Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "new findings"
-
Things have been a little too quiet on my side here, so its time for an exciting new series:
practiseSafeHex's new life as a manager.
Episode 1: Dealing with the new backend team
It's great to be back folks. Since our last series where we delved into the mind numbing idiocy of former colleagues, a lot has changed. I've moved to a new company and taken a step up as a Dev manager / Tech lead. Now I know what you are all thinking, sounds more dull and boring right? Well it wouldn't be a practiseSafeHex series if we weren't ...
<audience-shouting>
DEALING! ... WITH! ... IDIOTS!
</audience-shouting>
Bingo! so lets jump right in and kick us off with a good one.
So for the past few months i've been on an on-boarding / fact finding / figuring out this shit-storm, mission to understand more about what it is i'm suppose to do and how to do it. Last week, as part of this, I had the esteemed pleasure of meeting face to face with the remote backend team i've been working with. Lets rattle off a few facts to catch us all up:
- 8 hour time difference to me
- No documentation other than a non-maintained swagger doc
- Swagger is reporting errors and several of the input models are just `Type: String`
- The one model that seems accurate, has every property listed as optional, including what must be the primary key
- Properties go missing and get removed at the drop of a hat and we are never told.
- First email I sent them took 27 days to reply, my response to that hasn't been answered so far 31 days later (new record! way to go team, I knew we could do it!!!)
- I deal directly with 2 of them, the manager and the tech lead. Based on how things have gone so far, i've nick named them:
1) Ass
2) Hole
So lets look at some example of their work:
- I was trying to test the new backend, I saw no data in QA. They said it wouldn't show up until mid day their time, which is middle of the night for us. I said we need data in our timezone and I was told: a) "You don't understand how big this system is" (which is their new catch phrase) b) "Your timezone is not my concern"
- The whole org started testing 2 days later. The next day a member from each team was on a call and I was asked to give an update of how the testing was going on the mobile side. I said I was completely blocked because I can't get test data. Backend were asked to respond. They acknowledged they were aware, but that mobile don't understand how big the system is, and that the mobile team need to come up with ideas for the backend team, as to how mobile can test it. I said we can't do anything without test data, they said ... can you guess what? ... correct "you don't understand how big the system is"
- We eventually got something going and I noticed that only 1 of the 5 API changes due on their side was done. Opened tickets. 2 days later asked them for progress and was told that "new findings" always go to the bottom of the backlog, and they are busy with other things. I said these were suppose to be done days ago. They said you can't give us 2 days notice and expect everything done. I said the original ticket was opened a month a go *sends link* ......... *long silence* ...... "ok, but you don't understand how big the system is, this is a lot of work"
- We were on a call. Product was asking the backend manager (aka "Ass") a question about a slight upgrade to the new feature. While trying to talk, the tech lead (aka "Hole") kept cutting everyone off by saying loudly "but thats not in scope". The question was "is this possible in the future" and "how long would it take", coming from management and product development. Hole just kept saying "its not in scope", until he was told to be quiet by several people.
- An API was sending down JSON with a string containing a message for the user with 2 bits of data inside it. We asked for one of those pieces to also come down as a property as the string can change and we needed it client side. We got that. A few days later we found an edge case and asked for the second piece of data to be a property too. Now keep in mind, they clearly already have access to them in order to make the string. We were told "If you keep requesting changes like this, you are going to delay the release of the backend by up to 2 weeks"
Yes folks, there you have it, the most minuscule JSON modifications, can delay your release by up to 2 weeks ........ maybe I should just tell product, that they don't understand how big the app is, and claim we can't build it on our side? Seems to work for them
Thats all the time we have for today,
Tune in for more, where we'll be looking into such topics as:
- If god himself was an iOS developer ... not
- Why automate when you can spend all day doing it by hand
- Its more time-efficient to just give everything a story point of 5
- Why waste time replying to emails ... when you can do nothing instead
See you all next week,
practiseSafeHex13 -
Hey, Root? How do you test your slow query ticket, again? I didn't bother reading the giant green "Testing notes:" box on the ticket. Yeah, could you explain it while I don't bother to listen and talk over you? Thanks.
