News for hackers. Stuff that matters.
Re:How not to check the validity of an email address by Glyptodon on Wednesday September 04, 2013 @02:08AM (#6325888)
Every single legacy application I've ever worked on has had analogous code buried in it somewhere.

An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a web page. The page takes around 20 seconds to load. Switching it to use a single properly formatted SQL reduced load times to under a second.

Another legacy app I'm employed to "repair" has one single 'template' for every page on the whole site. Its first ~500 lines conveniently consist of a giant and highly nested if/else clause to set the page variables and inline javascript.

Such things are the result of "IT experts," "Software Managers," and "Product Administrators" who've never done real software/web development in their lives hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP.

It only gets lovelier when eventually somebody realizes it's a huge security risk and hires an outside development firm to "secure" it. (Giant eye roll. If they couldn't vet a programmer, you can bet they're great at vetting security consultants and contract developer shops.) Did you know that randomly moving code into folders named "private" and "public" for a few thousand dollars can solve giant architectural and security issues like ridiculously easy XSS and SQL injection?

I don't know what the deal is, but a huge proportion of people writing code are plain incompetent.

At my last company we fired someone who created huge amounts of work for everyone (he thought he could secure page content and alert messages by using base 64 encoding as a stand in for hashing and encryption, for example) and a few months later he was hired as lead developer by a pretty reputable educational business.

... sigh

Re:How not to check the validity of an email address by sown on Wednesday September 04, 2013 @03:21AM (#6326110)
> Every single legacy application I've ever worked on has had analogous code buried in it somewhere.

I'm not old enough to be responsible for stuff like that but I am incompetent enough.

Re:How not to check the validity of an email address by petenixey on Wednesday September 04, 2013 @07:35AM (#6326779)
I love your comment. Funny and humble.
Re:How not to check the validity of an email address by sown on Wednesday September 04, 2013 @12:57PM (#6328834)
Rest assured that while the person responsible for the legacy design flaw is perhaps long gone, I'll be right there...waiting, oblivious.
Re:How not to check the validity of an email address by impressive on Wednesday September 04, 2013 @07:11AM (#6326709)
> I'm not old enough to be responsible for stuff like that but I am incompetent enough.

Now that is a great conversation starter! I assume you think you know more than the senior/lead/architect on the team. You might, but have fun with that mentality. It's not sure to last. :)

Re:How not to check the validity of an email address by cema on Wednesday September 04, 2013 @11:29AM (#6328215)
You must have misread the parent in an interesting way.
Re:How not to check the validity of an email address by aptwebapps on Thursday September 05, 2013 @05:15AM (#6332997)
Not old enough as in hasn't produced any legacy code yet. Not in the sense of avoiding senility.
Re:How not to check the validity of an email address by bnejad on Wednesday September 04, 2013 @11:12AM (#6328074)
What are you on about?
Re:How not to check the validity of an email address by kylemaxwell on Wednesday September 04, 2013 @12:28PM (#6328621)
the GP said "incompetent enough"
Re:How not to check the validity of an email address by rpedela on Wednesday September 04, 2013 @11:26AM (#6328196)
What?
Re:How not to check the validity of an email address by jmadsen on Wednesday September 04, 2013 @03:50AM (#6326191)
>Another legacy app I'm employed to "repair" has one single 'template' for every page on the whole site. Its first ~500 lines conveniently consist of a giant and highly nested if/else clause to set the page variables and inline javascript.

oh, oh! I'm doing one of those. Only, it's a modern, MVC version, so there's actually a couple of dozen controllers with a single function each, and all actions snake through The Great Maze of Ifelsedom to set their rightful values, before traversing it once more on the page view file

Manager: "Uhm, I thought you said changing that label would be a 5 minute task?"

Re:How not to check the validity of an email address by umsm on Wednesday September 04, 2013 @12:06PM (#6328495)
Whenever something like that happens, this is my reference: http://developerexcuses.com
Re:How not to check the validity of an email address by fbernier on Wednesday September 04, 2013 @10:49PM (#6331902)

  git commit -m "$(curl -s developerexcuses.com | sed -n '/<a.*>/{s/<[^>]*>//g;p}')"
Re:How not to check the validity of an email address by brdrak on Thursday September 05, 2013 @12:50AM (#6332247)
Nice bit of sed. :-) Here's the best awk, I could muster:

  awk -F'>' -v RS='<' '/a href/{print$2}'
Re:How not to check the validity of an email address by raldi on Thursday September 05, 2013 @03:00AM (#6332618)
There's also:

    lynx -dump -nolist developerexcuses.com
Re:How not to check the validity of an email address by evincarofautumn on Wednesday September 04, 2013 @03:52AM (#6326195)
> Switching it to use a single properly formatted SQL reduced load times to under a second.

