The Daily WTF

The Hot Fix

Ellis Morning — Tue, 30 Jun 2026 06:30:00 GMT

Everybody has a nemesis. A dark mirror of yourself, a challenge that is everything you hate. If you've ever worked tech-support, you know what that is: printer issues.
I'm Anonymous, and you last saw me in the case of The Ghost Cursor. This is my story.

As the days marched on, the chill in the air turned from bracing to painful. God had hoofed it down to Florida for the winter, and this year, he'd stolen Hope away with him. Between leaden skies and dirty slush, gale-force winds sent snow tearing down city streets to sandblast one and all into their constituent atoms.

In that timeless slog, one year ended and another began, barely noticed. The short days and bitter cold made my foot-and-bus commute almost unbearable. Only the promise of warmth and caffeine at the other end got me through. A cup of joe at my desk, then a glance at my caseload, something I approached with a weird mix of curiosity and dread.

That morning, a fresh ticket had just come my way: The new printer in HR keeps printing gibberish.

Another printer. Why was it always printers? I dialed up the source, a guy named Tony, and made my introductions. “What do you mean by 'gibberish?'”

“It'd be easier to show you in person,” Tony replied, his voice jittery. “Could you stop by my cube right away?”

“Sure thing.”

I hung up, tossed the last dregs of coffee down my throat, and stood from my chair. At the same moment, a slight silver-haired woman made tracks down the open passageway a few feet away from me. She clutched her laptop and a stack of folders to her chest, making a beeline toward who-knew-what.

My first pleasant surprise of the day. I couldn't help calling out to her. “Aggie! How's it goin'?”

When I'd first gotten my start in Tech Support, Agnes Shaw had been one of the department's top reps. She knew every system quirk, every trick to pull, every right thing to say to leave a smile on someone's face. I'd come up under her wing, sought her advice a million times.

And then they'd offered Aggie a promotion, with a fancy title and salary to boot. She'd taken it.

That was years ago, now. I wasn't her direct report, so I only caught glimpses of her now and then. It was a shame.

Aggie halted in her tracks, dazed and startled, before looking my way. A second later, she smiled. “Hello! Doing just fine, yourself?”

“Same as ever.” But my spirits had lifted. Knowing there was no time to waste, I darted over to conversational distance. “You're a hard one to get ahold of.”

She shrugged her shoulders with a wistful expression.

“Why don't we step out for a smoke?” It seemed like we both needed it. “When are you free?”

“Not today. Meetings all day.” Aggie glanced askance. “It's not appropriate for me to go out there, anyway. You need a place where you can vent freely.”

“Spoken like a true manager,” I scolded with a smirk. “Listen, we haven't caught up in ages. Could we step out for coffee sometime?”

A warm glow peeked through her distraction. “I'd like that! Find an open spot on my schedule and book it, OK? I gotta run!” With a look of apology, Aggie backed away and rushed down the passage flanked by cubicles and filing cabinets.

Aggie made these offers all the time. Then, just before the appointed hour, something always came up that required a rain check. Well, I didn't care. I darted back to my desk, woke up my sleeping machine, and pulled up the office calendar to request a meeting the next day, right when I usually needed a dose of caffeine to make it through an otherwise endless afternoon. It was on Aggie to confirm or reschedule.

Meanwhile, I had a date with HR.

Human Resources. Normally, those words gave me an instant case of the willies. Μost of the people there were the sort of drones who couldn't hack Accounting or Finance in business school. But Leila … Leila was different. I couldn't help thinking about her. Back when I'd fielded a support ticket up in C-Town, an issue caused by the very CEO who'd filed the ticket, Leila had helped me keep my head attached to my neck. It seemed like maybe, just maybe, she really did want to improve this sorry joint the way she claimed.

I entered the nearest stairwell and plodded down a couple flights of concrete steps. Within those narrow confines, I brought myself back to reality. Leila was one executive among dozens on the org-chart. She wouldn't have a blessed thing to do with a low-level case like this. I had to stay on my toes in HR, no matter what friends I thought I'd made.

I pushed open the stairwell door and entered a carpeted space lined with filing cabinets, supply closets, and office machines. Sharp florescent lighting revealed an older man in a tailored suit only a few feet away, frowning as he took a hair dryer to the insides of a large printer that'd seen better days and now begged for oblivion.

As the stairwell door swung shut behind me, I froze. No matter how many years you piled up in this joint, it never ran out of new things to throw at you. This had to be the printer I was there to fix—more like save from yet another abusive higher-up who'd require kid-glove handling.

First things first. I had no idea if I'd gotten there in time to save the printer, but damned if I wouldn't try. Like a lifeguard diving in after a drowning victim, I rushed over to the outlet where the hair dryer was plugged in. Adding to the insanity, it was the wrong sort of outlet for a hair dryer, which needed a GFCI to run safely. I ripped the plug from the outlet and threw it aside.

The roar of the dryer faded, leaving stunned silence in its wake.

Burning with righteous fire, I spun around to face the perp. The HR big-shot faced me, too, brandishing his hair dryer like a revolver. Wide-eyed passersby fringed the scene like extras in a B-Western.

Kicking anything or anyone when they were down was the sort of thing that stabbed through my armor of veteran cynicism, riling me up with righteous anger. But an outburst would only make things worse. For the good of all, I swallowed it, forcing a polite lie past gritted teeth. “Just wanted to make sure you could hear me, sir.”