And later:
Hey Root. I'm the DBA. Could you explain exactly what you're doing in this ticket, because i can't understand it. What are these new columns? Where is the new query? What are you doing? And why? Oh, the ticket? Yeah, I didn't bother to read it. There was too much text filled with things like implementation details, query optimization findings, overall benchmarking results, the purpose of the new columns, and i just couldn't care enough to read any of that. Yeah, I also don't know how to find the query it's running now. Yep, have complete access to the console and DB and query log. Still can't figure it out.
And later:
Hey Root. We pulled your urgent fix ticket from the release. You know, the one that SysOps and Data and even execs have been demanding? The one you finished three months ago? Yep, the problem is still taking down production every week or so, but we just can't verify that your fix is good enough. Even though the changes are pretty minimal, you've said it's 8x faster, and provided benchmark findings, we just ... don't know how to get the query it's running out of the code. or how check the query logs to find it. So. we just don't know if it's good enough.
Also, we goofed up when deploying and the testing database is gone, so now we can't test it since there are no records. Nevermind that you provided snippets to remedy exactly scenario in the ticket description you wrote three months ago.
And later:
Hey Root: Why did you take so long on this ticket? It has sat for so long now that someone else filed a ticket for it, with investigation findings. You know it's bringing down production, and it's kind of urgent. Maybe you should have prioritized it more, or written up better notes. You really need to communicate better. This is why we can't trust you to get things out.
*twitchy smile*rant useless people you suck because we are incompetent what's a query log? it's all your fault this is super urgent let's defer it ticket notes too long; didn't read21 -
Dev: Hey that internal audit you asked me to perform didn’t go so well
Manager: It has too! I’ll get in a lot of trouble if it doesn’t pass.
Dev: Ok well it’s a lot of work to get it to a passing state, we have to dedicate a lot of resources to fix all these findings.
Manager: We don’t have any spare resources, they are all working on new projects! Why did you have to find things??
Dev: ….It’s a lot of hard to miss stuff, like missing signatures on security clearance forms
Manager: Ok can’t you just say that everything is all good? They’ll probably not double check.
Dev: I’m not really comfortable with that…Look all of these findings are all just from one member of the team consistently not doing their job, can’t you just address that with him and I can make a note on the audit that issues were found but corrective action was made? That’s the whole point of audits.
Manager: You don’t get it, if anything is found on the audit I’ll look bad. We have to cover this up. Plus that’s a really good friend of mine! I can’t do that to him. Ok you know what? You are obviously not the right person for this task, I’ll get someone else to do it. Go back to your regular work, I’m never assigning you audits again.8 -
"Pre-Installed Malware Found On 5 Million Popular Android Phones"
"added somewhere along the supply chain"
See below how to check if it's installed
Sources:
- (new) https://thehackernews.com/2018/03/...
- (new) https://research.checkpoint.com/rot...
- (old relevant news) https://thehackernews.com/2017/03/...
---
"Rottensys" a malware which covers devices from: Honor, Huawei, Xiaomi, OPPO, Vivo, Samsung and GIONEE
---
"According to our findings, the RottenSys malware began propagating in September 2016. By March 12, 2018, 4,964,460 devices were infected by RottenSys," researchers said.
"At this moment, the massive malware campaign pushes an adware component to all infected devices that aggressively displays advertisements on the device’s home screen, as pop-up windows or full-screen ads to generate fraudulent ad-revenues."
---
If you have one of the affected devices, here's how I checked mine:
1. Install ADB (Windows: https://forum.xda-developers.com/sh...)
2. Connect your device in USB-debugging mode
3. execute "adb shell 'pm list packages -f' > output.txt" (On windows navigate to C:\adb and replace "adb" with ".\adb.exe")
4. open the now created output.txt
5. search for any of those:
com.android.yellowcalendarz (每日黄历)
com.changmi.launcher (畅米桌面)
com.android.services.securewifi (系统WIFI服务)
com.system.service.zdsgt19 -
Ticket: Add <feature> to <thing>. It works in <other things> so just copy it over. Easy.
Thing: tangled, over-complicated mess.
Feature: tangled and broken, and winds much too deep to refactor. Gets an almost-right answer by doing lots of things that shouldn't work but somehow manage to.
