How a routine gem update ended up creating $73k worth of subscriptions
On November 5, 2021 (a Friday of course), we've deployed innocent-looking gem updates. Minor versions of Ruby on Rails, Ruby Sentry client, Ruby Slack client, http libraries, Puma, Devise, OmniAuth Ruby client, Mongoid, and a few test gems. However, something went very wrong. We saw odd Stripe error...
Hasnain says:
The downside of SemVer and always updating dependencies immediately. And on the importance of tests.
(this totally should have been a breaking change called out far and wide).
"Even if that Mongoid shouldn't have changed existing methods behaviors between minor versions, my implementation was a true code smell as it was unclear what it did. This code should never have been deployed to production. But also and more importantly, the feature itself was a bad idea. Using our API to scrape search engine results shouldn't trigger a renewal of a credit card subscription in the first place. And we'll be removing that feature as soon as possible."
Posted on 2022-01-17T20:30:42+0000
T-Shaped People and Academia
T-Shaped People and Academia Tags: academia, musings Published on Saturday, January 8, 2022 « Previous post: Things You Are Allowed To Do, Academic … Being on the lookout for recruiting new students for my new research group, I wanted to distil some of my observations into textual form. This post...
Hasnain says:
This was an interesting read. While I don't fully agree with the conclusion and some of the details, I do agree with the central point - teams need people with a wide variety of skills and backgrounds.
"This post spawned a lively discussion on HackerNews. One interesting facet that escaped me so far is the extent to which certain research groups are exploiting Ph.D. students for tasks that should rightfully be handled by a person specifically trained for the job. That’s something I can wholeheartedly advocate for—I think most labs benefit immensely from an on-call sysadmin, developer, etc. The point I am making in this article is that, at least in ML research, it is hard to pin down what ‘doing only research’ means. If we only measure the value of a budding Ph.D. student by the number of papers on their CV, we miss out on candidates that can introduce better coding practices into a lab, for instance. Of course, they should not be hired primarily because of this, but why not recognise and reward skills that are clearly there and relevant for doing research and facilitating the research of others?"
Posted on 2022-01-17T20:29:32+0000
Outcomes, Mistakes, and the Nuance of Error Handling
Outcomes, Mistakes, and the Nuance of Error Handling January 16, 2022 11 minutes After my last post, I decided it was time to finish up several projects, no matter how experimental, and roll a proper release for them. One such project I’m finally wrapping up development of, is a Rust library. It.....
Hasnain says:
Really great read on some of the trade offs that come with various error handling approaches. The examples and libraries discussed are Rust specific but the lessons generalize well.
“I would argue that, in most languages even outside of Rust, a majority of our time is spent logging an error and simply returning to a given caller. In reality, a warning or some retry operation is meritted; the nuance of what really is an error is something that needs to be taken into consideration when designing these critical paths that must handle mistakes and failures.”
Posted on 2022-01-17T08:00:34+0000
Opinion | To Fight Covid, We Need to Think Less Like Doctors
Leaders are too focused on risks to individuals versus the population as a whole.
Hasnain says:
I am not a doctor nor a public health official so my opinion doesn’t count as much as others’ - but this resonated a lot with me.
“Masks are another example. If you can have only the best, you’ll focus on N95 masks, see they are in short supply at the start of the crisis and tell most people they shouldn’t wear masks at all because only certain ones provide the best protection, and we have to save them for those at highest risk. A population-level view argues that cloth or surgical masks — which aren’t anywhere near as good as N95s but were easier to get — would lower the risk for everyone when the pandemic was beginning, and therefore would be helpful. It took until April 2020 — many weeks into the pandemic — for the C.D.C. to recommend mask wearing for the general public.”
Posted on 2022-01-16T06:11:08+0000
Opinion | I’m a Longtime Union Organizer. But I Had Never Seen Anything Like This.
After a spate of deaths, a group of health care workers in Oregon decided that to save lives, they needed a union.
Hasnain says:
This quote stuck with me. A very moving human interest story about healthcare workers fighting to have their patients be treated better.
“Time is a white-collar weapon. People with resources can easily outwait people with none. The longer it takes to get to an election, the less chance workers have of winning their union.”
Posted on 2022-01-16T05:31:54+0000
Live updates: Hostage situation at synagogue in Colleyville, Texas
The FBI and Texas Department of Public Safety are assisting a hostage situation at the Congregation Beth Israel in Colleyville, Texas, according to police.
Hasnain says:
I’m glad the hostages are free and safe. Anti semitism is not okay in any form - and taking things to violent extremes like this is always despicable.
Posted on 2022-01-16T05:00:12+0000
The Biden administration has failed its Covid test
When Omicron emerged, the White House missed chance after chance to limit infections – despite claiming to ‘follow the science’
Hasnain says:
“And why is the administration still pushing reimbursement schemes for the insured and complicated ways to get tested rather than mailing tests home for free and giving them away wherever anyone will take them? Why are Biden and Harris both telling people to Google where to get tested, when 18% of people below the federal poverty line – those most at risk for Covid – don’t have internet access?”
Posted on 2022-01-15T19:44:48+0000
How we used C++20 to eliminate an entire class of runtime bugs - C++ Team Blog
C++20 is here and has been supported in MSVC since 16.11, but today’s post is not about how you can use it, but rather how we used it to effectively eliminate an entire class of runtime bugs by hoisting a check into compile-time.
Hasnain says:
This is a cool c++20 trick.
“In total we identified ~120 instances where we were either passing the incorrect number of arguments to a diagnostic API or where we passed the wrong type for a particular format-specifier. Over the years we have received bugs regarding strange compiler behavior when emitting a diagnostic or a straight-up ICE (Internal Compiler Error) because the format-specifiers were looking for arguments which were incorrect or did not exist. Using C++20 we have largely eliminated possibility of such bugs happening in the future and while offering the ability for us to safely refactor diagnostic messages, made possible by one little keyword: consteval.”
Posted on 2022-01-15T06:06:32+0000
Jan. 6 committee subpoenas tech giants after 'inadequate responses'
The subpoenas demand that Facebook, Google, Reddit and Twitter turn over more information about what they did and didn't do in the lead-up to Jan. 6.
Hasnain says:
The Jan 6 committee made a lot of progress yesterday and it looks like they're going to continue going. I like this.
"The House committee investigating the Jan. 6 riot at the U.S. Capitol subpoenaed Reddit, Twitter and the parent companies of Google and Facebook on Thursday after their "inadequate responses" to requests for information about what they did and didn't do in the lead-up to the deadly attack."
Posted on 2022-01-14T19:07:21+0000
Disturbing New Report Shows Dire Conditions For Grocery Workers
A huge new survey of Kroger employees finds homelessness, poverty, and food insecurity are widespread.
Hasnain says:
These are horrifying stats. I hope the unionization efforts go through.
“- Fourteen percent of Kroger workers are now homeless, or have been within the past year. More than one-third say they fear being evicted. Even among full time employees, 15% say that they cannot pay their next rent or mortgage bill.
- Despite working around food all day, one-quarter of Kroger workers say that they went hungry in the past year because they could not afford food. Fourteen percent say they receive food stamps. Kroger offers employees only a 10% discount on food at the store.”
Posted on 2022-01-13T20:39:59+0000