Like hell.

“Tech Support,” I introduced myself. “This the printer that ain't working?”

Hothead's glaring frustration shifted away from his victim, toward me. “Yes, and I've had it! It must be moisture inside the machine.”

God, help me. Oh, right: Florida.

“Good thinking, sir,” I said. “But I'm less worried about moisture and more worried about melting sensitive electronics with all that heat.”

His eyes went wide, like the notion had never entered his brain.

Slowly, I knelt to pick up the hair dryer's plug. Unchallenged, I rose and started winding the power cord around my left hand, inching closer to him in the process. Once I was standing in front of him, I proffered the wire bundle.

“Hold onto that for me, sir, if you don't mind.” Phrasing things as favors made them go down smoother. Now to dig up a workaround that would get this guy out of everyone's hair. “Is there some other printer you can use for now?”

His open hand clamped over the wire as his expression soured. “Yes, but it's a pain to walk over there!”

“I understand, sir. It's something. Don't worry about this one. I'll take it from here.”

Hothead walked off without another word. The spell broke; the onlookers found places to be.

With relief and dread, I approached the printer, fearing I'd be performing last rites. But as I checked it over inside and out, I found an incredible lack of melted parts. When I plugged it in and started it up, everything loaded just fine. Using the printer's onboard interface, I performed every available test print. They all worked.

Snatched from Death's doorstep. “Hang in there,” I muttered, patting the machine's plastic case. “I'm doing everything I can.”

Like making sure Leila got an earful about this. Later.

Before leaving the scene, I had a good look high and low. Ceiling tile and carpet were clean. No leaks, no spills. Even the heated indoor air lacked enough water molecules to give Hothead or anyone else the idea that “excess moisture” might've been the problem. Time to chase down the ticket-holder and see if the problem was already resolved.

A couple of passersby pointed me toward a distant corner of HR, where I found a cube-desk buried under reports, folders, and other well-intentioned clutter. A man was sitting in an office chair facing the cube's entrance, squeezing a rubber stress ball.

“You Tony?” I entered the cube, offering my hand.

He stood, shook, then immediately returned to the reassurance of his toy. “Sorry. My boss is, uh, tough like that.”

“Hothead's your boss? Jesus. He almost single-handedly iced that printer. Well, maybe 'iced' ain't the word for it.” I folded my arms. “You know who's gonna hear about it? The new head of HR. When I close this ticket, I'll drop her a line about what happened.”

Tony's eyes went wide. “Really? Thank you! I know I'm supposed to go up the chain, but …” He edged closer, lowering his voice. “Sometimes it's the chain that's the problem, y'know?”

Something I'd run into only a million times. “I know. Can't do much about it most of the time, but I can here, so I will.”

Tony nodded. “Thanks again.”

“Don't mention it. Anyway, the printer. Your ticket said it was new? Looks pretty darn old to me.”

“It's new over here,” Tony explained. “They just it brought down and set it up for us.”

“Can you try printing now?” I asked. “Let's see what happens.”

Later that morning, I stopped by the usual smoke-break spot between office buildings. As wind and snow coursed through the alley, I recapped the morning's events for my friends Megan and Reynaldo. Then I pulled a stack of folded-up paper from my trench coat pocket, splitting it in half to hand them several pages apiece. At last, I dug through my pockets for my sorely-needed cigarettes and lighter. While I carefully shielded the lighter's flame from the wind to light the cigarette clenched in my teeth, they studied the printouts with looks that quickly turned baffled.

”I don't feel safe working with Cheryl?” Reynaldo read aloud.

”John keeps staring at me in the break room. I've told him twice.” Megan's eyes found mine. “What the hell? Every print request does this?”

“Every print job except for test prints,” I replied. “We're lucky the poor thing starts up at all after Hothead gave it the salon treatment.”

Megan smirked, handing back her pages before hugging herself against the cold. “Sounds to me like it might be a network issue.” She glanced Reynaldo's way for confirmation.

Our veteran network admin was too busy frowning at the stack of paper he rifled through to notice. “What have you tried?” he asked me.

I helped myself to a long, warming drag. “The printer already spent some time turned off and unplugged.” Hothead had seen to that. “Since it's old, figured I'd reinstall the drivers, clear the print queue. Didn't help.” I shrugged. “Megan's right. Since it doesn't happen with test prints, it seems like something fishy's happening when the print requests coming through the network.”

Reynaldo frowned in thoughtful silence for a while, then glanced between us. “Do you remember that system for submitting HR complaints anonymously through the intranet?”

Forcing my brain-pointer back into memory spaces I usually steered clear of, it came back to me a little, through a thick fog. “Few years back? Before your time,” I added for Megan's benefit. “Never paid it much mind. Never really believed those gripes would actually be anonymous.”

“Yeah, that's crazy!” Megan said. “Who would trust that?”

I hefted the printouts she'd returned to me, each page loaded with more beef than a Texas ranch. “That's who.”

“They retired that program ages ago,” Reynaldo said. “The server was decommissioned—at least, so I thought.” He dropped his cigarette butt to the slush-covered asphalt and crushed it underfoot, sighing heavily with a knowing look. “Let's go trace some IPs.”

“Swell!” I was about to grind my partially-smoked cigarette against the brick wall behind me to save it for later when I caught the hopeful look in Megan's eye.

“Can I help, too?” she asked.

