once when he hadn't been asked to review the code.

After August 20, 2013, if at all possible, I push changes into production before noon, and not on Fridays.

If memory serves the "maybe $100 million" ended up being around $28 million.

And that's the time that I could have easily caused a $28 million loss.

There was also a time I misplaced a paren and had a bad actor noticed, they could have used 60 million customer computers in a DDoS UDP traffic amplification attack. My test cases weren't matching my hand-worked-out examples, but I eventually just gave up and assumed my code was correct and put incorrect values in the message authentication code test vectors. Never roll your own crypto, especially if your test vectors aren't coming out as you expect. That was 2004.

[1] https://www.cnbc.com/id/100976404

Edit: if you are managing someone who is new in a job, it's your job to make sure they don't push bugs to break important stuff in the first place.

Yes, I and the person who reviewed the change bear more responsibility than the new developer. Also, I say "new guy", but the person who had interned with us the Summer after "the new guy" had already joined full time at that point, so "the new guy" had been working full time with the team for at least 9 months at that point. I also remember the room where it happened, which wasn't the first room we were in, so maybe he had been with us full time more like 18 months. In any case, it was the first time when he was trying keep the weight of billions of dollars out of his head and calmly but quickly fix a bug.

That's impractical in organizations with flatter structures and general purpose communication channels.

What would you suggest, kicking everyone off of internal IRC/Slack/mailing lists/etc.?

I guess there is some pressure/tiredness/newness/taste/external factors driving the choices, test count, and style guide aberrations.

Have you tried trigraphs? (/me ducks.)

I think it was an issue of familiarity and comfort, not newness. The author joined Google before I did. If you're basically working with one other person, and you're rarely getting code reviews from outside your coding pair, and few other people interact with your code, it's easy to develop some bad habits and forget that your code choices have externalities. To be fair, the externalities were usually rather small.

One can never, however, be sure that someone really feels that way ("The secret to success is sincerity - once you can fake that, you've got it made!") Nevertheless, faking it involves never saying certain things, and that turns out to be hard, so the fallible approach that I aspire to is to assume sincerity unless given evidence to the contrary.

In this view, blameless postmortems are the right way to go, at least up to a point: neither embarrassment nor regret are things that can truly be imposed from outside, and definitely not sincerity.

But culture isn't a magic tool that completely neutralizes assholes, and there are assholes in _every_ organization of sufficient size, like the "[name redacted]" character in the previous post

Edit: I should point out that we were in Google NYC, as were the researchers. We had lunch with them some times. I remember the first name and face of the guy who submitted the slow code, but forget his family name and intentionally left his name out.

New Yorker to New Yorker adds a lot of context. Google's corporate culture is generally very Californian, but this happened all within the New York office between people who generally got along pretty well and knew each other decently.

In context, there was a heavy note of respect for someone's abilities and disappointment that they weren't performing at a top level. He wouldn't have been so harsh with someone who was new or was a weaker engineer, or someone who wasn't used to New York culture.

As a lifelong Californian who moved to NY, this makes sense.

Though I don't know if it's a blanket excuse... There's a reason that my friends at Goldman would agree that Google's culture is better, and a lot of it has to do with the difference between CA and NY culture. I completely dismiss the claims that the difference is just about surface-level abrasiveness, instead of noticeable differences in how unkindly people treat each other. I regularly see strangers here treat each other in ways that I didn't see in 30+ years in California.

Ie, "he's from New York" isn't quite a rebuttal to "he's being an asshole at work". The work culture is more tolerant of assholes, but that barely makes it better.

New York and Hong Kong are both very impatient places that don't suffer fools lightly. They're both brutally honest places, but with strong shared identities. Both places have lots of people from elsewhere who are sympathetic to being new to the city.

The quintessential New York story is the woman pushing a stroller (buggy, for my overseas friends) out of a subway car. A man in a hurry is passing her, looks over his shoulder, they make eye contact and silently agree he should help. He grabs the front of the stroller, they carry it up the stairs, and he sets the stroller down at the top of the stairs. They give each other a nod, and he runs off. Never a word is spoken. On the other hand, if you stop in the middle of the sidewalk to read a map or talk on the phone in New York, don't be surprised if people bump into you, perhaps on purpose.

