This code review gave me eye cancer.

So, first of all, let me apologize to anyone impacted by eye cancer, if that really is a thing... because that sounds absolutely horrible. But, believe me, this code was absolutely horrible, too.

I was asked to code review another team's script. I don't like reviewing code from other teams, as I'm pretty "intense" and a nit-picker -- my own team knows and expects this, but I tend to really piss off other people who don't expect my level of input on "what I really think" about their code...

So, I get this script to review. It's over 200 lines of bash (so right away, it's fair game for a boilerplate "this should be re-written in python" or similar reply)... but I dive in to see what they sent.

My eyes.

My eyes.

MY EYES.

So, I certainly cannot violate IP rules and post any of the actual code here (be thankful - be very thankful), but let me just say, I think it may be the worst code I've ever seen. And I've been coding and code-reviewing for upwards of 30 years now. And I've seen a LOT of bad code...

I imagine the author of this script was a rebellious teenager who found the google shell scripting style guide and screamed "YOU'RE NOT MY REAL DAD!" at it and then set out to flagrantly violate every single rule and suggestion in the most dramatic ways possible.

Then they found every other style guide they could, and violated all THOSE rules, too. Just because they were there.

Within the same script... within the SAME CODE BLOCK... 2-space indentation... 4-space indentation... 8-space indentation... TAB indentation... and (just to be complete) NO indentation (entire blocks of code within another function of conditional block, all left-justified, no indentation at all).

lowercase variable/function names, UPPERCASE names, underscore_separated_names, CamelCase names, and every permutation of those as well.

Comments? Not a single one to be found, aside from a 4-line stanza at the top, containing a brief description of that the script did and (to their shame), the name of the author. There were, however, ENTIRE BLOCKS of code commented out.

[ In the examples below, I've replaced indentation spacing with '-', as I couldn't get devrant to format the indentation in a way to suitably share my pain otherwise... ]

Within just a few lines of one another, functions defined as...

function somefunction {
----stuff
}

Another_Function() {
------------stuff
}

There were conditionals blocks in various forms, indentation be damned...

if [ ... ]; then
--stuff
fi

if [ ... ]
--then
----some_stuff
fi

if [ ... ]
then
----something
something_else
--another_thing
fi

And brilliantly un-reachable code blocks, like:

if [ -z "$SOME_VAR" ]; then
--SOME_VAR="blah"
fi

if [ -z "$SOME_VAR" ]
----then
----SOME_VAR="foo"
fi

if [ -z "$SOME_VAR" ]
--then
--echo "SOME_VAR must be set"
fi

Do you remember the classic "demo" programs people used to distribute (like back in the 90s) -- where the program had no real purpose other than to demonstrate various graphics, just for the sake of demonstrating graphics techniques? Or some of those really bad photo slideshows, were the person making the slideshow used EVERY transition possible (slide, wipe, cross-fade, shapes, spins, on and on)? All just for the sake of "showing off" what they could do with the software? I honestly felt like I was looking at some kind of perverse shell-script demo, where the author was trying to use every possible style or obscure syntax possible, just to do it.

But this was PRODUCTION CODE.

There was absolutely no consistency, even within 1-2 adjacent lines. There is no way to maintain this. It's nearly impossible even understand what it's trying to do. It was just pure insanity. Lines and lines of insanity.

I picture the author of this code as some sort of hybrid hipster-artist-goth-mental-patient, chain-smoking clove cigarettes in their office, flinging their own poo at their monitor, frothing at the mouth and screaming "I CODE MY TRUTH! THIS CODE IS MY ART! IT WILL NOT CONFORM TO YOUR WORLDLY STANDARDS!"

I gave up after the first 100 lines.

Gave up.

I washed my eyes out with bleach.

Then I contacted my HR hotline to see if our medical insurance covers eye cancer.

One week, and it turned out to be worse than that.

I was put on a project for a COVID-19 program in America (The CARES Act). The financial team came to us on Monday morning and said they need to give away a couple thousand dollars.

No big deal. All they wanted was a single form that people could submit with some critical info. Didn't need a login/ registration flow or anything. You could have basically used Google Forms for this project.

The project landed in my lap just before lunch on Monday morning. I was a junior in a team with a senior and another junior on standby. It was going to go live the next Monday.

The scope of the project made it seem like the one week deadline wasn't too awful. We just had to send some high priority emails to get some prod servers and app keys and we were fine.

Now is the time where I pause the rant to express to you just how fine we were decidedly **not**: we were not fine.