What fool would say no?

“We may need a good developer at that,” I said. “C'mon!”

To be continued…

[Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

CodeSOD: Off the Path

Remy Porter — Mon, 29 Jun 2026 06:30:00 GMT

File path separators are a common pain point when writing cross platform software. Of course, not every programming language has a graceful API for handling that. For example, prior to C++ 17, you had to do some #ifdef preprocessor magic to handle that. Which people usually did (or they'd use the Boost suite of libraries).

Code like this wouldn't be out of place or incorrect:

#if defined(WIN32) || defined(_WIN32) 
#define PATH_SEPARATOR "\\" 
#else 
#define PATH_SEPARATOR "/" 
#endif

Do I like it? No. But now I've got a pre-processor constant that I can use to assemble my paths in a way that will work across different file path conventions.

Of course, that's the "normal" solution. You could, if you wanted, to it completely wrong. That's what Xian's predecessor did.

#ifdef UNIX
           filename += "/";
#else
           filename += "\\";
#endif
           filename += (*exSeq)[i].path;
#ifdef WIN32
           ReplaceAll(filename, "/", "\\");
#else
           ReplaceAll(filename, "\\", "/");
#endif

If we're compiling for unix, append a "/" to the filename. Otherwise, append a "\". Then we append a path out of an array. Then, if we're on Windows, find all the "/" in our filename and replace them with "\". Otherwise, find all the "\" in our filename and replace them with "/".

Instead of defining a constant and using it everywhere you need to construct paths, this code was copy/pasted everywhere you needed to append a path separator onto your string. Well, almost everywhere. Clearly, we don't know that the contents of (*exSeq)[i].path are correct for our target operating system, hence we have to do the ReplaceAll call to sanitize it. Why didn't we sanitize the portion we're appending instead of the whole filename (which presumably is already sanitized?)? A better question: is this running inside of a loop? It looks like it is, based on the [i] array access there.

Multiple developers have copy/pasted this code into multiple places. Not one of them gave a shot at refactoring it. And somehow, there are still code paths that output the wrong path separator sometimes, though at least modern Windows is forgiving about that.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

Error'd: Fi fa foe

Lyle Seaman — Fri, 26 Jun 2026 06:30:00 GMT

First up this week is a little story about a fifafail. I do wonder if this was a failure of the television station, or whether there was something more to it than that.

Hercules wrote to alert us to these World Cup shenanigans, explaing "At least the flags were correct. And yes, this was live TV. The host got the country names correctly, and even called out that the written text was wrong"

"I'm very open in my job search but I did limit it to France. The search has been working well for months, but this morning I got a bevy of new interesting propositions. It seems France is much bigger than it was yesterday." Apparently WorkerNumber29200 is surprised by the expansionist nature of an imperialist coloniser. Plus ça change, Worker.

We have a couple of wtfs from Github. First Hans K. "would love to find a, so I could fix this GitHub Dependabot issue."

And Peter S. figures that "GitHub has trouble doing basic math -- or they have an unpublished proof that 0=1"

Finally Michele has just encountered one of the most maddening phenomena on Amazon recently. "Searching for a cheap USB-C fast charger. Got a list of expensive CDs of obscure artists." All of them AI-generated, like the 100000 Whys books?

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

The Roadmap

Remy Porter — Thu, 25 Jun 2026 06:30:00 GMT

When Gary was called in for a meeting with a few of his managers- because of course he had several- he thought it was going to be for an "attaboy", because things had been going really well for the past few months.

Gary had inherited a mess, and taken over a nightmare application. It was the kind of application that should be a simple CRUD-style data-driven app, but somehow despite only having 20ish entities it managed, someone had generated 500+ controllers for managing them. Most of those controllers were copy/pasted code with minor changes in the WHERE clause of a SQL query.

And that was just the code. The infrastructure was similarly a mess, with duplicate resources provisioned in their cloud host. There was no CI/CD, no unit tests to speak of, no deployment process that wasn't "manually copy these files and pray". And uptime? You've heard about "five nines", but this product was lucky to get even one nine. Especially because the manual deployment process meant a few hours of downtime.

And that was just the infrastructure. The backlog was similarly messy. There were lots of tasks- many thousands- but not a single one had a priority. Most of the tasks were something like, "Fix database timeouts", or "Bug 531" with no description to explain what they were. At best, some of the "new feature" tasks linked to a Google Doc that explained a software roadmap that had been last updated in 2020.

So with no guidance, Gary and the rest of his team got to work. Cloud costs were massive. Just cutting the duplicate resources would help, but with actual planning it wasn't hard to find even bigger wins. In total, Gary got the cloud costs down 60%- essentially saving the company a small multiple of his salary every year.

With that out of the way, getting a CI/CD pipeline running was next. Within a few weeks, manual deployments were gone. Everything was automated. Downtime nearly vanished. And now, with all the cost savings in cloud resources, for a fraction of what they were paying, it was easy to automate provisioning test environments for each new feature.

So Gary was very ready for some congratulations when he sat down with management. He was prepared to discuss all the wins he and the rest of the developers on the project had gotten over the past few months.

"I'm sure you know why we're sitting down," Manager the First said when they settled into the conference room.

"I'm sure," said Manager the Second.

"We have some concerns about your performance," Manager the Third said.

"My performance?" Gary asked.

"Yes," said Manager the First. "Let me pull up the backlog."