We need you to change it back because the system that scrapes that page is relying on the page load time.

Re:How not to check the validity of an email address by nwh on Wednesday September 04, 2013 @05:02AM (#6326400)
That is, computer running the sign on the front of the store pulls data from here, and you've completely broken it because now the page loads a second time before it can finish drawing the screen. It /needs/ that delay on the HTTP request in order to catch up. A real programmer would have thought of that. Add some loops, sleeps and rands; we can talk about your reckless conduct in the morning.
Re:How not to check the validity of an email address by nnnnni on Wednesday September 04, 2013 @07:54AM (#6326843)
What's worse is when fake delays are put into the code because (stupid) people think that the computer can't possibly be doing a good job if it retrieves the results in under a second. If it's "thinking", it's working well!
Re:How not to check the validity of an email address by pbhjpbhj on Wednesday September 04, 2013 @09:10AM (#6327274)
I thought the fake delays were so the programmer could cash in on doing optimisations at a later date.
Re:How not to check the validity of an email address by kamjam on Wednesday September 04, 2013 @09:56AM (#6327562)
Also, your ads are viewed for more seconds = more revenue
Re:How not to check the validity of an email address by nnnnni on Wednesday September 04, 2013 @05:19PM (#6330572)
Those two things are just added bonuses!
Re:How not to check the validity of an email address by entropic on Wednesday September 04, 2013 @09:30PM (#6331657)
Re:How not to check the validity of an email address by ceejayoz on Wednesday September 04, 2013 @08:32AM (#6327020)
See: banking websites.
Re:How not to check the validity of an email address by jfb on Wednesday September 04, 2013 @12:13PM (#6328528)
Just put a four way Cartesian join in a subselect that gets discarded. All unit tests pass! Ship it!
Re:How not to check the validity of an email address by jbaiter on Wednesday September 04, 2013 @03:52AM (#6326198)
> hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP.

That's pretty unfair to people coming from history or psychology who actually can write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.

Re:How not to check the validity of an email address by einhverfr on Wednesday September 04, 2013 @07:00AM (#6326678)
As a history major, I would agree with you.

One of the real issues has to do with the mentality of coding. There are people regardless of background who approach coding as a job, and those who approach it as a craft. You want the latter, not the former.

Here's my rule:

If you don't look back at code you wrote a decade ago with some degree of horror, you are either an extraordinarily good coder, or you aren't a good coder at all.

Re:How not to check the validity of an email address by dpcx on Wednesday September 04, 2013 @07:03AM (#6326684)
A decade is a long time at a single job... Try six months for a good start :)
Re:How not to check the validity of an email address by einhverfr on Wednesday September 04, 2013 @07:18AM (#6326734)
If you are coding at all outside of work you will have code to look back at.

The question is:

Are you improving? Or are you beyond improvement?

Re:How not to check the validity of an email address by krisgee on Wednesday September 04, 2013 @08:30AM (#6327009)
Six months? I come in after the weekend and constantly want to rewrite the whole goddamn thing.
Re:How not to check the validity of an email address by vxNsr on Wednesday September 04, 2013 @09:17AM (#6327315)
This^ and I'm only a student; I'll write a program in the evening and by the following morning I'm all, no, no, no!
Re:How not to check the validity of an email address by einhverfr on Wednesday September 04, 2013 @10:32AM (#6327810)
I tend to spend a lot of time planning (almost as much as coding). I do tend to notice big changes over a period of 2-3 years but areas where I can notice improvements in say six months.
Re:How not to check the validity of an email address by krisgee on Wednesday September 04, 2013 @08:05PM (#6331354)
I think I spend too much time planning and not enough time just getting shit done. It's one of the things that I feel like I have to work on this year.
Re:How not to check the validity of an email address by einhverfr on Wednesday September 04, 2013 @09:57PM (#6331751)
I don't think it is necessarily a bad thing. I spend a lot of time planning because I find my coding productivity is higher. Often it's better to let problems sit for a bit than to code then first, or if one does a mock-up it is an exploration that is part of the planning, to be discarded and done right a second time.

