The Daily WTF

Error'd: Named And

Lyle Seaman — Fri, 30 Oct 2026 06:30:00 GMT

I do like it when submissions include the creator of the wtf, unless the specific kind of err is really spectacular and then it might be noteworthy regardless. This week we received a few who did tell us something about the responsible party. That being said, on with the party!"

An anonymous contributor shared with us this "Important order info from Ubbad HBG-ICS I", saying "I checked on Amazon but can't find order #{randnum(3)}-{randnum(6)}. This is worrisome though, because my credit card does end in **{randnum(4)}." Wild, so does mine!

"With the right translation this could say anything" observed B.J. H. sagely. "I guess they haven't translated to English yet. I especially like this: [%EXTERNAL_TRANSLATION:New gender_aware email footer body 5 privacy policy BLUE%] Can't they decide on capitalization and whether to use spaces or underscores?"

"this could go in two directions" worried undercapitalized (but aren't we all) klinsten. "well... it is a mail with my paycheck. but the label 'promotions' got me worried. do i get a promotion (nice!!) or did they apply a discount to my paycheck (less nice!!) i'm afraid to click it..."

Reader Valts S. wondered "I'm not sure where I'm supposed to track my order, but it feels like it's been censored." Or merely forgotten?

Regular contributor Michael R. took a flier with this, hedging that it's "Probably more a joke than a RWTF." But it's a little funny, so this editor will allow it.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

CodeSOD: Oh, K?

Remy Porter — Thu, 29 Oct 2026 06:30:00 GMT

Pierre found this cry for help:

 for (j = 0; j < DISTRICT_CARDINALITY; j++) {
    /*
    * A poor way to work around some sort of memory
    * violation.  k gets clobbered, so I buffer l with it.
    * Help?
    */
    for (k = 0, l = 0; k < customers; k++, l++) {
            /* c_id */
            FPRINTF(output, "%d", l + 1);
            METAPRINTF((output, "%c", delimiter));

Honestly, I'm always a little worried in C-like languages when the loop variable isn't scoped to the loop and declared in place. Always concerning, so when there's concerns with clobbering, I'm not surprised.

This iterates across a set of "districts", and then iterates across a list of customers. Standard output functions are replaced with macros, and honestly, I don't know that I want to know what happens in METAPRINTF.

But fine, this iterates across a bunch of stuff and generates output. It's the comment that we're really curious about. "Some sort of memory violation", so we duplicate our loop variable. What on earth could be happening here?

Well, Pierre found the "memory violation", which is probably what you expected:

k = strlen(someOutputString) - 8;

k is used elsewhere in the loop as a variable. That's not a memory violation, that's just how variables work.

This leaves us with one possible conclusion: the developer who wrote the comment couldn't find this bug. And given the weird use of macros here, I'm going to go out on a limb and guess that it's not the developer's fault; I strongly suspect the loop is so long, so complicated, and so obfuscated that very few developers could find that.

My earlier complaint about scoping the variable to the loop wouldn't fix this, which I guess is on me. They still should really scope the variable to the loop.

[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.

CodeSOD: Session Recording

Remy Porter — Wed, 28 Oct 2026 06:30:00 GMT

We still get a fair bit of old school ASP .Net webforms code, which was cutting edge about twenty years ago, but remains a collection of bad choices that tried to make web programming feel like desktop programming. As an aside, what a reversed world we live in today, where everyone uses Electron and our desktop programming feels like web programming.

In any case, Thomas sends us some pretty ugly webforms code.

Me.Session("Albumid") = CType(e.Item.FindControl("lblAlbumID"), Label).Text
If Not Me.Session("Albumid") Is Nothing And Not Me.Session("Uid") Is Nothing Then

    Me.strDelSQL = "Delete from tbl_Albumshare_Mast where Album_Id=" & Me.Session("Albumid") & " and Sharer_ID=" & Me.Session("Uid")
    Me.objDB.ExecQry(Me.strDelSQL)
    Me.Response.Redirect("frmmyalbumshare.aspx", False)

End If

Broadly, the goal of this code is to take an album ID from the user and delete an album from the database where the ID matches and the album is owned by this user. And everything is horrible here.