I just left Goldman after more than a decade. I actually really preferred the corporate culture to the Google culture, but most of my time was in Hong Kong. I even knew a couple of people who worked at Goldman, went to Google, and came back to Goldman. I don't doubt that there are some assholes there, particularly in trading, but my experience in both Strats and Technology was overwhelmingly positive. In my experience, abusive MDs didn't last long, but maybe I was very lucky. If you're having a tough time, I don't want to give out full names, but some pretty unique names: Laurent, Jia, Dunstan, and C.K. all really seem to care for their folks. The heads of SRE, One Delta Strats, and Flow Strats in Hong Kong also seem to be really great managers, but Grahaeme, Nick, and Alain are pretty common names.

At Google, a friend of mine managed a couple of small teams (on a shoestring budget, using mostly interns) and completed a couple of projects ahead of time, only to get them cancelled by middle management right before launch. One of the projects even had heavy buy-in from upper management, but he got essentially zero credit for either one because they were cancelled before launching. It was incredibly frustrating for him and he left. In my experience, Goldman runs projects much better, particularly using "Projito" internal contracts that list the value proposition, deliverables, timetable, and whose budget is paying for it.

Also, despite Goldman's reputation, I saw a lot less arrogance at Goldman than at Google. Goldman has a much more healthy respect for its competitors, though with good reason. I've also seen a few people transition from Google to Goldman and take a bit of time to adjust to the idea that Google's way of doing things is best in Goldman's operating environment. At Google, I got the sense that lots of people thought that Google was better than its competitors because they were smarter. At Goldman, I got the sense that lots of people felt they were better than their competitors because they had higher expectations of themselves.

Is there any science showing rude reviews improve some metric or some greater good?

There is a point where someone has to put their foot down and demand things be done properly, otherwise the inevitable consequence is a giant mess leading to disaster.

You might be used to small startup teams with responsible, experienced developers.

Out there in larger industry you get people doing absolutely crazy things that break huge, expensive systems.

There’s a difference between “oops I didn’t realise this library doesn’t scale the way I assumed it did” and “rewriting language symbols because I’m too stupid to use more than one syntax forever and ever.”

The standard you walk past is the standard you accept.

Are you saying you would walk past C code with DO…OD instead of {…}?

Would you accept that standard just to be “nice” all the time?

What I've learned since then is that, with a healthy company culture, you can give frank feedback -- even about stupid mistakes -- without it being a rebuke.

It's also important that you target the right problem. It's only human for smart people do stupid things sometimes. In the specific DO...OD example, I'd be more interested in how it got through a code review than the mistake itself. (Funny enough, early versions of the C source for Bash itself had macros like that.)

Now, if someone exhibits a pattern of ignoring good, constructive feedback, that's a problem. The folks I've seen like that both gave terrible feedback and took feedback terribly. That's a behavioral problem, and you only get so many chances to correct that before it's time for them to find other employment.

This is what management is for, too bad tech companies are too cool for that and prefer to live out lord of the flies.

I would just like to know exactly how are the engineers going to make the decisions, and the key point here being that they are in plural.

They all have different opinions, preferences, levels of ambition etc, how does this spontaneously merge into a cohesive team that pulls into the same direction?

It doesn't, in any other type of group in all of society. Every group needs a leader, so how is this spontaneously going to "just work" in software engineering?

If you don't want to have a manager, you have to have something else. Democracy? Plutocracy? Gerontocracy?

I think it's pretty obvious that just leaving it to chance is not going to be efficient or any type of healthy environment, and will probably quickly start to resemble something pretty nasty, especially because their livelihood is on the line.

Now if only we could all agree how that looks exactly

researcher types often get to work on problems that swe types find interesting, so some swes get grumbly. researcher types also tend to write pretty horrific code which adds salt to the wounds.

but there also can be a sort of envy that emanates from the research side. many are fully aware of their shortcomings and are envious of the swes ability to get things done on computers cleanly.

it often seems that there can be yearning to wear each other's hats from the two groups. if i were running a company i think i'd try to break down that wall as it would probably make a lot of people happier.

of course, the right answer here isn't a meme... it's performance regression tests in the ci suite. and maybe a little training on why customizing a programming language with macros is bad.

Both the author and the reviewer had passed C++ style certification. They knew why it was bad. They just got a little lazy and wanted to write their code in a way that felt familiar to them, and figured it was harmless. I got a bit grumpy at having to drop what I was doing right away to fix their mistake due to their laziness.

if so that's silly, as it is literally 2x the work to type.

if they also included some sort of state that had to be managed, then it starts to verge towards reasonable.

Yes, "OD" was definitely just "}". DO might have been ") {" to allow

  while (a < b DO
     ...
  OD

The real answer is to just do something like

  }  // while

True on a US keyboard, not true on many others.