I write a quick patch that avoids the decent into madness and duplicates the broken behavior in a simple way for consistency and ease of fixing later. I inform my boss of my findings and push the code.
He gets angry and mildly chews me out for it. During the code review, he calls my patch naive, and says the original feature is obviously not broken or convoluted. During the course of proving me wrong, he has trouble following it, and eventually finds out that it really is broken -- and refuses to admit i was right about any of it. I'm still in trouble for taking too long, doing it naively, and not doing it correctly.
He schedules a meeting with product to see if we should do it correctly. He tells product to say no. Product says no. He then tells me to duplicate the broken behavior. ... which I already did.
At this point I'm in trouble for:
1) Taking too long copying a simple feature over.
2) Showing said feature is not simple, but convoluted and broken.
3) Reimplementing the broken feature in a simpler way.
4) Not making my new implementation correct despite it not working anywhere else, and despite how that would be inconsistent.
Did everything right, still in the wrong.
Also, they decided I'm not allowed to fix the original, that it should stay broken, and that I should make sure it's broken here, too.
You just have to admire the sound reasoning and mutual respect on display. Best in class.19 -
About 2 years ago, our management decided to "try outsourcing". I was in charge for coordinating dev tasks and ensuring code quality. So management came up with 3 potential candidates in India and I had to assess them based on Skype calls and little test tasks. Their CVs looked great and have been full of "I'm a fancy experienced senior developer." ....After first 2 calls I already dismissed two candidates because they had obviously zero experience and the CV must have been fake. ..After talking to the third candidate, I again got sceptical. The management, however, started to think that I'm just an ass trying to protect my own position against outside devs. They forced me to give him a chance by testing him with a small dev task. The task included the following statement
"Search on the filesystem recursively, for folders named 'container'. For example '/some_root_folder/path_segments/container' " The term 'container' was additionally highlighted in red!
We also gave him access to a git repo to do at least daily push. My intention was to look at his progressions, not only the result.
I tried the task on my own and it took me two days, just to have a baseline for comparison. I, however, told him to take as much time as he needs. (We wanted to be fair and also payed him.)
..... 3 weeks went by. 3 weeks full of excuses why he isn't able to use git. All my attempts to help him, just made clear that he has never seen or heard of git before. ...... He sent me his code once a week as zip per email -.- ..... I ignored those mails because I made already my decision not wanting to waste my time. I mean come on?! Is this a joke? But since management wanted me to give him a chance .... I kept waiting for his "final" code version.
In week 5, he finally told me that it's finished and all requirements have been met. So I tried to run his code without looking at it ..... and suprise ... It immediately crashed.
Then I started to look through the code .... and I was ..... mind-blown. But not in a good way. .....
The following is what I remember most:
Do you remember the requirement from above? .... His code implementing it looked something like this:
Go through all folders in root path and return folders where folderName == "/some_root_folder/path_segments/container".
(╯°□°)╯︵ ┻━┻
Alone this little peace of code was on sooooooo many levels wrong!!!!! Let me name a few.
- It's just sooooo wrong :(
- He literally compared the folderName with the string "/some_root_folder/path_segments/container"...... Wtf?!?
- He did not understand the requirement at all.
- He implemented something without thinking a microsecond about it.
- No recursive traversal
- It was Java. And he used == instead of equals().
- He compares a folderName with a whole path?!? Wtf.
- How the hell did he made this code return actual results on his computer?!?
Ok ...now it was time to confront management with my findings and give feedback to the developer. ..... They believed me but asked me to keep it civilized and give him constructive feedback. ...... So I skyped him and told him that this code doesn't meet the requirements. ......... He instantly defended himself . He told me that I he did 'exactly what was written in the requirements document" and that there is nothing wrong. .......He had no understanding at all that the code also needs to have an actual business purpose.
(╯°□°)╯︵ ┻━┻
After that he tried to sell us a few more weeks of development work to implement our "new changed requirements" ......