First, the use of e.Item.FindControl to look up the input field is suspicious. That's usually what you do when you've dynamically generated controls, but I don't think that's happening here. Because we use FindControl we have to cast it to Label, and only then can we get the text property. That itself raises a question, because why are user inputs getting stored in a label?. That's not what labels are for. They're clearly doing some sort of hacky lookup/autocomplete field thing and using the label to actually store the input, but presenting the user with a different UI for picking it. Not an uncommon pattern in those days, but a hidden field would be a more typical way of doing it.

We then construct a SQL injection vulnerability and run it against the database.

Then, we use a redirect to send the user to a different page. Again, a common thing to do back then, but a thing I hate: using HTTP 300 codes to redirect users as a form of navigation is awkward and weird.

Of course, none of that is precisely the WTF here. The real WTF is the developer apparently hates local variables. strDelSQL is a member variable- why do we need to store this in a class member? Especially because in the page lifecycle, we handle one request and then die; either this is unnecessary, or far, far worse, some other code is looking at this SQL query later. But far worse than a badly scoped variable is the overuse of session variables.

Thomas sends us this block as a representation, but the developer responsible just stored everything they could in a session variable. While in this example, "Uid" probably makes sense, "Albumid" definitely doesn't. And in other cases, basically every user form input gets stored in a session variable, and even worse: they're often used as loop variables. while Session("myloop") < 5 type stuff.

And finally, we already know I hate hungarian notation, but here we have a client side form holdover that pollutes the user experience: the URL they get redirected to has a hungarian frm prefix. It's bad enough that you're using hungarian notation, but don't show that to your users! They really don't need to see everything.

[Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

News Roundup: Security Fourth

Remy Porter — Tue, 27 Oct 2026 06:30:00 GMT

A bit ago, I broke with my usual pattern and wrote up some security issues that I felt were particularly funny. It was a change of pace, a different thing, but not a thing that'd become a habit. After all, I'm not a security expert, this isn't a security site, and seriously, what are the odds that suitably funny security issues would crop up again less than a week later?

Well.

Let's start with the actual serious issue, PHP2Shell. In terms of scope, every version of PHP for the past twenty years has had this bug. The general issue that permits the exploit was known about, but wasn't considered exploitable.

Oops.

The broad strokes of the bug is that it's two separate bugs. The first allows someone to bypass the checks on a request's size, thus giving them a direct route to triggering an out-of-memory error. The second is that, depending where you are in the processing pipeline, PHP doesn't properly handle cleanup, allowing for use-after-free that can trigger code execution. It doesn't matter what code you've written, this all happens before the request even hits your code.

Bigger oops.

This bug was found via LLM tools, which has lead to a lot of hype around the idea that we've entered some new era. I'll certainly grant that the ability to throw compute at hacking challenges instead of human effort is going to shift the landscape, but I'm not quite willing to buy the apocalyptic prophecies. Especially when some of those prophets are telling us that their AIs will avoid deletion by copying themselves onto your thermostat. I think it's safe to say we're going to see a lot of security incidents coming out of LLMs in the near future, not because they're magic genius hackers, but because they're pretty good at processing structured text and running tests.

For those of us living in the real world, the concern isn't AIs, but HIs: human intelligences. In this case, the exploit was discovered back in August. Security researchers and the PHP Foundation put their heads down to work on it, and where necessary, notified so-called "critical infrastructure providers" to ensure that everyone was ready to address the issue. The problem there is that two people can keep a secret if one of them is dead, and a lot more than two people got roped in to deal with this.

Rumors were circulating in security circles. And cybersecurity firm Chainguard decided this was good enough excuse to break the embargo and announce the flaw before patches were available. No patches for a flaw that impacts 20 years worth of software versions of widely deployed software.

Patches are out now, though only for versions 8.2 and up. Source patches are out back to 7.4, which is officially end-of-life, but I have to wonder how many official EOLed copies of PHP are out there.

On a lighter note, we can't let the hijinks of eMudhra pass without comment. eMudhra is, among other things, a root certificate authority. They've got a bunch of key pairs that they use to sign certificates for other customers, thus vouching for those customers' identity. As a root CA, they were trusted by pretty much every TLS/SSL implementation on Earth; if you had a certificate from eMudhra, every browser would trust that you were who you said you were.