Tuesday rolls around and what a bad Tuesday it was. It was the first of many requirement changes. There was going to need to be a review process. Instead of the team just reading submissions from the site, they needed accept and reject buttons. They needed a way to deny people for specific reasons. Meaning the employee dashboard just got a little more complicated.

Wednesday came around and yeah, we need a registration and login flow. Yikes.

Thursday came and the couple-thousand dollars turned into a tens of millions. The amount of users we expected just blew up.

Friday, and they needed a way for users to edit their submissions and re-submit if they were rejected. And we needed to send out emails for the status of their applications.

Every day, a new meeting. Every meeting, new requirements that were devastating given our timeframe.

We put in overtime. Came in on the weekend. And by Monday, we had a form that users could submit and a registration/ login flow. No reviewer dashboard. We figured we could take in user input on time and then finish the dashboard later.

Well, financial team has some qualms. They wanted a more complicated review process. They wanted roles; managers assign to assistants. Assistants review assigned items.

The deadline that we worked so hard on whizzed by without so much as a thought, much less the funeral it deserved.

Then, they wanted multiple people to review an application before it was final. Then, they needed different landing pages for a few more departments to be able to review different steps of the applications.

Ended up going live on Friday, close to a month after that faithful Monday which disrupted everything else I was working on, effective immediately.

I don't know why, but we always go live on a Friday for some reason. It must be some sort of conspiracy to force overtime out of our managers. I'm baffled.

But I worked support after the launch.

And there's a funny story about support too: we were asked to create a "submit an issue" form. Me and the other junior worked on it on a wednesday three weeks into the project. Finished it. And the next day it was scrapped and moved to another service we already had running. Poor management like that plagued the project and worked in tandem with the dynamic and ridiculous requirements to make this project hell.

Back to support.

Phone calls give me bad anxiety. But Friday, just before lunch, I was put on the support team. Sure, we have a department that makes calls and deal with users. But they can't be trained on this program: it didn't exist just a month ago, and three days ago it worked differently (the slippery requirements never stopped).

So all of Friday and then all of Saturday and all of Monday (...) I had extended panic attacks calling hundreds of people. And the team that was calling people was only two people. We had over 400 tickets in the first two days.

And fuck me, stupid me, for doing a good job. Because I was put on the call team for **another** COVID project afterwards. I knew nothing about this project. I have hated my job recently. But I'm a junior. What am I gonna say, no?

Client: Extend string size for that URL field. I have to input a really large URL in there.

Me: Please show me the URL first.

Client: Here it is //randomurl.com/random-route/15363783?i=jfjfjfjjfjfjhf&shit=jfjfjkfkfkgjfjjhh74747jdjh&you=kfjfjbhgg779hdhhd&not=jfjhdh63737#fuckingKiddingMe

Me: You can leave the whole part after the question mark. Insert it like //randomurl.com/random-route/15363783

Client: Ok, great. Thanks.

#####

Me later checking the data inserted:

//randomurl.com/random-route

I hate humans.

Worst legacy experience...

Called in by a client who had had a pen test on their website and it showed up many, many security holes. I was tasked with coming in and implementing the required fixes.

Site turned out to be Classic ASP built on an MS Access database. Due to the nature of the client, everything had to be done on their premises (kind of ironic but there you go). So I'm on-site trying to get access to code and server. My contact was *never* at her desk to approve anything. IT staff "worked" 11am to 3pm on a long day. The code itself was shite beyond belief.

The site was full of forms with no input validation, origin validation and no SQL injection checks. Sensitive data stored in plain text in cookies. Technical errors displayed on certain pages revealing site structure and even DB table names. Server configured to allow directory listing in file stores so that the public could see/access whatever they liked without any permission or authentication checks. I swear this was written by the child of some staff member. No company would have had the balls to charge for this.

Took me about 8 weeks to make and deploy the changes to client's satisfaction. Could have done it in 2 with some support from the actual people I was suppose to be helping!! But it was their money (well, my money as they were government funded!).

I was pressued to shift the blame.

We received an angry email from a customer that some of their data had disappeared. The boss assigns me to this task. This feature is relatively new and we've found some bugs in the past in here. I go through request logs, search the database, run some diagnostics, etc. for about 5 hours and I cannot find the problem. I focus on the bugs that we've had before but they don't seem to be the problem.

I tell the boss "sorry but I checked XYZ and I can't find the problem. I'm out of ideas." But the boss wanted answers by the end of the day. They did not want to admit to the client that we couldn't figure out what's wrong.