But what this means is I rarely come in the next week and wonder what I was thinking (it does happen, but rarely). More often I look at things, over a few months figure out better solutions to coding problems and my style changes accordingly.

Re:How not to check the validity of an email address by aptwebapps on Thursday September 05, 2013 @05:18AM (#6333008)
That's good, but the rate slows down over time.
Re:How not to check the validity of an email address by mitchty on Wednesday September 04, 2013 @08:36AM (#6327050)
I look at stuff I wrote 3 months ago with horror.

Then again I started learning ios programming then so I might have a bias/reason for it. >.<

Re:How not to check the validity of an email address by mncolinlee on Wednesday September 04, 2013 @01:42PM (#6329112)
I became an English major because I'd been coding since I was six years old and preferred to learn how to become a better writer.

At the time, the majority of incoming CS freshman did not even harbor the most basic ideas or curiosity about how a computer functioned. They had all heard they could make mounds of money. When I took elective CS classes in college, I had graduate CS students attempting to copy off of me.

It's possible CS students and programs have changed since the 90s, but based upon the CS graduates I encounter, I expect they haven't improved that much.

Re:How not to check the validity of an email address by rmc on Wednesday September 04, 2013 @05:09AM (#6326421)
Here here. There are plenty of people who have CS degrees and can't programme. Why else do we need "FizzBuzz".
Re:How not to check the validity of an email address by TazeTSchnitzel on Wednesday September 04, 2013 @06:21AM (#6326585)
It's "hear, hear!" - an abbreviation of "Hear him, hear him!".
Re:How not to check the validity of an email address by shrikant on Thursday September 05, 2013 @04:56AM (#6332936)
This one annoys me as much as "bare with me"..
Re:How not to check the validity of an email address by mje__ on Thursday September 05, 2013 @07:15AM (#6333404)
Yeah, it "literally" kills me every time
Re:How not to check the validity of an email address by protomyth on Wednesday September 04, 2013 @01:30PM (#6329053)
I knew a music major who was a better coder than most of the CompSci grads.

At one job, I judged coding ability by the number of times your SQL woke me up due to huge I/O usage[1]. Many a CS graduate cannot read a query plan.

1) if it looked like a reasonable query and it was just Sybase's crap optimizer, I gave them a pass. Although, after a while, you learned to force the indexes.

Re:How not to check the validity of an email address by Glyptodon on Wednesday September 04, 2013 @10:37AM (#6327839)
Yeah, I didn't mean to sound so derogatory, but out of non-formally-trained developer co-workers I've ever had only a handful didn't create work for everyone.

The two most common issues are inability to create sanely defined and decomposed schemas and clearly written queries, and poor ability to structure code in an organized way.

That said, I have known a couple very good coders without any kind of formal education. They just seem to be outliers.

When dealing with formally trained developers I've certainly encountered the incompetent also, but I'd say at an easy majority of trained coders I've worked with are competent enough to not be hard to work with.

Mind I you I do not claim to be a "superstar developer" or anything. The state of the art tends to change just a bit faster than I can keep up with these days.

Re:How not to check the validity of an email address by alsocasey on Wednesday September 04, 2013 @11:32AM (#6328236)
Conversely, I'd hazard a guess that <10% of my outgoing CS class were competent in the way you describe... I'm fairly certain that the "ability to create sanely defined and decomposed schemas and clearly written queries, and structure code in an organized way" is the outlier here.
Re:How not to check the validity of an email address by hcayless on Wednesday September 04, 2013 @06:12AM (#6326566)
Speaking as a former history major, thanks! :-) Code like that is written by people who don't really understand how their code works and there are plenty of CS majors in that category. With any luck, they are swiftly promoted to management where they can do less harm.
Re:How not to check the validity of an email address by stinos on Wednesday September 04, 2013 @10:22AM (#6327729)
I know it's unfair to generalize, but seriously if we'd had to put numbers on it and perform statistics on it (something most psychology degrees are pretty capable of even though the way they do it might raise questions) I'm rather sure the outcome would be close to: sorry, but 90% cannot write good code. Why I think this? Because I've seen and fixed code written in multiple laguages by psychology degrees (about 20 in total, from more than one institution) for the last ten years. And there are just no words for how awful it was. Hell, I've seen matlab scripts in which I would use the same dataset for both dataset arguments and still the result was there was a statistically relevant (p < 0.01) difference between the two.
Re:How not to check the validity of an email address by superuser2 on Wednesday September 04, 2013 @11:24AM (#6328176)
Indeed. It would have been better as "CS degrees from JavaSchools."
Re:How not to check the validity of an email address by etler on Wednesday September 04, 2013 @02:33PM (#6329480)
I'm starting to really dislike the term "legacy code". It implies the code is bad because it's old. It perpetuates the misconception that code gets "stale" and problems build up. But that's not true. "Legacy code" is bad because it's BAD. All code is "legacy code" because unless the project is brand new, it has some history. We just don't call good old code "legacy code" because it hasn't caused us any problems. There is no reason to correlate bad code with age.
Re:How not to check the validity of an email address by cperciva on Wednesday September 04, 2013 @03:04PM (#6329684)
I think you're misunderstanding the term. Legacy code -- like legacy lots of other things -- is the intersection of "bad" and "it's too late to fix now".

