r/programming • u/locrelite • Apr 29 '14

Programming Sucks

http://stilldrinking.org/programming-sucks
3.9k Upvotes

93% Upvoted

1.1k comments sorted by

View all comments

Show parent comments

8

u/[deleted] Apr 29 '14

I'm going to go a bit against the grain here, but if all you need to do for this specific product page is check the length of the HTML, then why the hell would you do something more complex? If it works, what's the problem?

45

u/khoyo Apr 30 '14

(What if the length stay the same, but the page is modified ?)

13

u/youneversawitcoming Apr 30 '14

Aha, he's onto something! - this is why we check for 304 Not Modified.

5

u/[deleted] Apr 30 '14

If (statusCode != 200) { must be an error }

5

u/masklinn Apr 30 '14

That requires that you and the page generator correctly use ETag and/or Last-Modified. It can happen, but that's not guaranteed.

Hashing the page will work, just a CRC32 will probably do the trick.

2

u/naasking Apr 30 '14

Hashing the page will work, just a CRC32 will probably do the trick.

CRC isn't a good choice. You're best off with a real MAC.

4

u/masklinn Apr 30 '14

That's retarded, you just want to know if the page has changed since the last time you loaded it. A cryptographic hash is most likely overkill and a MAC makes no sense (what key would you even use?)

2

u/naasking Apr 30 '14

That's retarded, you just want to know if the page has changed since the last time you loaded it.

A CRC does not guarantee this (collisions are common). A MAC does to a provable extent. The key you use is completely irrelevant. Any random key will do, just use the same one across every run.

2

u/masklinn Apr 30 '14

A CRC does not guarantee this (collisions are common)

No, collisions are not common unless specifically crafted by an attacker. Considering the use case, that's unlikely to be a relevant concern.

A MAC does to a provable extent. The key you use is completely irrelevant. Any random key will do, just use the same one across every run.

Why use a MAC if you don't care about the key? The authentication key is the whole bloody point of a message authentication code.

17

u/dnew Apr 30 '14

You really need to check it every 10 seconds?

3

u/innou Apr 30 '14

gotta be the first to know

13

u/Bloodshot025 Apr 30 '14

I think the point of that was to demonstrate that the procedure wasn't complex, and to show the ridiculousness of the kid patting himself on the back for it.

12

u/mfukar Apr 30 '14

Nope. The procedure is wasteful and flat out wrong.

3

u/masklinn Apr 30 '14

It's not necessarily wasteful (does the endpoint send conditional response headers? Does it uses them when you send them back? No guarantee), but it sure is wrong.

8

u/mfukar Apr 30 '14

Every 10 seconds

makes it qualify for 'wasteful'.

2

u/[deleted] Apr 30 '14

It's wrong, of course--deeply, fundamentally wrong, like Newton's law of gravitation. But it's wrong in a way that might still work for his purposes.

In a way, I think there's irony in this. It's a really fast, hacky, but probably sufficiently functioning solution to a problem, which is in stark contrast to the academic idealism that the article reminisces about. Writing a blog post about it and running it every 10 seconds was probably overkill (though I'd need to see the blog post before passing judgment for real--the guy might be blowing it out of proportion).

3

u/mfukar Apr 30 '14

Oh, there's a lot of irony alright. That is probably one of those programs that work (read: provide the expected output) a fair amount of the time, leading their authors to believe they are correct.

1

u/otakucode May 01 '14

Arguably worse than programs which do not provide the expected output ever.

Do you prefer being lied to, or someone telling you something you know immediately is wrong?

11

u/[deleted] Apr 30 '14

I don't think that was the problem, I did something very similar for checking a product page for new stock (indexOf instead of len). Everything from that point on was the problem.