(╯°□°)╯︵ ┻━┻
Footnote: I know a lot of great Indian Devs. ..... But this is definitely not one of them. -.-
tl;dr
Management wants to outsource to India and gets scammed.9 -
Me: We have a new research project for you. We need you to test these 2 new services, see how they will fit into the new application, look at alternatives if necessary etc. At the end we need you to write a report with your findings, showing how you would integrate them to achieve X, Y and Z, and how much it would cost each month.
Dev: sounds good, I'll come back to you when I have it.
*2 and a half weeks later*
Document paragraph 1: The new language translation service doesn't support the languages we need.
Document paragraph 2: Here's my proposal for integrating the new language translation service.
*review*
Me: So I had a look at the doc and it says it doesn't support the languages.
Dev: yeah unfortunately not.
Me: Ok, so when you discovered that, why didn't you look for an alternative? Or come back to me and say it's not going to work.
Dev: I dunno, I thought you'd want to see the rest of the research first.
Me: ... not if we know for 100% undeniable fact that it will never function.
Dev: Ah ok, I didn't think of that. I'll do that next time, don't worry.
... aw how sweet, he thinks there will be a next time. Poor guy.2 -
A manager who asked me to research and produce documentation on findings on a new system upgrade we could apply. Report on the risks, the amount of resource and time that would be needed etc. And the benefits of upgrading. Then after recieving the documentation and taking 1 month to read it, refused to make any form of decision without asking managers 2 levels above them who respond with "It is your decision". Then deciding it's best not to upgrade at this time. Okay, no probs.
6. Months. Later. That thing I said I didn't want you to do? I want you to do it now, could you get that done by the end of the week seeing as you have done the research already? Oh yeah and I will be off for the next two weeks as I am off on a ski holiday, so good luck with that. -
I really hate sales people. My stakeholder wants to buy an address verification service but is hesitant to purchase now because the dev time needed would be substantial. Now the sales rep has planted seeds of doubt in my SH and SH thinks I grossly overestimated the labor I quoted.
Sales rep is all “major corporations have installed this in a weekend.” 🤬🤬🤬 Major corporations also have more than one developer and probably aren’t dealing with a website that has a dozen address forms that all work differently. Oh, and I DON’T WORK WEEKENDS MOFO.
My SH originally requested a labor estimate for installing the AVS on all address forms and that’s what I delivered. My audit revealed a dozen different forms. I’m working with a legacy code base that’s been bandaged together and maintained by an outside dev agency. The only thing the forms have in common is reusable address fields. They all work differently when it comes to validating and submitting data to the server and they all submit to different api endpoints. At least a quarter of those forms are broken and would need to be fixed (these are mostly admin-facing). I also had to provide an estimate on frontend implementation when I have no idea what they want the FE to look like.
My estimate was 5-8 weeks for implementation AND testing. I wrote up my findings and clearly explained the labor required, why it was needed, and the time needed. All was fine until the sales rep tried to get into SH’s head.
My SH is now asking for a new estimate and hoping for 1-2 weeks of labor, which is what will SH to buy the AVS. Then go to the outside dev agency you used to work with and ask for a second opinion. I’m sure they’d also tell you at least month if not more for testing, implementation, and deployment because you have a DOZEN FORMS you want to add this to. 1-2 weeks is only possible for a single form.
My manager doesn’t work in the same coding language I do, but he read my documentation and supports my original estimate.
I honestly want to ask my SH if this sales rep is giving a very good price for the AVS. If not, are there other companies in the mix? Because right now you have a sales rep that’s taking you for a ride and trying to pressure you all so he can get another notch in his belt for getting another “major corporation” as his account. I don’t think it’s a good idea to be locked in with a grimy sales rep.3 -
I mentioned in a previous rant that one of my favorite games of all times (CrossCode) was written in HTML5 and Javascript. I have been playing the game again (this time on the ps5) and continue to be surprised at the monumental force of the game. So, I decided to take a look at the "original" game engine in which the game is built. ImpactJS. So, apparently (and I have not looked at the inner workings of the code) the creator had a module system in which files could be imported before module imports was a thing in Javascript, not only that but it had a class system mimic in place to deal with things, with inheritance and everything in between. Fucking fascinating. Now, one can actually see the dev logs of a new project that Radical Fish is working on, their primary target remains, but now they seem to be using TypeScript with a plethora of other things in order to build the game, they essentially took the game engine and re-modified the fuck out of it to come with something different. And it fucking worked, beautifully.
