Zum Hauptinhalt springen
••
Linux Tipps & HardeningSecurity: Mehrere Probleme in lemonldap-ng (Fedora)(04.10.2026 um 09:18 Uhr)
•
Linux Tipps & HardeningSecurity: Denial of Service in nanosvg (Fedora)(04.10.2026 um 09:18 Uhr)
••
Sicherheitslücken (CVE)CVE-2025-29933 | AMD μProf up to 5.0 out-of-bounds write(04.10.2026 um 22:31 Uhr)
•••
Sichere ProgrammierungSafeSpeak -A Private English Practice Partner for My Shy Friend(04.10.2026 um 22:48 Uhr)
•
Sichere ProgrammierungBlazor Forms Hate Immutability(04.10.2026 um 22:48 Uhr)
•••
Linux Tipps & HardeningSecurity: Mehrere Probleme in lemonldap-ng (Fedora)(04.10.2026 um 09:18 Uhr)
•
Linux Tipps & HardeningSecurity: Denial of Service in nanosvg (Fedora)(04.10.2026 um 09:18 Uhr)
••
Sicherheitslücken (CVE)CVE-2025-29933 | AMD μProf up to 5.0 out-of-bounds write(04.10.2026 um 22:31 Uhr)
•••
Sichere ProgrammierungSafeSpeak -A Private English Practice Partner for My Shy Friend(04.10.2026 um 22:48 Uhr)
•
Sichere ProgrammierungBlazor Forms Hate Immutability(04.10.2026 um 22:48 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

CodeSOD: A Real POS Report

Eddie's company hired a Highly Paid Consultant to help them retool their systems for a major upgrade. Of course, the HPC needed more and more time, and the…

Beitrag
0
Seite
0
↗ Quelle (thedailywtf.com)
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!

Eddie's company hired a Highly Paid Consultant to help them retool their systems for a major upgrade. Of course, the HPC needed more and more time, and the project ran later and later and ended up wildly over budget, so the HPC had to be released, and Eddie inherited the code.


What followed was a massive crunch to try and hit absolutely hard delivery dates. Management didn't want their team "rewriting" the expensive code they'd already paid for, they just wanted "quick fixes" to get it live. Obviously, the HPC's code must be better than theirs, right?


After release, a problem appeared in one of their sales related reports. The point-of-sale report was meant to deliver a report about which items were available at any given retail outlet, in addition to sales figures. Because their business dealt in a high volume of seasonal items, every quarter the list of items was expected to change regularly.


The users weren't seeing the new items appear in the report. This didn't make very much sense- it was a report. The data was in the database. The report was driven by a view, also in the database, which clearly was returning the correct values? So the bug must be in the code which generated the report…


If POSItemDesc = "Large Sign" Then
grdResults.Columns.FromKey("FColumn12").Header.Caption = "Large Sign"
End If
If POSItemDesc = "Small Sign" Then
grdResults.Columns.FromKey("FColumn12").Header.Caption = "Small Sign"
End If
If POSItemDesc = "2x2 Hanging Sign" Then
grdResults.Columns.FromKey("FColumn12").Header.Caption = "2x2 Hanging Sign"
End If
If POSItemDesc = "1x1 Sign" Then
grdResults.Columns.FromKey("FColumn12").Header.Caption = "1x1 Sign"
End If
'.........Snipping more of these........
If POSItemDesc = "Light Thief" Then
grdResults.Columns.FromKey("FColumn12").Header.Caption = "Light Thief"
End If
If POSItemDesc = "Door Strike" Then
grdResults.Columns.FromKey("FColumn12").Header.Caption = "Door Strike"
End If

First, it's worth noting that inside of the results grid display item, the HPC named the field FColumn12, which is such a wonderfully self documenting name, I'm surprised we aren't all using that everywhere. But the more obvious problem is that the list of possible items is hard-coded into the report; items which don't fit one of these if statements don't get displayed.


At no point, did the person writing this see the pattern of "I check if a field equals a string, and then set another field equal to that string," and say, "maybe there's a better way?" At no point, in the testing process, did anyone try this report with a new item?


It was easy enough for Eddie to change the name of the column in the results grid, and replace all this code with a simpler: grdResults.Columns.FromKey("POSItem").Header.Caption = POSItemDesc, which also had the benefit of actually working, but we're all left puzzling over why this happened in the first place. It's not like the HPC was getting paid per line of code. Right? Right?


Of course not- no HPC would willingly be paid based on any metric that has an objective standard, even if the metric is dumb.



[Advertisement]
ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten CodeSOD: A Real POS Report

Thematisch verwandte Begriffe: CodeSOD, Real, Report · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
Nächster Beitrag