The only problem? One of their private keys was 4. Yes, it's the XKCD.

Now, in their defense(?), eMudhra didn't generate impossibly insecure keys. They performed a key signing ceremony and generated appropriately strong keys. Then they used an in-house tool to pack/unpack the keys, and this tool decided to truncate some of them down to one byte. Shockingly, even though ECC has relatively short key sizes, 8-bit ECC isn't secure! You could derive the private key from the public key using only pencil and paper. But the worst part is that they did check the validity of the keys- before they got truncated, giving them a false sense of security.

The good news, for eMudhra, is that this particular key signing ceremony generated a total of 24 keys, and only 8 of them were truncated to the point of uselessness. I have it on good authority that two out of three ain't bad.

Now, after that disgrace, it's no surprise that eMudhra is dropping out of the certificate authority business. Still, the press release where their chairman explains the rationale is some serious "screw you guys, I'm going home," energy.

He added that global SSL/TLS is a small part of eMudhra’s business contributing to about 1% of the global revenue. Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base.
However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business. In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders. For many certifying authorities, SSL/TLS is the whole business. For eMudhra it is one part of a much broader digital solutions portfolio. We will put our energy where we create the most value for customers with Sharpened Focus on Core Enterprise Solutions and trust services other than SSL/TLS.

eMudhra's chairman added "There were no end entity certificates issued out of the affected CA’s. Its infrastructure was not compromised and no data was breached. All physical and logical security controls remained intact." That's thin sauce, of course, because while eMudra may not have issued any certs under the broken keys, anyone else could have. It's not that everyone is overreacting to a non-event, and more that it's a non-event only through sheer luck.

Also, removing a root CA from your trust store isn't a trivial task, and at the time of this writing, there's still loads of cleanup that needs to happen as a result of this.

Something I learned while writing this is that eMudhra's slogan is "Trust Delivered". This is sorta like when my partner and I tried to get a coffee table delivered, and instead received a cardboard box full of wooden shards, because apparently someone though "air freight" meant "wait till the plane is roughly over my house and push the box out the back". Something was delivered, but it wasn't a coffee table by the time I got it.

Securely Useless

Ellis Morning — Mon, 26 Oct 2026 06:30:00 GMT

Submitter Chops relates a tale of chasing "The Standard" at any cost:

A company had been forced, kicking and screaming, into the 20th century, and then into the 21st. Their range of dumb hardware was no longer being bought by customers who expected at least some way to get the data off it, and a USB stick wouldn't cut it.

The techno-fearful hired an external IT company and instructed them to ensure that the company adhered to the UK's "CyberEssentials" programme of IT security.

Unfortunately, this meant that the nascent software development capability was immediately hamstrung, as people were denied the right to install and run unapproved software (including software that needed admin level rights in order to work, such as process monitor tools used as standard in software dev and test), could not easily connect across networks (also vital for the software dev), could not add various hardware to the network (such as the company's own products, which made testing them awfully difficult) and so on.

A criminal underworld of mystery PCs slowly grew into place, plugging into the network to get things done, disavowed by anyone who saw them. Tunnels grew up, IP addresses were handed round on notepaper (no DNS approvals), a shadow world of software development in the back alleys of the network. Until finally it was too much, and approval was given for a second, less secure network. The plan was that the real core business, the really important parts, they would stay on the high-security side. There would be a second network, with a single bridge, which would serve the various software development and test systems, and also host the myriad new internal services growing up (wikis, servers, tools and so on). This way, the real core business would definitely remain secure, and compliant, and the software side of it and all that would not compromise the heart of the business.

The heart of the business ended up being a network share containing a decade of out-of-date, unsearchable documentation for products that were mostly no longer sold. It is super-secure, and the business heads confirm whole-heartedly that the company adheres to the CyberEssentials programme 100% with zero compromise.

There's just a carefully separated set of servers and PCs, not the true core of the business but about eight times the size and full of essential activity, on a secondary network.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

Error'd: It's About Time

Lyle Seaman — Fri, 23 Oct 2026 06:30:00 GMT

Usually I have to save up a few weeks' worth of error'ds to get five of a kind, but this week we got a rash of funky date entries! I guess we were due.