"And the roadmap," said Manager the Second.

"Yes, I'm getting that up too, thank you." The trio of managers struggled with pulling up the appropriate pages, and after about 15 minutes, gave up. Instead, they discussed their complaint without visual aids. "You haven't completed any of the tasks on the roadmap. Bug 673 has been open since you started on the team. None of the roadmap milestones have been touched. There's absolutely no progress."

"Okay, but that document was wildly out of date," Gary said. "Instead I put cycles into solving the actual problems we're having. I've saved the company a huge amount of money. I've gotten our development cycle time down to a fraction of what it was. And we have basically no downtime!"

"That's all very nice, I'm sure," said Manager the Third. "But none of that was on our roadmap."

"Well, maybe we should set up a meeting to go over the roadmap," Gary said. "Because a lot of the tasks on there don't make much sense right now-"

"I don't think that's a good use of time," Manager the Second said. "Large meetings are expensive. Just stick to the roadmap, please."

With that, the meeting ended. Gary went back to work…

… updating his resume.

[Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

CodeSOD: Authorized Logger

Remy Porter — Wed, 24 Jun 2026 06:30:00 GMT

Gretchen's company recently got purchased by Initech. Specifically, they were bought for their dev team, of all things. They had a few software products that were high performers, and Initech wanted that secret sauce. They bought the company, and then split the dev team up and migrated the developers to new products.

That actually worked out okay for Gretchen, most of the time. For a few projects, the dev team was given some requirements and a free hand to figure out how to deliver them. They were free to reuse code that existed or rewrite entirely, based on their own judgement. They were free to pick the tools they wanted to use, and the results worked out well.

But there were some projects that… were a different story. After those successes, Gretchen got moved onto a project that was 90% firefighting. The app had code like this:

req.body.externalId = !!req.body.externalId ? req.body.externalId + "" : "";

How's that for some null handling.

The whole thing can't run on a version of NodeJS newer than 14: a version that last got an update in 2023.

"The code follows no conventions," Gretchen writes, "there's no logging."

exports.create = (req, res) => {
  logger.debug('creating new staffClient');
  logger.debug(req.body)
  // let staffClient = new StaffClient({});

  // // run through and create all fields on the model
  // for(var k in req.body) {
  //   if(req.body.hasOwnProperty(k)) {
  //     staffClient[k] = req.body[k];
  //   }
  // }


  StaffClient.query().insert(req.body)
  .returning('*')
  .then(staffClient => {
    if(staffClient) {
      res.send({success: true, staffClient})
    } else {
      res.send({ success: false, message: "Could not save StaffClient"})
    }
  });
}

Now, you may say to yourself, "What do you mean there's no logging? I see it right there!" There is a logger utility class, and do you know what it prints when you call logger.debug("some message")? It prints DEBUG.

This code handles an HTTP request, and stuffs the body of the request into the database; here's hoping that it's a well formed request. Somebody's got a lot of faith in their front end. WHat's interesting about this one is they've tried two different ways of copying the request object into the database, the first one focusing on making sure they only copied non-inherited properties, and the second just YOLOing the data into the database.

Now, this particular segment goes through their ORM to write data into the database. But not all the code does that. Many places write data through direct SQL, and guess what happens there: SQL injection vulnerabilities.

You may also notice that this function doesn't do any authorization checks, which is fine, that should be configured in the middleware. Should be- but isn't. Most endpoints have no authorization checks at all. Even the endpoints that do, like their admin API, have copies of the same endpoint with no authentication configured.

[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.

CodeSOD: Do a Lot to Do Nothing

Remy Porter — Tue, 23 Jun 2026 06:30:00 GMT

Today's anonymous submitter works in finance. I'll let them start the introduction:

This is a legacy application that has been running for nearly a decade in production so one could say that it's been thoroughly tested by daily production use and nothing needs changing

This is a collection of two C# methods, and we'll start with ValueAGPFund, which isn't a WTF per se, but definitely not code I'd want to maintain either.

public Valuation ValueAGPFund(int valuationId, ValueAFundParameters parameters, CapitalAccount capitalAccount, int? lotId)
{
    if (parameters.UseActiveCoefficientSet)
    {
        parameters.CoefficientSet = _coefficientSetQueries.GetActive();
    }
    parameters.InternationalDveCoefficientSets = _coefficientSetQueries.GetInternationalDveActive();
    var referenceData = _referenceDataFactory.CreateReferenceData(parameters, capitalAccount);
    if (lotId != null)
    {
        var di = referenceData.FundDirectInvestments.Where(x => x.PositionId == lotId);
        referenceData.FundDirectInvestments = di;
    }

    var countryMappings = _countryQueries.GetFullIsoCountryList();
    var valuation = _valuationFactory.Initialise(referenceData, parameters, countryMappings);
    valuation = ApplyValuators(valuation, referenceData, _valuatorFactory.CreateValuators(valuation, this));

    var valuationForCoverage = _valuationQueries.GetWithDirectValuationsAndFundValuations(valuationId);
    valuation = ApplyCoverage(valuation, valuationForCoverage);

    foreach (var fv in valuation.FundValuations)
    {
        _logger.Info($"Debugging distributions: for fund (parameter fund id = {parameters.FundId}, valuation fund id = {valuation.FundId}, fund valuation fund id = {fv.GpFundId}) in valuation {valuationId}," +
            $" loaded fund investment distributions from {string.Join(", ", fv.FundInvestmentDistributions.Select(x => $"{x.InvestmentId}:{x.TransactionDate:yyyy/MM/dd}"))}");
    }