From my other findings, it seems that they had to jump through some hoops to get the games to run on consoles, specially the Nintendo Switch which we all know it is a bitch to port into, but apparently the underlying tech is built on Haxe using something known as Kha, a portable multimedia lib.
This is interesting to me as someone that always admired game development, and I sometimes wonder if they would just be better served using something like C# as a target platform with something that they could mold up from the ground up like MonoGame.
I am probably not going to work tomorrow in order to stay in playing the game all day lmao.
Game devs are amazing really. And this game is a jewel, try out the demo online if you have not yet and see what you think:
http://www.cross-code.com/en/home3 -
I was asked to make proof of concept small frontend app with some simplified requirements, they asked me because it should be written in the stack I done most of my career work with. I do it in 3 days instead of 5, using those 2 days to optimise the app and explore different approaches. I noted down my findings, what to avoid and reasons and also what is good to use and reasons and shared with everyone.
We waited for the project to start, I started working on another project in the meantime and there was a big rush to make project go live etc., so I was consumed 100% on that new project.
So they put in charge backend php developer to do frontend js work. I said ok, do you need help in starting out? Nah, my proof of concept repo is enough.
4 days before that small project goes live they asked me to do code review. All things I noted down to avoid are in the codebase, few bad practices but everything is over-engineered (in a very bad way), some parts should be more flexible as current setup is very rigid, having almost all kinds of CSS, I saw SASS, CSS variables, 2 different CSS-in-JS tools with some additional libraries that is used to toggle classes.
I don't know how to approach this as I am not asshole as a person and I don't want to say to my colleague that his codebase is completely trash, but it is.
The worst parts: They called me to help finish the app and budget is almost spent!
I would rewrite the whole app as the state of the current app is unusable and everything is glued with bad Chinese ducktape that barely holds.
Additional points because it won't bundle as everything is f**ked.
I am seriously thinking of duplicating master branch and refactor the whole fricking app but won't do that as I am burning midnight oil on other two projects. Don't worry overtimes are paid.
I hate those shitty situations, this project was supposed to be tiny, sweet and example of decent project in this company but it is instead big fat franken-app that will be example how smart it is to avoid putting backend dev to do frontend work (I also agree for vice versa)! -
I'm in a team of 3 in a small to medium sized company (over 50 engineers). We all work as full stack engineers.. but I think the definition of full stack here is getting super bloated. Let me give u an example. My team hold a few production apps, and we just launched a new one. The whole team (the 3 of us) are fully responsible on it from planning, design, database model, api, frontend (a react page spa), an extra client. Ok, so all this seems normal to a full stack dev.
Now, we also handle provisioning infra in aws using terraform, doing deployments, building a CI/CD pipeline using jenkins, monitoring, writing tests, building an analytics dashboard.
Recently our tech writer also left, so now we are also handling writing feature releases.
Few days ago, we also had a meeting where they sort of discussed that the maintenance of the engineering shared services, e.g. jenkins servers, (and about 2-3 other services) will now be split between teams in a shared board, previously this was handled only be team leads, but now they want to delegate it down.
And ofcourse not to mention supporting the app itself and updating bug tickets with findings.
I feel like my daily responsiblities are becoming the job responsibilities of at least 3 jobs.
Is this what full stack engineering looks like in your company? Do u handle everything from app design, building, cloud, ops, analytics etc..7 -
With Atom being discontinued I guess I have to start looking for a new IDE.
Visual Studio Code seems to be #1 choice.
I don't get why.
1. Search
It pops up in the small side bar. Can't see which of the findings I am actually interested in.
2. Open file in Solution Explorer
Found the shortcut to open SE after my failed search. Trying to navigate files with keyboard. Enter does not open the file. Neither does CMD+Enter, Option+Enter or Shift+Enter, but CTRL+Enter does! In a new tab which only covers *half* of the window! Wtf.11 -
1. Cool side projects
2. Learning new things and revisiting old concepts and tricky findings in my notes
3. Remembering all the times that I absolutely crushed it
4. Helping new developers and engineers who are not that well rounded but really curious about building things. you never look good trying to make someone else look bad so always try to help others. it’s fucking annoying sometimes though.