First up Tim R. reminding us here that "Dates are difficult! ...but when the entire purpose of your web site is to convert the time to different time zones, I'm not inclined to give you much slack for being one hour out."

And an anonymous reader who just doesn't trust big tech. "In my calendar I have a monthly reminder to clear my data MS data manually. Now you know why, although I don't expect this will come as a surprise to anyone." Note the date on the lower right of the screenshot.

"June has 30 days, so 31 was not accepted," repeats Daniel D. incredulously. "I needed to calculate day difference between two dates. So I entered June 30 (as shown) only to get this error message. Now - should I trust that calculator to calculate date differences, what you say?"

Daniel D. went on to share with us a couple of images from "A well-known e-commerce website in Central Europe that allows you to filter by battery life! Only it randomly switches to seconds." Yes, randomly. See the second image too.

And finally this week, Marc Würth identified a novel Network Solutions Domain History Date Format(TM) "In other places, they displayed dates formatted as "01/13/2025", for example. I guess, instead of using actual ISO 8601, they just flipped the order and replaced the slashes with dashes."

Representative Line: Readable Formats

Remy Porter — Thu, 22 Oct 2026 06:30:00 GMT

We all love format strings for generating human readable text. Certainly, they're a better choice than string concatenation. Even if I have a blind spot that keeps me from remembering the printf format tokens, I still prefer to use format strings.

Jasmine has a co-worker that does use format strings, but they also miss using string concatenation. So they've found a way to combine them, and avoid the perils of making readable code that describes the format of their text.

myField.DataFormatString = "{0:#,##0." + new string('0', 2) + ";(#,##0." + new string('0', 2) + ")}";

Now, in their defense, I can see how this code started its life. At some point, they wanted to make the number of decimal places a parameter. And sure, this is an easy way to do that and retain the intent, though this whole thing could be cleaned up with just a simple decimalPlaces = new string('0', 2), which would make the concatenation less confusing to read.

Related, while I was checking the documentation on the .NET formatting strings, I learned that they have a per-mille format specifier which requires writing a unicode sigil on most keyboards.

I'm sorry, but seeing string perMilleFmt = "#0.## " + '\u2030'; in my code would be TRWTF.

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.

CodeSOD: Doing the Assignment

Remy Porter — Wed, 21 Oct 2026 06:30:00 GMT

Today's code maybe isn't much of a WTF, but it does point in the general direction of, "Damn, you live like this?" Poor Nancy unfortunately does.

int x = 3;
int y = 4;
int z = 4;
x = y = z;

Each variable is declared and initialized, and then they're set equal to each other. It just raises the question though, why do it this way? Why not declare them and then x = y = z = 4, if we want that? Or maybe, for more clarity, int x = DEFAULT_VALUE; would be more legible, and we can skip the multiple assignments on one line. Why does x get set to 3 but then overwritten?

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

The Outage

Remy Porter — Tue, 20 Oct 2026 06:30:00 GMT

At my employer, we use a service called Coveralls, which is a code coverage reporting tool that hooks into your CI pipeline. It takes your lcov reports and gives you some insights, and also makes it easy to cause the CI pipeline to fail if newly added code doesn't have reasonable coverage.

I have no strong feelings about the tool, but on February 24th, our CI jobs started failing, and our CI step that talked to Coveralls was the culprit. Coveralls had gone down. That happened to us, and a lot of other people. It was a widespread outage impacting anybody who used their service.

Coveralls actively published updates as the outage dragged on, and boy, did it drag on. Between them posting nearly identical updates minutes or even seconds apart and the general desperation that snuck into their outage notes after the first few days, I couldn't help but find their notes hilarious.

They've published their post-mortem, and the short version is that despite them paying their bills, Amazon decided they hadn't, and shut down their services. But it took them roughly 68 hours to figure that out.

If you scroll down past the post-mortem, you can see their outage notes. This is an unauthorized, dramatic reading of those notes. We've taken some liberties in interpreting it.

I hope this is taken in a good spirit, because they were just doing their best when this happened. I don't think most companies would be able to maintain operations when their cloud provider decides to lock their accounts. But I don't care who you are: begging your users to email you if they can help you migrate off AWS is funny.