I still find this kind of preprocessor abuse horrific; I’m just responding to your specific statement.

i once had a team lead in a quasi monorepo situation tell me straight up to copy-paste some functions i was interested in from their code. they made up some fishy story about deployments. was the story true? did they even know? did anyone know? who even owned it? would they even know?

or the guy who got up in arms because i touched his team's code and didn't write the unit tests that they didn't write when they originally wrote the code.

oh, monorepos.

Finding some perfect compromise for those groups would probably be a superpower for whichever org pulled it off, I agree.

When you go far away from the humanities, you lose some humanity.

Bash (like Bourne shell before it) uses do/done. I think DO/OD was in an Algol (68?). I'm not sure where else?

Bash does do the reversing for if/fi and case/esac, though.

The original bournegol macros for DO and OD were a bit different:

  #define DO ){
  #define OD ;}

Typically you run Flume over docjoins in your project’s quota. If you screw up, all that should happen is that your Flume job is out of quota.

We cared because indexing latency is important. Engineers get paged and woken up in the middle of the night when indexing latency gets high. Doubling CPU usage meant doubling indexing latency. The pre-Percolator indexing system ran roughly 1,000 threads per box on roughly 1,000 Warp18 boxes. Of course, most of those threads were blocked on I/O. (Warp18 was something like 16 cores per box... I think those were the RevE Opterons that had the memory fence bug that caused the glibc semaphore implementation to not actually synchronize operations.) I personally would have written things using more async and/or non-blocking I/O, but the main reasoning in Google at the time was that massively multithreaded blocking I/O is a simpler programming model and closer to what was being taught in school those days.

Also, the indexing system's quota is huge. Someone made a mistake in their benchmark program that they thought got maximum utilization out of the Warp18 hardware. The indexing system actually got higher utilization than the hardware stress-test, resulting in cooling being under-provisioned in the Atlanta datacener (more than a decade ago, I'm sure indexing has moved now). There was a couple day stretch one hot Summer where we needed to stay on the phone with staff inside the Atlanta DC to keep track of the temperature inside the datacenter. When the temperatures started to get above something like 80 F, we needed to dial back on the number of workers in our Borg jobs.

While testing the prototype for the Percolator indexing system, we were luckily sitting right next to an engineer who planned datacenters. We luckily overheard him saying he couldn't figure out why the power usage seemed to be swinging so wildly. It was literally the power usage of a decent sized town suddenly ramping up and down. We asked him the exact times power usage was ramping up and down, and figured out it was when Frank and Daniel were starting and stopping the Percolator prototype.

My best guess is that the indexing system right before Percolator was a bit more energy efficient than Percolator, but maybe not. In any case, doubling CPU usage was a big deal. Real money, and in Atlanta, probably real carbon footprint. (The Dales was hydro, but I don't think much of Atlanta's power was renewable at that time.)

It sounds like it would be even cooler to coordinate with the local electricity suppliers to spin up and shed extra load a few minutes in advance, but I'm not sure if this would actually have a practical benefit.

> Also, the indexing system's quota is huge.

Well, it might no longer be the case, but for a number of years the indexing cluster was the largest in the entire fleet, especially when it came to memory. I don't know if you were around in the days of yl-i (I think), but it was edifying to rank it against the Top500...

Was the datacenter engineer Peter P?

Also I’ve heard that Google automatically fails people who use regex in interviews, so their average engineers probably aren’t the best at it.

Hmm... I don't remember that, and I conducted over 100 interviews back when I was at Google. A blanket failure for using a regex sounds like it's missing some nuance. But, maybe that was before or after my time.

I wouldn't be surprised if they start out with some interview questions that are easy to implement as regexes, but then gradually make the question harder and more general, where a pushdown automaton is necessary for a general correct solution, and fail people who either don't get a correct answer or end up implementing a pushdown automaton by dynamically generating larger and larger regexes.

In general regexes finish instantly for normal sized inputs, but the actual O(n) might be quadratic or whatever.

> Probably…

Conclusions.

Any web app pentesters here willing throw in their 2c? Could this offer insights into the way data is parsed in the backend, or might result in something more interesting than a crash?

would be funny if it were a remotely exploitable bug in an api endpoint.

famous last words. finding security relevant bugs is often a game of identifying what the original developers might have found to be not "too exciting" or places they were out of their depth and then focusing intense effort on finding their mistakes.