    foreach (var fv in valuation.FundValuations.Where(x => parameters.InvestmentIds.Contains(x.EqtInvestmentId)))
    {
        fv.ValuationId = valuationId;
        _fundValuationCommands.Add(fv);
    }

    foreach (var dv in valuation.DirectValuations.Where(x => x.LotIdDiOnly == lotId))
    {
        dv.ValuationId = valuationId;
        _directValuationCommands.Add(dv);
    }

    foreach (var vw in valuation.ValuationWarnings)
    {
        vw.ValuationId = valuationId;
        _valuationWarningCommands.Add(vw);
    }

    var previousValuation = CheckPreviousValuationIfRequired(valuationId, parameters, capitalAccount, lotId);

    if (previousValuation != null)
        valuation.ChildValuations.Add(previousValuation);

    if (parameters.Frequency == ValuationFrequency.Daily)
    {
        var unapprovedValuations = _valuationQueries.GetList(valuation.FundId, valuation.ValuationDate, valuation.Frequency, valuation.Purpose)
                                                    .Where(x => x.IsApproved == ValuationStatus.Unapproved)
                                                    .ToList();

        _valuationCommands.Delete(unapprovedValuations.Select(x => x.Id).ToArray());
    }

    valuation.Id = valuationId;
    _valuationCommands.Update(valuation);
    _valuationCacheService.Refresh(valuation.Frequency, true);

    return valuation;
}

The key problem with this function is that it's got loads of side effects. It modifies the parameters parameter, which while it was passed by value, the value itself is a reference, so you are updating it on the caller, whether the caller likes it or not. It also modifies a bunch of internal class members. It's also just… doing a lot of different steps. It's not a WTF, but it's bad code. Note the call in the middle to CheckPreviousValuationIfRequired- we're going to come back to that in a second.

Let's take a look at how it's called.

private Valuation CheckPreviousValuationIfRequired(int valuationId, ValueAFundParameters parameters, CapitalAccount capitalAccount, int? lotId)
{
    if ((parameters.Frequency == ValuationFrequency.Quarterly || parameters.Frequency == ValuationFrequency.Monthly)
        && ValuationPurposeHelper.UserGenerated(parameters.Frequency).Contains(parameters.Purpose))
    {
        var inPeriodParams = new ValueAFundParameters
        {
            FundId = parameters.FundId,
            ValuationDate = parameters.ValuationDate.GetPreviousValuationDate(parameters.Frequency),
            CreatedBy = parameters.CreatedBy,
            Purpose = ValuationPurpose.InPeriodCalculation,
            Frequency = parameters.Frequency,
            InvestmentIds = parameters.InvestmentIds,
            UseActiveCoefficientSet = true,
            UseAmericanDve = parameters.UseAmericanDve,
            ValuationOptions = parameters.ValuationOptions
        };

        var openingValuation = _valuationQueries.GetInPeriodOpeningValuation(inPeriodParams.FundId, inPeriodParams.ValuationDate, valuationId);

        //return openingValuation == null
        //       ? null
        //       : ValueAGPFund(openingValuation.Id, inPeriodParams, capitalAccount, lotId);
        return openingValuation == null
                ? ValueAGPFund(openingValuation.Id, inPeriodParams, capitalAccount, lotId)
                : null;
    }

    return null;
}

This function checks the input parameters. Depending on the values, it will either return null, or it will call ValueAGPFund. Wait a second, ValueAGPFund calls this function. That's not good.

But let's really focus in on the return statement and its comment:

        //return openingValuation == null
        //       ? null
        //       : ValueAGPFund(openingValuation.Id, inPeriodParams, capitalAccount, lotId);
        return openingValuation == null
                ? ValueAGPFund(openingValuation.Id, inPeriodParams, capitalAccount, lotId)
                : null;

The current version checks if openingValuation is null, and if it is, tries to access it, thus triggering a NullReferenceException. This function either returns null or throws a NullReferenceException. So all that worrying about side effects and circular calls doesn't matter, but this likely isn't correct. The comment indicates that there used to be a correct version, which only called ValueAGPFund if the valuation wasn't null- but that version likely had all the problems of circular calls and unpredictable side effects.

As it stands, the application as a whole works. Since CheckPreviousValuationIfRequired only ever returns null or throws an exception, and since ValueAGPFund is only called from here, it looks like these functions could just both be removed without problems. But our submitter is wary of doing that:

The problem is that I first need to figure out whether 1) this piece of code produces any side effects and 2) nobody is relying on the System.NullReferenceException being thrown here.

No worries, though, right? I'm sure your unit tests will catch any regressions caused by removing that. Because this is the kind of code that definitely has great unit tests.

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

CodeSOD: When False is True

Remy Porter — Mon, 22 Jun 2026 06:30:00 GMT

Lillith was integrating some new tools into an existing Ruby on Rails API. The existing API allowed you to send a dry_run flag along with the request, so that you could have the service calculate its changes without applying them.

The problem was, the new tool Lillith was integrating could send, in the body of the request, {"dry_run": false}, but the service would see it as true. Consistently.