[Advertisement] Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!

A Vat of Terrible Experiences

Ellis Morning — Mon, 19 Oct 2026 06:30:00 GMT

Taxes are a royal pain for everyone. Amazon has found a unique way to make them even worse, as Kris W. attests:

I recently bought a €9.61 kitchen knife on Amazon Spain. My card was charged €7.94 instead. After some investigation, I discovered that Amazon had applied an old VAT registration number I'd added to my personal account years ago, and had classified my purchase as a VAT-exempt intra-EU business transaction. The invoice even contained my business address from 2022, which no longer appeared anywhere in my account settings. I just wanted to remove the VAT number so I could go back to buying kitchen utensils without accidentally generating international tax paperwork.

Unfortunately, Amazon no longer provided any visible way to manage that VAT number. Their customer support chatbot insisted I provide the order number from which I wanted the VAT number removed. A human agent confidently explained that I must have entered it into a secondary address field, and instructed me to delete and recreate my shipping address. Another support representative sent me an extensive list of documents I'd need to provide, including my passport, airline boarding passes, proof of export outside the EU, or my NATO identification card. Apparently removing a VAT number from an Amazon account is a process normally reserved for international travelers, Andorran residents, and military alliances.

Eventually, I found Amazon's official help page. It explicitly stated that VAT numbers could be removed either by contacting Customer Service or by creating an Amazon Business account to use the self-service option. After another round of correspondence, Customer Service informed me that they were not allowed to remove VAT numbers and instructed me to use the Business settings that my personal account didn't have. So I followed the documentation and created a Business account using my existing email address. During registration, Amazon required me to enter the very VAT number I was trying to remove, then promptly congratulated me by email on successfully adding and activating it.

But I couldn't access the Business settings yet. Amazon couldn't verify my business and demanded official documentation, so I obtained two freshly-issued certificates from two separate Spanish government agencies to prove that I was, in fact, a self-employed software developer. I uploaded both documents and waited. Eventually, my shiny new Amazon Business account was approved. I now had a separate Business account, complete with its own purchasing features and complimentary Business Prime membership. At last, I could navigate to the promised VAT-management page!

The page displayed my VAT number, confirmed it was valid, and offered a button to add more tax information. Beside the existing number, however, there was no Edit button. No Delete button. No self-service removal option whatsoever. There was only a link saying, Contact Customer Service to change your tax ID.

Naturally, the link led to a generic help center. After creating an entire business account, submitting government paperwork, and successfully registering the same VAT number a second time, I had arrived precisely where I started: Customer Service, which had already explained that it was not allowed to remove VAT numbers.

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.

Error'd: Scrollpocalypse

Lyle Seaman — Fri, 16 Oct 2026 06:30:00 GMT

Dr. Doom...scroller titled this one "Scrollbar-ception". Said he "Screenshot of the TikTok webpage (i.e. in a desktop browser) while not logged in. I swear this wasn't a NSFW TikTok video, instead it was a montage of some live show from some singer. Anyway... Back on the topic of the actual publishable snarky comments: Social media is known for doom-scrolling. Well, these are scrollbars of doom. Or doom-scrollbars."

An anonymous reader clarified "I was reorganizing the document by drag-and-dropping a bunch of table cells a bit too far for Word's comfort and it's telling me what I did wrong." Clearly.

B.J. H. reported a crisis. "First Southwest made me question the existence of my bags: I saw them scanned but the bag tracking system said there were no scans. Then the next page made me question my own existence as well." B.J. who?

Adam R. reported a new way of formatting numbers. "Stripe has decided "You know what, I'll put the +/- sign for the transaction amount on the *previous* line instead of the same line, just for funsies." Less snarkily: line break algorithms are fickle, and they forgot to put a non-breaking space in there."

Peter S. proposed "I was trying to sell my Peleton equipment on their official "Repowered" site, and I was shown this nice list of yes/no buttons. I am not sure if I feel like gambling today with these answers." I want to know if Peter is unloading all his equipment because he reached his goals, or if he just gave up.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

The Frist Line of Defense

Remy Porter — Thu, 15 Oct 2026 06:30:00 GMT

We don't cover a lot of security issues here, simply because they're not usually funny. But sometimes, they are. So here's a quick hit about some recent ones.