Code which can be fixed easily isn't "legacy". Code where a replacement would need to be bug-for-bug compatible in order to avoid breaking things is "legacy".

Re:How not to check the validity of an email address by ante_annum on Thursday September 05, 2013 @12:26PM (#6335076)
My favorite definition of legacy code is bad code for which no tests exist. It's terrible because people have no idea what to do with it and no idea what they're breaking when they change it.

You could be writing legacy code today.

Re:How not to check the validity of an email address by sopooneo on Thursday September 05, 2013 @09:59AM (#6334198)
I've heard of that scenario, but I'm curious about what the best way to produce a bug-for-bug replacement would be. Should you do it right, and then put a layer in front of it that switches/transforms the output to match the old errors?
Re:How not to check the validity of an email address by danielweber on Wednesday September 04, 2013 @05:27PM (#6330621)
Code sitting on the same machine can keep on performing the same way forever.

But other things change. The library changed its interface. You coded your crypto lib when MAC-then-Ecrypt was all the rage. You aren't handling HTTP/1.0 headers. Windows 7 doesn't even have those 16-bit drivers any more.

I hate the "throw everything away and rewrite with the brand new frame work every two years" that some parts of the web development community seem to have (and then get angered when you ask about a version over six months old because it is what you installed everywhere). But sometimes software does rot if it's old and no one is trying to keep it up-to-date.

Re:How not to check the validity of an email address by willthames on Wednesday September 04, 2013 @07:14PM (#6331138)
In 'Working with Legacy Code', Michael Feathers defines legacy code as code without sufficient tests.

The great thing about this definition is that it doesn't matter how old the code is - if it can be changed without worry about introducing unwanted behaviour because of test coverage, then it's not legacy.

It also means that you can write new legacy code right now!

Re:How not to check the validity of an email address by MartinCron on Wednesday September 04, 2013 @09:35PM (#6331681)
It also means that you can write new legacy code right now!

I once made the argument that a team within my organization was actively producing new legacy code. It wasn't my most diplomatic moment.

Re:How not to check the validity of an email address by jrgnsd on Thursday September 05, 2013 @04:33AM (#6332870)
The only legacy code that people talk about is bad legacy code. People never fondly remember the function they wrote ten years ago that's still doing what it should do, no debugging required.

It's always the function that's been rewritten twenty times that gets labelled as legacy code.

Re:How not to check the validity of an email address by andyroid on Wednesday September 04, 2013 @03:12PM (#6329730)
While code may not go bad with age, the surrounding world (compilers, frameworks, dependencies) change constantly. So while the code quality of a million LOC Java 1.0 application might be stellar, maintaining it may still be a royal pain. So in one way code does get "stale" when left untouched for too long.
Re:How not to check the validity of an email address by MartinCron on Wednesday September 04, 2013 @09:34PM (#6331674)
Look at it this way: any legacy code that people care enough to still support is code that works, at least a little bit.
Re:How not to check the validity of an email address by stephen_g on Wednesday September 04, 2013 @10:16PM (#6331807)
I take the term more to mean 'under-maintained code' than just old code.
Re:How not to check the validity of an email address by skizm on Wednesday September 04, 2013 @05:25PM (#6330610)
> I don't know what the deal is, but a huge proportion of people writing code are plain incompetent.

Hooray for short term job security!