The helper method which checked for "true" parameters looked like this:

def param_true?(param_name)
  param_value = params[param_name]
  params.key?(param_name) && (!param_value || param_value.to_s.downcase == 'true')
end

The purpose of this function is to handle stringy or nil inputs gracefully. And there's one thing I can say about the function: it will always identify a true value correctly. If your false value is a string, "false", it also works. But that pesky !param_value mean that any actual boolean false value will be seen as true.

This function has been in wide use through the application. Lillith's best guess is that up to this point, no one had set the dry run flag on anything but GET requests, where everything was strings. On POST/PATCH/PUT requests, where the data was passed in the body as JSON, it got parsed into actual boolean values, and thus failed.

That's the WTF, certainly, that this function was lurking and waiting to cause this confusion. But the annoying thing in this function is that it fetches the value from the associative array, then calls params.key? to see if the key exists. That's fine, since Ruby just returns a nil if a key doesn't exist, it's just annoying. I hate to see it. This is, admittedly, more of a "me" problem, but I hate it.

[Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

Error'd: Microbits

Lyle Seaman — Fri, 19 Jun 2026 06:30:00 GMT

This week we have got a couple of Mathanon's. Maybe they're the same person, maybe they're not, there's really no way to know!

Frist anon has a "Numeric fun fact" for us: "Got a form sent from work to express interest in some event. They actually enforced the validation that the answer must be a number, so I submitted "42"." Bravo.

Next anon has a different numeric fun factor: " The SAS website wants us to know the size of the file behind the link down to the nanobyte precision." They split the bit! That must be what this quantum computing thing is about.

Conscientious dad Mark R. takes all the responsibilities. "My kid's school ensures they're legally covered on all things said and unsaid."

Philipp H. points out "The Redmond philosophers have created something the old Greek philosophers will have to rethink. Or is this a pun on Schrödinger's Cat? German→English translation: "We cannot bring/transfer/switch you to this message because you're in a chat, in which you're not in.""

We haven't heard from Michael R. in a while. Here he is with a pithy "The irony is not lost on me."

Happy Juneteenth to those who celebrate.

[Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

Representative Line: Sort This Out

Remy Porter — Thu, 18 Jun 2026 06:30:00 GMT

Today's anonymous submitter has spent a long time toiling through many, many tickets. Their effort has been an attempt to "save" their employer from the disaster left behind by by a highly-paid consultant. As one does, our submitter started with the highest priority tickets with the highest severity. Eventually, they whittled down that list, and had some bandwidth to start looking at the pieces of the code which clearly weren't exploding right now (because there were no tickets), but were likely to explode at some point in the future (creating a storm of tickets).

Scanning through the JavaScript, our submitter found a sort function. That was automatically concerning- why was that particular wheel being reinvented?

The first line of the sort function was this:

obj[x._id.account_id] = x.count_total

In this case, x._id is meant to be the unique identifier from their Mongo DB. That, uh, should be not precisely a UUID (Mongo does its own weird version), but it definitely shouldn't have an account_id field on it. They are storing an arbitrary object as their unique identifier in the database. Which, I'm no Mongo expert, but I don't need to be Flash Gordon to know that's a bad idea.

But setting aside the choice of using random objects as unique identifiers, there's also the other question: how is this furthering the goal of sorting? Why on Earth am I building an object in the form: {"id0": 5, "id1": 7, "id2": 11}? Or am I even doing that? This is the first line of the function, so we're not even doing a loop, it's just {"id0": 5}.

This isn't just an unexploded bomb, it's a mystery: the primary mystery being why hasn't this exploded already? The second mystery is: what's going to happen when your luck runs out?

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

CodeSOD: Weekly Calculated

Remy Porter — Wed, 17 Jun 2026 06:30:00 GMT

There's a language out there called "Progress Advanced Business Language" (or "Open Edge Advanced Business Language"). Just hearing that string of words in a sequence tells you you're in for it. It's a verbose, "English-like" programming language. But we're not here to pick on the language.

A long time ago, Mirjam had the "pleasure" of working in a Progress ABL environment. At some point, one of the developers had needed to find a date six months prior to the current date. It didn't need to be accurate, and thus said developer littered the code with comments reminding everyone that it didn't need to be that accurate. They arguably spent more time defending the choice to be inaccurate than it would have taken to write code that would have been accurate.

Mirjam doesn't have the code anymore, so what we have here is a mix of her remembered pseudocode, Progress syntax, and my attempts to clarify all of it. Let's not worry too much about the language, and instead focus on the logic:

ASSIGN v-date = TODAY.

/* Calculates the current week/year */
RUN week.p(INPUT v-date, OUTPUT v-weeknumber, OUTPUT v-year).

IF v-weeknumber > 26 THEN 
    ASSIGN v-weeknumber = v-weeknumber - 26.
ELSE 
    ASSIGN v-weeknumber = 52 - 26 - v-weeknumber
           v-year       = v-year - 1.

/* Turn the result of that calculation back into a date */
RUN week2.p(INPUT v-weeknumber, INPUT v-year, OUTPUT v-resultdate).

This code gets the current date. It then breaks that into week number of the date (1-52), and the year of the date. Then, if the week number is greater than 26, it subtracts 26 from it, giving us a date half a year ago, ish. If the current weak number is less than or equal to 26, we do 52 - 26 - v-weeknumber, and decrement the year. Which yes, is a fairly round about way to handle the rollover- 52 - 26 happens to be… 26.