We start with a very bad month for the Danish social security system, the Central Register of Persons (CPR). Last week, they detected a breach which exposed the personal details of 8.8m people. Per the Register article, a cybersecurity specialist correctly pointed out that treating your ID number as if it were a secret was a terrible idea in the first place, but unfortunately, so many systems have grown up around the idea that full knowledge of your state issued ID number as proof of identity, that the security expert is screaming into the wind. They're right, but it's going to take a lot to change.

Okay, Denmark's social security service was hacked. What's so funny about that?

Well, the mechanism of the hack appears to go thusly. First, third party companies have access to the database, which they can use to send notifications to their customers via CPR. That connection is secured with a password, and one of those third parties secured their account with the kind of password you'd use to protect the precious air of the planet Druidia. Also known as the kind of password some idiot would put on their luggage: "123456". (paywalled, Danish article).

The hacker accessed the system on September 10th, and spent ten days searching through the system. The intrusion wasn't detected until October 2nd, when CPR went to send an invoice to the third party company and noticed, "Boy, that's more searches than they have customers." Now, obviously, CPR should have never even allowed such a low complexity password, but also, the third party company shouldn't have used such a low security password.

Now, if you'll excuse me, I have to change the combination on my luggage.

In other news, I'm not particularly fond of blockchain stuff. Mostly, the whole distributed ledger seems like a solution in search of problems, and "trading tokens as if they're money" is the best thing anybody's been able to come up with. Back in my consulting days, when blockchains were all over the news, I was consulting with a large retailer, and they were exploring using blockchain in their supply chain. "How does that work?" I asked innocently. "It'll have blockchain in it." "Sure, but what does the blockchain get you?" "We'll be using blockchain. If there's like, an e. coli outbreak, we can trace where it came from." "Couldn't you get that out of a regular database?" "But this'll have blockchain."

In any case, blockchain companies getting hacked and having all their users' assets stolen is practically a daily occurrence. Not really notable. But a recent hack is legitimately interesting.

A company, called Ledger, sells "hardware wallets". Instead of storing your keys on some third party's servers (where it'll get hacked and you'll lose all your "money"), you store them on a hardware device that you put in a safe. It's not connected to the internet, and thus is unhackable. Or so you'd think. But if enough people are buying those devices, a supply chain attack becomes potentially very lucrative. And that's exactly what happened. Someone in the supply chain cracked a bunch of these devices open, and inserted new hardware. They attached a microcontroller to the screen leads, that allowed it to read what was on the screen (and thus detect when the screen was displaying a recovery code that could be used to access the wallet), and a cellular modem that allowed it to literally phone home with that information.

In total, these hackers walked away with the equivalent of nearly $100M in cryptocurrency.

All the devices passed through Ledger, where they were inspected before being sold. Presumably, they were sealed with tamper-resistant packaging. It's plausible that the tamperer was downstream from here and the customers didn't fully inspect the packaging. Even your most savvy user generally doesn't check that kind of thing, and I suspect a lot of these customers aren't actually all that savvy. But also, companies in the crypto space tend to be... we'll say, more eager than cautious, so I wouldn't be surprised if the tampering happened upstream and didn't get caught by their inspection process.

Security is hard in the best case. It's much harder when you're putting the final onus of security on end users who may have thousands or even millions of dollars locked behind a single key. Or when passwords are hard, so you pick an easy one to remember.

[Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

Representative Line: A Diamond in the Rough

Remy Porter — Wed, 14 Oct 2026 06:30:00 GMT

Mandy's co-worker recently learned about virtual inheritance in C++. It's become their new favorite button to push, and they only use virtual inheritance.

Virtual inheritance is one workaround for the "diamond problem", where you have an inheritance tree that "recombines" via multiple inheritance: when a child class has a Hapsburg-esque parentage, it's hard to decide which inherited methods are being invoked or overridden.

In C++, imagine you have class A, which gets derived into classes B and C. Class D then uses multiple inheritance to inherit from B and C. In practice, this means that D inherits from A twice, and would have two internal copies of all of A's members.