By now I was more pressured to find an answer, find something or someone to blame it on, not exactly to find the real solution. So I made up some BS:

"Sometimes, in HTML forms, the number inputs allow you to change the number by scrolling. We have some long forms where the user has to scroll. Perhaps the focus remained on the number input, so when they scrolled down they accidentally changed the number they meant to input."

The boss was happy with that. We explained this to the customer, and there's now a ticket to change type="number" to type="text" in our HTML forms and to validate it in th backend.

A week later another customer shows us a different error. This one is more clear because it had a stack trace, but I realise that this error is what caused our last error. It was pretty obscure, mind you, the unit tests didn't detect it.

I didn't tell the boss that they were connected tho.

With two angry clients in two weeks, I finally convinced the boss to give us more time to write more unit tests with full coverage.

I sometimes put "[Object object]" in input forms, in hopes of making the devs debugging it lose their freaking minds.

Updating code for big client.

Find that they are not encrypting passwords in the database and are not sanitizing user input from forms.

Do not trust the user!

I might be fucked up, but I have a tendency to gravitate towards the shit that everyone else dislikes for the sake of knowing if their bias against is actually because shit is truly fucked up or if shit is legit plain WRONG.

From all technologies that I have worked with professionally I can count:

Java(currently in the form of old JSP services for an "enterprise level application")

Java for Android development - i was the lead engineer for a mobile project

Swift with IOS dev, same gig as the above.

C++ for Android development in the form of OpenCV with Java as well.

Javascript in all possible forms, basic input validation, ajax services, jquery datatables, jquery animations and builders.

Css/sass heavily

Clojure for an ldap active directory application

Python for glue scripts

Classic ASP with JScript and VBScript

VB Net forms

C# For ASP.NET MVC

Bootstrap for multiple intranet frontends

Node+Express for a logistics warehouse management tool

Ruby on Rails freelancing small gigs

Php in all ways possible from complete standalone php apps to Laravel and just php+composer apps aaaaall the way to wordpress

Django consulting

I have found that the one that I dislike the most is wordpress. And the one that I like working with the most is Node. Don't know why, i just do really fucking like messing around with Javascript, the language has changed a fuckload throughout the years and continues to increase and change. It was my first scripting language following a stint in me trying to learn cpp way when i was starting and royally FAILING

Never really got the hate for it, even when I used JScript with classic ASP i just enjoy working with Javascript a lil too much. And from all the above mentioned stacks safe from Php is the one, or one of the ones in which i don't royally suck :V

Let's talk about input forms.

Please don't do that!

Setting time with the arrow buttons in the UI.
Each time change causes the page to re-fetch all the records. This is fetching, parsing, rendering tens of thousands of entries on every single click. And I want to set a very specific time, so there's gonna be a lot of gigs of traffic wasted for /dev/null.

Do I hear you say "just type the date manually you dumbass!"? I would indeed be a dumbass if I didn't try that. You know what? Typing the date in manually does nothing. Apparently, the handler is not triggered if I type it in manually/remove the focus/hit enter/try to jump on 1 leg/draw a blue triangle in my notebook/pray

NO. NO. A THOUSAND TIMES: NO.

I clicked on this out of genuine curiosity to see if someone was finally trying to discourage people from annoying the shit out of website visitors. A summary of the suggestions in their article as to what to use popups for:

1. Announce new products/services, features, policy updates, new blog posts
2. Promote your sales or coupons (including countdowns)
3. Encourage people to input their e-mail address / subscribe, perhaps also offering some vague thing they will get as a reward for doing so
4. Contact forms (e.g. support etc.)
5. Prompt visitors to confirm their age before showing content
6. Login/register forms
7. Display social media "share" buttons when a visitor has scrolled a certain way through the page content.
8. Display cookie consent prompt.
9. Help guide visitors to the part of the website they want to go to.

Of these: 1, 2, 3, and 7 need to die for sure. If a website does any of these things I'm inclined to immediately leave and never return. 8 is a little annoying but seems a necessity.

Someone even replied to the Tweet saying that popups are annoying, the company responded with "let's change that!"

Blank portions of the screenshot are to avoid promoting the company unintentionally as a result of the rant ;)

Forms with autofocus. What are your opinions on that?

My boss keeps asking us to always give autofocus to the first input of a form, without any UX study to support it, just his opinion ("I think it makes sense"). I fucking hate it. He says it's nice for keyboard users, but I'm a keyboard user myself and I say that's what the tab key is for. To fucking focus stuff.