It's worth noting, that as primitive looking as this syntax is, Progress ABL does have an ADD_INTERVAL function, which lets you do date arithmetic, without all this nonsense. In fact, Mirjam went ahead and replaced all of this with a single line.

That said, as a little bonus WTF, Progress does have some weird date quirks, for example, you can construct a date from an integer. Which has a very unsurprising (but also, weirdly surprising) range of possible values:

The value of the expression cannot be a date value before 12/31/-32768 or after 12/31/32767.

At least that covers a range that includes both the discovery of agriculture and the eventual rediscovery of agriculture after the event that enters into legend as "The Fall".

CodeSOD: Required Fields

Remy Porter — Tue, 16 Jun 2026 06:30:00 GMT

If you want to connect to another system, you need to supply credentials. That's a pretty obvious requirement. We can set aside the whole technical challenge of managing those credentials and the security problems various techniques create, and just focus in on: you must supply some credentials to authenticate.

Lisa has inherited a method which connects to another system. It, correctly, will complain if you don't supply parameters for credentials. It will, incorrectly, mislead you about their requirement:

public function connect(string $username = "", string $password = ""): void
{
    if ($username === "") {
        throw new InvalidArgumentException("username is required.");
    }
    if ($password === "") {
        throw new InvalidArgumentException("username is required.");
    }
    // ... other stuff
}

The $username and $password fields here are set to default values. Which means it is syntactically valid to invoke the function connect(). It won't work if you do that, as it will definitely throw an exception, but this is a bit of misleading ergonomics. If the parameters are required, they should probably, I don't know, be required?

What really draws our attention here, however, is not the misuse of default parameters, but the absolute disaster that debugging issues with this function could easily become. If you fail to enter a username, you'll get an exception telling you "username is required". And if you fail to enter a password, you'll also get an error message telling you "username is required".

Which is a factually true statement: username is required. But it's not the cause of my error, which is that I failed to supply the password. Theoretically, though, we could adopt this to make writing exception messages easier. I could make every exception message be "username is required", and it wouldn't be wrong. And clearly, that's what we truly mean when we say "not even wrong".

CodeSOD: Caught a Mistake

Remy Porter — Mon, 15 Jun 2026 06:30:00 GMT

Daniel recently started a new job. His first task was to fetch some data from the database and render it to the user. Easy enough, and there were already wrapper functions around the database to make it easy. He called execute_read, passed it a query, and checked the results.

There were no results. But the query definitely should have returned results. What was going on?

def execute_read(conn, query, params, only_one=False):
    result = None
    cursor = None
    try:
        start_time = time.time()
        cursor = conn.cursor()
        cursor.execute(query, params)

        if only_one:
            result = cursor.fetchone()
        else:
            result = cursor.fetchall()

        end_time = time.time()
        time_taken = end_time - start_time

        if env.is_production():
            if time_taken > 0.4:
                logger.critical("long query", query=query, time_taken=time_taken)
        else:
            if time_taken > 0.2:
                logger.warning("long query", query=query, time_taken=time_taken)

    except Exception as err:  # pragma: no cover
        logger.exception("execute_read exception", exception_msg=err, query=query)

    finally:
        logger.debug("execute_read debug", query=query, params=params, only_one=only_one)
        if not result:
            if only_one:
                result = {}
            else:
                result = []
        if cursor:
            cursor.close()

    return result

There are a lot of things I don't like about this function. The only_one parameter, for starters. Note how the database library actually breaks that behavior out as different functions- that's a much more appropriate model, especially since you have wildly different return types depending on how that flag is set.

Similarly, checking env.is_production() to check a timing threshold is itself pretty awful. I can sympathize with wanting different timing constraints based on what environment you're in- but if that's the case, the timing constraint is the parameter. env.long_query_threshold should be the configuration parameter. Also, your database should be able to alert you to these kinds of things, so that it doesn't live in your code anyway.

But the WTF here is the promiscuous exception handler, which catches all errors and simply logs them. This created a situation where Daniel sent a query to the database and got no results. He didn't go straight to the logs and tried to debug it more directly, so it took him quite some time to find the execute_read exception log line which told him what was wrong: his SQL query had a syntax error.

Daniel writes: "I can't imagine the disaster that this causes if there's a network hiccup in production." Failing silently and returning empty results sets definitely is inviting a lot of confusion.

Error'd: No Rush

Lyle Seaman — Fri, 12 Jun 2026 06:30:00 GMT

This week, friend Adam R. sent in an entry and included with it a link to a short-form YouTube video. Presumably this was a mistake, because I watched that video and the next one and the next one and the next one and after two hours I still haven't got this column ready. I won't share the video link with you. You're welcome.

What Adam really wanted to say was: "The USPS offers a sincerely service called Informed Delivery that, every morning, emails you scans of the exterior of your postal mail that you're expected to receive that day, which is a genuinely useful service (#not-sponsored). In today's digest, however, the subject line had an extra None thrown in there. Some Python script gone wrong that wasn't tested before production, perhaps?" We get lots of NaN, null, and undefined submissions, but None are actually rare.

Carlos sent us a fresh email, reporting "Mint Mobile hit the jackpot but their template engine didn't."

"No Rush" stated Robert F. calmly. "My Carbonite backup files will be deleted in 11250001 days if I don't reconnect the drive. Well, there's no rush, really. They have given me 30,822 years to reconnect it. (It was never disconnected in the first place!)"