If, on the other hand, you have B and C inherit virtually (class B : public virtual A), then class D will only actually inherit a single copy of A.

If you're reading this and going, "Boy, this just sounds like another reason to avoid multiple inheritance," you're probably right. The important thing, though, is inheriting virtually impacts how your child classes will inherit. It only matters if you have child classes.

Which brings us back to Mandy's co-worker. He read somewhere that defaulting to virtual inheritance all the time was safer, so he did that all the time. All. The. Time.

Including in this case:

class SomeSpecificDerivedClass final : public virtual SomeBaseClass

The class here is marked final. It can't be inherited from. The use of virtual accomplishes nothing.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

Editor's Soapbox: Digital Mail

Ellis Morning — Tue, 13 Oct 2026 06:30:00 GMT

Ever get some special letter, card, or picture from a friend or loved one that you held onto, maybe even taped to your cube or office wall? Is it something you still look at fondly, something that lifts your spirits whenever you're down? Certainly, a thoughtful card or letter is much nicer than a thoughtful email.

Now imagine your special keepsake being scanned, censored, and converted into a digital file that you can only view from a tablet — assuming you can afford the fee to access the tablet. The original has been destroyed; it's gone forever. You'll never get to see or feel it in your hands.

It sounds almost too cruel, like something you'd find in a Fallout game. Unfortunately, it's reality for more and more people incarcerated in US prisons.

I've been writing to an incarcerated person for a while now myself. I find the process incredibly rewarding; I think about my friend all the time and wish them well. Unfortunately, the scanning and processing takes absolutely forever, so in a given year we only exchange 3 letters per side. The digitized files that I receive have names censored out of them; I have no idea what's removed from my letters before my friend receives them. For me, this is all too reminiscent of exchanging letters with my grandmother in Iran before she died. Agents there would straight-up open the envelope, confiscate any valuables inside, marker over anything they didn't like, then re-seal the envelope and send it back on its merry way.

Over 30 US states now digitize the mail passing in and out of prisons, relying on AI to judge what's kosher and what isn't. If you thought AI was great with resumes, just wait until you task it with threat detection! It's been working so well that one nonprofit organization had to change its name: the word fight, used in any context whatsoever, gets flagged.

Once mail is scanned, it's only accessible by tablets that have to be paid for. Incarcerated people are already nickled and dimed for a ridiculous number of things and surely don't need more fees.

It doesn't stop at mail, either. The latest tech is also being used to eliminate physical visitation. Because if there's anything the pandemic taught us, it's that nothing beats seeing your loved ones exclusively on a screen for years at a stretch.

The states justify these egregious measures by playing the drug card. They're necessary to stop drugs from entering the prisons. But these states stop short of providing evidence to show that these tech-facilitated practices are actually having the intended effect. Even if they magically solved drug trafficking forever, could any result truly justify the vast harm being inflicted upon incarcerated people, their families, and their friends? Physical mail and visitation are necessary lifelines and psychological boosts for those who might otherwise have nothing and no one to hold onto during an unimaginably difficult time of their lives.

Do I really have to explain the benefit of parents and children exchanging homework, letters, and pictures?

I'm angry about this on so many levels. If you are, too, here's some stuff we can do to ~~fight~~ work against this together:

Support prison abolition with your time, money, and/or IT superpowers. Forced prison labor is slavery. The entire punitive model is cruel, biased, and far less effective than approaches like restorative and community-based justice. Moving on is long overdue and the best way to make all of this stop.
Avoid working for companies that facilitate these practices. Tell your friends not to work for them, either. If you're stuck working for them for survival's sake, look for ways to enact positive change from the inside.
Spread the word of what's happening. Most people have no idea. Use your knowledge to educate technical and non-technical folks. They might want to do something about this, too.
Write to incarcerated people yourself. Like Bob Ross said, "Everybody needs a friend." Knowing there's someone in your corner who cares about you makes all the difference in the world. Sites like WriteAPrisoner.com will match you up with a pen pal.

A drop of water seems harmless, but get enough of those together and you carve out the Grand Canyon. If we all do something to help, however big or small, our massed effort becomes something powerful. As tech professionals, we are especially empowered to push back on these cruel and abusive practices. We must act now, before they move out of prisons and into mainstream society.