It really annoys me to no end when things like this are requested, but it's ok to have buttons, checkboxes, etc without fucking :focus and :active styles. Just :hover is not enough ffs.

And "links" that work with "onclick". Damn how I want to kill anyone that does that.

Should I be excited or concerned?

Newbie dev(babydev) who just learned string vs int and the word "boolean", is SUPER into data parsing, extrapolation and recursion... without knowing what any of those terms.

2 ½ hrs later. still nothing... assuming he was confused, I set up a 'quick' call...near 3 hrs later I think he got that it was only meant so I could see if/where he didnt understand... not dive into building extensive data arch... hopefully.

So, we need some basic af PHP forms for some public-provided input into a mySQL db. I figured I'd have him look up mySQL variables/fields, teach him a bit about proper db/field setup and give him something to practice on his currently untouched linux container I just set up so he could have a static ipv4 and cli on our new block (yea... he's spoiled, but has no clue).

I asked him to list some traits of X that he thinks could be relevant. Then to essentially briefly explain the logic to deciding/returning the values/how to store in the db... essentially basic conditionals and for loops... which is also quite new to him.

I love databases; I know I'm not in the majority... I assumed he'd get a couple traits in his mind and exhaust himself breaking them down. I was wrong. He was/likely is in his sleep now, over complicating something that was just meant as a basic af.

Fyi, the company is currently weighted towards more autistics (him and myself included) than neurotypicals.

I know I was(still am) extremely abnormal, especially when it comes to things like data.

So, should I be concerned/have him focus elsewhere for a bit?... I dont want to have him burnout before he even gets to installing mySQL

Generally devs who are too arrogant to accept help or constructive criticism. There’s this data visualisation library that missed a specific feature that psychologists use quite frequently, so I added it myself and opened a PR. The maintainer closed it because people should use whatever he’d already implemented. It’s like not giving someone the option to listen to disco because rock music is better. Yeah, cool story bro. Now all my visualisation projects depend on my fork instead. Same with the now abandoned Material Design Library devs. They didn’t have a drop down with free input, so I opened a PR with my solution. Closed as it was out of scope, simply because Google didn’t specifically include that in the Material specs, only an input and a drop down separately which my solution matched. I also opened a PR for an obviously missing feature (being able to validate forms via JS), closed as this behaviour wasn’t in the Material specs either. No wonder MDL died before it was ever finished.

So I want to inform my internet provider of my new phone number, but I can't remember any of my login info for their web interface because I never used it. Luckily, they have a "forgot my username" function, where I submit my email address and get a confirmation that my username has been sent to me.

Yet, I just don't get said email. I try again, but no avail. So I just guess my username and use their "forgot password" form, which – hooray! – confirms it just sent my an email.

But I don't get any email. I retry, I retry after a day, but no automatic response. I remember a incident a few years back when I didn't get some automatically generated mails from a company and decide to contact their support if they could just reset my password manually.

Nearly a week passes.

Now I received the answer. I just don't have an account.

Lesson learned: Next time I'll just input garbage first to check if those forms are sane.

My colleague had some problems today.
He had problems from both user input and predefined strings sent with ajax to backend. The "&"-sign was splitting values in GET-requests into unintended parameters. So... he was simply going to search and replace all of those signs with the word "and"...

encodeURI()? Why are you sending our forms with GET-requests?! 🙃

Hey just brainstorming a business/ startup idea I may try out sometime down the line. I wanted to put it in writing available to my peers for review. If that sounds boring, sorry.

So I've had an idea and I know it's a million dollar idea because it's absolutely boring as fuck.

Recently I have been learning about NoSQL and it has gotten me pretty excited about unstructured data.

Now the first thing you should know about me is I like to make business software. I don't like games or social networks or blah blah blah, I like business stuff. One dream I have always had is to make THE business solution. I've noticed so many specific business solutions for very specific areas of work. Specific software for car washes, which is separate from the software for car maintenance, which is separate from the point-of-sales software, which is separate from the [...]

One of the problems with this is the inconsistency. Modular is good, but only if the modules are compatible. They aren't. Training needs to be provided for each individual system since they are all vastly different. And worst of all, since all of these different applications reach their own niche market, they charge out the butt for things that are usually very simple "POST a form over http(s)" machines.

I mean let's not get too dreamy here. My solution is an over-complicated form-builder. But it would be a game-changer for small and medium-sized businesses. Allowing users to build their own front-end and back-end disguised as a drag-and-drop form builder would be THE alternative, because they could bring all of their solutions into a single solution (one bill!) and since THEY are the ones that build what they need, they can have custom business software for the price of a spreadsheet program.