"Roosting indeed" harumphs The Beast in Black. "Somebody should tell Claude Code that it keeps using that word but I do not think it means what it thinks it means. On the other hand, considering how sssllllllooooooowwww it usually is, perhaps this is honesty."

Peter S. has been driven to madness by Sixt, right along with me. "Now that I am silver, Sixt's top offer is to fill all mandatory fields in their data extension. I wonder what gold gives me."

CodeSOD: Dating in Hungarian

Remy Porter — Thu, 11 Jun 2026 06:30:00 GMT

A horse can only be so tenderized, but as well established at this point: I don't like Hungarian Notation. Richard G sends us an example of yet more of it, being misused, as well as some bad date handling. That's basically two of the easiest things to complain about, so let's take a look!

DateTime sCDate2 = Convert.ToDateTime(Hdn_SelectedDate.Value);
Double dStart2 = double.Parse(Hdn_SelectedShifts.Value.Split('@')[0]); // Gets something like "10.5" for 10:30

// More code ...

DateTime lSelectedStartAdd = DateTime.Parse(sCDate2.ToShortDateString() + " " + DateTime.FromOADate((dStart2) / 24).ToShortTimeString());

We take the value of Hdn_SelectedDate, which is one case where I'm actually willing to be a bit flexible on my hate of Hungarian Notation. In this case, it tells us that this is a "hidden" field on an ASP .Net form. Of course, storing a bunch of data in hidden fields on your form is a dangerous pattern, and in this case, they're carrying between 30 and 50 different pieces of data from one page to the next as hidden fields.

In any case, we take the value of that field and convert it to a datetime, storing the result in sCDate2. Here, the questions start. s, conventionally, tells us that this is a string. But it is not a string, it is a date. Why is it CDate? Actually, why is it CDate2? What's so 2 about this? There is no sCDate, sCDate1, or any other variation thereof- why 2?

Then, we look the contents of Hdn_SelectedShifts. This is another hidden field, and this one stores a string that is delimited by @s. We take the first element, which represents a time of day- as a double. 10.5 means 10:30. That's certainly a way to represent a time of day.

With this data in hand, we then use this to populate the lSelectedStartAdd variable. Once again, the l exists to mystify us. In some Hungarian flavors, it could mean "local variable", but if that's the case, why aren't we using that for any of the other local variables? More commonly, it might mean "long integer", but once again: it's a date.

This all brings us to DateTime.FromOADate. No, this is not when you Netflix and chill while watching cheap streaming sci-fi, OA in this case stands for OLE Automation, and now we have to go down a rabbit hole which has nothing to do with any of this code.

One of the things which made Windows what it was was the use of COM; the Component Object Model was an object oriented approach for letting applications talk to each other. It's what gave us DLL Hell, but it was also a really powerful system for automating software. You could use Visual Basic to leverage COM libraries provided by other software; even if the software you were targeting didn't have a scripting system, you could write your own scripts to control it anyway. OLE, Object Linking and Embedding, was a subset of all the COM functionality. It replaced Dynamic Data Exchange, which was the previous way of automating applications. With COM, COM+, DCOM, DDE, OLE, Microsoft created a whole soup of ways to link to functionality exposed by other applications. It was a giant mess, and I just put this paragraph here to flashback on the horrors of that era.

In any case, because OLE was mostly about automating Office applications, and because of Remy's Law of Requirements (no matter what the users said they want, what they really want is Excel), OLE Automation has its own date data type, which is a floating point number measuring the offset from December 30th, 1899. Which, of course, is not Excel's date epoch: Excel starts at 31-DEC-1899. Except Excel inherited its epoch from an older spreadsheet tool, Lotus 1-2-3. And Lotus had a bug: it thought 1900 was a leap year. Which means in practice, for any date past 28-FEB-1900, the effective epoch is 30-DEC-1899. Excel intentionally recreated the bug, because it needed to be compatible with Lotus 1-2-3 if it had any hope of competing in the market. One pesky little detail and now 1900 is a de facto leap year.

I'm sorry, we've got afield. We have dStart2, which is a floating point number representing hours in the day, with minutes as the fraction. We divide that by 24, then pass it to FromOADate, which will now treat that as an offset from 30-DEC-1899 00:00:00, giving us a date like 30-DEC-1899 10:30:00. We grab the time string off that, the date string of four date, munge them together and parse it back to a date.

Of course, the C# DateTime type has an AddHours, so they could have just done scDate2.AddHours(dStart2) and skipped all the parsing.

You want to know something more fun about this? That floating point representing time? It's initially populated by having users select off a drop down, and the drop down uses as its labels the more conventional HH:mm format. The value stored by the drop down is the floating point value. And yes, someone did manually write all that out in the code, they didn't use a loop or anything.

In any case, this is a long winded reminder: I hate Hungarian Notation.

CodeSOD: Delicious Fudge

Remy Porter — Wed, 10 Jun 2026 06:30:00 GMT

Stella (previously) sends us a much elided snippet. The original code is several thousand lines contained in a single try block. But the WTF is pretty clear without seeing all of that:

try:
  # the whole business logic without any exception handling
except:
  print("Fudge")

They didn't really say fudge of course, but we mostly try to keep profanity off our main page. Mostly. In any case, when your operation fails someplace in the middle and you have no idea where, why, or how: "Oh, fudge!" is the appropriate expression.

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.