Do you want your post office to start doing this?

Sources:

Why Justice Systems Don't Always Deliver

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.

CodeSOD: A Type of Type Safety

Remy Porter — Mon, 12 Oct 2026 06:30:00 GMT

For some godawful reason, people like to explain object oriented concepts via analogy to biological taxonomies. I suppose it's easy to understand an "is-a" relationship (a cat is a mammal), but the down side is you get a complex and increasingly leaky analogy that over-emphasizes the importance of inheritance.

That's not to slight Alan's choice of using it to anoymize today's code. It's just a broad frustration on my part.

In any case, Alan has been working in a C++ codebase that's written by people who maybe don't fully understand all the key object oriented concepts. That's why you get code like this:

    /*
     * If possible, steal tentacle from the given animal.
     */
    void Animal::StealTentacle(Animal *animal) {
        // only Octopus and Squid can have tentacles
        if (!IS_INSTANCE_OF(this, Octopus) && !IS_INSTANCE_OF(this, Squid)) {
            return;
        }

        Limb *limb = animal->mLimbs->GetFirstTentacle();
        if (limb) {
            limb->AttachToAnimal(this);
            // . . .

This function takes a raw pointer to an Animal object. If that pointer is not an Octopus or a Squid, we bail. Otherwise, we're going to take its tentacle, and do stuff with it.

Now, this is a pretty clear example of the type switch anti-pattern. Instead of using the type system and polymorphism to enforce restrictions, we instead do runtime type checks.

But wait a second, what's going on in that IS_INSTANCE_OF?

    // I've noticed that dynamic_cast always returns a valid result when
    // casting an "objectPointer" of type "className".
    // Try casting it to a [Organism *] to force it to work. (?)
    #define IS_INSTANCE_OF(objectPointer, className)    ((bool) (dynamic_cast<className *>(((Organism *) objectPointer)) != NULL))
    #define IS_MEMBER_OF(objectPointer, className)      IS_INSTANCE_OF(objectPointer, className)    // temporary macro alias

This code attempts to take an objectPointer and first, force it into a pointer to our base type (Organism), using a C-style cast. Now, in C++, C-style casts are a shorthand, and the compiler will, based on the context, attempt to do the best cast which fits the situation, starting with a const_cast (which only alters the constness of the type), and failing all the way up to a reinterpret_cast- which just ignores type information entirely and assumes you know what you're doing.

Which this developer clearly doesn't.

In any case, we pass the C-style cast result into the dynamic_cast function, which attempts to cast that pointer into an instance of className. If no such conversion is possible (because they're not part of the same inheritance hiercharcy), it returns NULL, which is what they're checking.

Their comment highlights their misunderstanding of the function; dynamic_cast can be used to crosscast. In other words, dynamic_cast<Dog*>(my_cat) will actually work, because (in this example) Dog* and Cat* share a common base.

From the docs:

Otherwise, if expression points/refers to a public base class subobject of the most derived object, and the type of the most derived object has an unambiguous and public base class of type Target, the result points/refers to the Target subobject of the most derived object. In other words, dynamic_cast can be used to crosscast (or side-cast) pointers/references, between two types derived from the same base.

You shouldn't be using dynamic cast to solve this problem. Hell, you sohuldn't be doing any of this in the first place!

In any case, in actual usage, the developers responsible do stuff like this:

    if (IS_INSTANCE_OF(animal, Felid)) {
        Felid *cat = (Felid *) animal; // Yes another C-style cast - this time (hopefully) devolving to the same dynamic_cast hidden inside the expansion of the previous macro.

I love when a comment says "hopefully". "This hopefully does what I think it should do".

I'll let Alan summarize the problems:

Used prudently, the dynamic dispatch facility that object oriented languages provide their users can be a valuable tool for capturing the domain model in clean, elegant code. However, as even C++'s designer Bjarne Stroustrup acknowledged, in "The Design and Evolution of C++", the introduction of support for Run-Time Type Information makes it possible to spurn such assistance and write RTTI-based code for which a verdict of "combines the syntactic elegance of C with the run-time efficiency of Smalltalk" is just "too kind".