The price difference we could offer would be IMMENSE. Not only would we be able to offer "cookie-cutter" pricing as opposed to "custom" pricing, but since this generic solution could be used for essentially all of their systems, we aren't just decreasing one bill. We're decreasing one bill, and eliminating the rest entirely. We could devastate competition.

"BUT ALGO", you scream in despair, "USERS AREN'T SMART ENOUGH TO DRAG AND DROP FORM PARTS TO MAKE A FORM"

I mean ya true. But you say that like it's a bad thing. For one, we can just offer a huge library of templates. And for another, which is part of the business plan, we can charge people support dollars to help them drag and drop their stupid fucking forms!! Think of the MONEEYYYY YOU COULD MAKEE BY EXPLAINING HOW TO COLLECT FIRST AND LAST NAMEEE. Fuck.

The controls library would be extensible of course. You would be able to download different, more specialized controls if you need them. But the goal would be to satsify those needs with the standard collection of controls (Including interesting ones line barcode scanner and signature input and all that). But if all else fails, maybe someone made an open source control for you to implement and ignore that stupid donation button. We all do.

This could PURGE the world of overpriced and junky specialized business software, and best of all, it's aimed at smaller businesses. With smaller businesses making more profit, they will stay afloat better and may start to compete with their larger foes. Greater for the entire economy.

Anyways, I'm sure it's full of holes. Everything always is. But I still think it's something I'll try before I die.

I wrote a stored procedure and declared the input as varchar instead of varchar(100). everything seemed to be working. later on we noticed that the procedure only saved the first character of the input (a user form). unfortunately we found out first when the monthly form reports where issued. a whole month of incomplete forms from our users. the client wasn't happy.

Can somebody explain to me why developers (especially web) have to micromanage every single thing into it's own f*ing component.

Story time: I have an input form with some tabs. I discovered that the UI Library (Devextreme) has a nice little component that handles forms, (including tabs, groups, etc.). So I make a page, configure tabs, inputs and whatnot.

Now, I already knew that my coworkers can't handle html that is bigger than a page. So instead of putting the configs in the frontend, I made nice files where I store those, to keep them nicely clean and seperated.

Me feeling very good, went off to have a nice lunch break.

I come back read the message from my coworker, asking me to make every tab it's own component and form and load them into a separate Tab-Component, instead of using the built in configuration

......

WHAT?

Like seriously. I have a f*ing library that handles that, why the f*ck do I need to reinvent the wheel here!?

Supposedly it's to make it more maintainable, easier to find bugs, flatten the hierarchy.

Here's a little wake up call you morons: Nesting hundreds of components into each other does *not* help you with that.
It just creates a rabbit-hole of confusing containers that you have to navigate and dissect every time you try to find something.

"Can I fix the bug in the detail Page? Sure I'll tell you tomorrow when I find out which fucking component the bug results from".

Components are there to be *reused*. It's using inheritance for reusing code all over again, but worse.

But maybe I'm just old fashioned, and conservative. Maybe I'm just a really bad software engineer, because nowadays everything seems to result in architectures spreading hundreds of folders, thousands of files with nothing but arbitrary cut-offs with no real benefit, that I don't see the value in.

HOW to document business logic in code?

background:

I'm a frontend dev for admin system of our company. Often times I code things like: if user choose this product type and that settings then I show some other input field to input. I deal with mostly forms and show/hide UI for user. And after some time nor did user/PM/test or myself remember the logic of what should show or why something do not show.

So I want something to be able to let me write code and business logic along the way.(I'm not asking for API docs or function docs like JSDoc)

Great Thanks

Related topics:

And In terms of this, I would also like to build something to centralize PM's business DOC with developers API/dev Doc and also things like how to test for our test team and etc... basically a unified place to document everything, I think scenarios like these inside companies should exists so I would like to know how other company do this.

A lot of our web forms are done with AngularJS and combined with jQuery it does everything I need to satify the needs of people who are most impressed CSS transitions and have no technical knowledge whatsoever. I have no peers to ask this question.

I'm the only person deciding on what JS libs to use at the company... and since AngularJS goes into maintenance mode... what would you guys suggest to handle form input and add/remove CSS classes to HTML elements?

Should I get on the VUE bandwagon this year?

Uh, oh. Helping finish a project heavy on forms. Notice that everything is straight up jQuery to pull and push every single individual input value. Not a form tag in sight. But there are tables. Tables are everywhere.