5. Posting shit on devRant and seeking validation -
Today I finally finished editing the video for my new song. I have been working on the song itself, recording hundreds of takes of instruments and vocals, for almost four weeks now.
Editing the video took about 3 days, partly because I am using Hitfilm 4 Express for the first time. It's definitely a huge step up from Windows Movie Maker, but I did hit one mindboggling snag which delayed me for more than an hour.
When the editing was done and I exported the finished video, I play it, only to discover that the first second or so of audio is missing. That's kind of important for a music video.
So I try all kinds of things. Reimporting the audio into the project in different resolutions, trying different rendering settings, deleting or adding audio tracks, you name it. And each time the finished video is missing that first second of audio.
And each render takes about 10 minutes to complete, which is a long time to wait for one second of silence!
Out of desperation I start thinking about adding the audio to the video in Windows Movie Maker, just because I know that always works, even if that will degrade the quality.
But before I do that I try one more thing: I add a few seconds of silence at the beginning of the song in Audacity, then import into Hitfilm one more time.
And then it works!
I shall report my findings to Hitfilm shortly :-)4 -
The Use of Recycled Heart Devices
There are many controversial issues in the healthcare, and some of them seem so debatable that it is difficult to chose which side to support. One of such issues is the use of recycled heard devices – implantable cardioverter-defibrillators (ICDs) that were previously used by people who could afford them and changed them to a new model or died. These devices are still in good condition and have some battery life remaining. Scientists like Pavri, Hasan, Ghanbari, Feldman, Rivas, and others suggest that these ICDs can be reused by those patients who cannot pay for them.
The issue has caused many arguments. Federal regulators and ICDs manufacturers in the United States prohibit the practice of such a reuse; however, it is allowed in India, where very few people can afford defibrillators. The use of recycled ICDs can be regarded as inferior treatment to the poor. People who cannot pay for the expensive devices still deserve the healthcare of the highest quality as any wealthy person. For this reason, other means of providing healthcare to poor people should be found as it is unethical to make them feel humiliated or deprived of medical aid guaranteed to them by the Declaration of Human Rights. Harvard medical experts claim: flagship projects must remain free of the taint of the secondhand, in part by making it clear when devices can safely be reused.
These scientists also doubt the safety of ICDs reuse. Despite the fact that all devices are carefully transported and sterilized, there is still a danger of infection transmission. The experts, for instance, claimed that three people died because of stroke, heart failure, and myocardial infarction. Though it is not proved to be caused by recycled ICDs, there is no evidence about the relevance of the reused devices to these deaths. It can be presumed that the failure of the defibrillator did not prevent the problem. In general, their findings prove that the alternative reuse of ICDs is a comparatively riskless life-saving practice.
There is another side of the problem as well. It is obvious that human life is sacred; it is given to one person only once, so it should be protected and preserved by all means (humanlike, of course) possible. If there cannot be another way out found, secondhand ICDs should be applied to patients who cannot pay for their treatment. If the world is not able to supply underprivileged patients with free devices, richer countries can, at least, share what they do not need anymore. One may draw a parallel between recycled defibrillators and secondhand clothes. There is nothing shameful about wearing things that were used by another person. Many organizations supply children in poor countries with garments in a good condition that richer people do not wear anymore. For the same reason, reused defibrillators in a proper state can be implanted to those patients who cannot afford new devices and will not be able to survive without them. Underprivileged patients in some developing countries receive alternative treatment of drug therapy, which, in this case, can be regarded as inferior method. Apparently, if to consider the situation from this viewpoint, recycled heart devices should be used as they allow saving people’s lives.
The use of recycled implantable cardioverter-defibrillators is illegal and risky as they are classified as single-use devices. Moreover, despite the fact that the results of researches on the topic proved to be positive, there were cases when some people with recycled ICDs died because of stroke, heart failure, or myocardial infarction. It is unethical to break the law, but at the same time, person’s life is more important. If there is no other possibility to save a person, this method must be applied.
The article was prepared by the qualified qriter Betty Bilton from https://papers-land.com/3