<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd"
xmlns:rawvoice="http://www.rawvoice.com/rawvoiceRssModule/"

	>
<channel>
	<title>Comments on: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone</title>
	<atom:link href="http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone</link>
	<description>Patrick McKenzie (patio11) blogs on software development, marketing, and general business topics</description>
	<lastBuildDate>Thu, 14 Jan 2016 20:48:09 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=4.1.7</generator>
	<item>
		<title>By: emma</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4318</link>
		<dc:creator><![CDATA[emma]]></dc:creator>
		<pubDate>Wed, 04 Jan 2012 23:07:01 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4318</guid>
		<description><![CDATA[You&#039;re a lifesaver - thanks for writing this up. Saved me a long night.]]></description>
		<content:encoded><![CDATA[<p>You&#8217;re a lifesaver &#8211; thanks for writing this up. Saved me a long night.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tobias</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4317</link>
		<dc:creator><![CDATA[Tobias]]></dc:creator>
		<pubDate>Thu, 08 Dec 2011 22:59:31 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4317</guid>
		<description><![CDATA[Yes, 2.3.11 was a doozy of an update. It broke my application too in precisely that way. I dread to think of the collective human hours lost because someone decided that silently deleting sessions would be a good security fix.]]></description>
		<content:encoded><![CDATA[<p>Yes, 2.3.11 was a doozy of an update. It broke my application too in precisely that way. I dread to think of the collective human hours lost because someone decided that silently deleting sessions would be a good security fix.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: robert sullivan</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4316</link>
		<dc:creator><![CDATA[robert sullivan]]></dc:creator>
		<pubDate>Thu, 24 Nov 2011 03:54:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4316</guid>
		<description><![CDATA[I was perversely hoping to read this to confirm my thoughts that, while I dislike working in Spring, I could say &quot;aha, much as Spring is an annoyance, it has a very good security layer, much more mature than Rails (does that even have security?), so I&#039;m really better off, no matter how fun and easy those rails developers are working&quot; - but I guess I can&#039;t.

&quot;instead of throwing exceptions, it would silently just clear the session and re-run the request.&quot;

I will say it is annoying when something that used to throw an exception, in this case swallows the exception, and marches on.  I guess that&#039;s considered &quot;handling&quot; the exception, but not even a warning in the log? Surely some of the blame lies in making a change like this.

An environment as close to production as possible would have helped in snaring this bug, but obviously there are limits and one could never truly replicate a prod environment, and in this case with a fairly subtle error due to timing issues.  There&#039;s a reason why Doug Lea&#039;s excellent util.concurrency was brought into Java 1.5 - concurrency is hard to get right.

This does remind me of &quot;The Cuckoo&#039;s Egg&quot;, about an astronomer that notices a 2 cent difference between the standard Unix (BSD in this case) accounting program, and a custom accounting program, written to provide a little extra functionality that the standard tool did not provide.  Long story short, it put the author (Clifford Stoll) on the trail of same hackers who gained access into the Lawrence Livermore Lab (Hagbard?).  Fascinating story, there are clips on YouTube, including Cliff&#039;s story, and a movie about the Germans (one of the guys apparently committed suicide but the circumstances were strange.  Movie is in German but might have subtitles?)  Anyway - all because this crazy astronomer wanted to figure out why there was a 2 cent difference in his accounting programs!]]></description>
		<content:encoded><![CDATA[<p>I was perversely hoping to read this to confirm my thoughts that, while I dislike working in Spring, I could say &#8220;aha, much as Spring is an annoyance, it has a very good security layer, much more mature than Rails (does that even have security?), so I&#8217;m really better off, no matter how fun and easy those rails developers are working&#8221; &#8211; but I guess I can&#8217;t.</p>
<p>&#8220;instead of throwing exceptions, it would silently just clear the session and re-run the request.&#8221;</p>
<p>I will say it is annoying when something that used to throw an exception, in this case swallows the exception, and marches on.  I guess that&#8217;s considered &#8220;handling&#8221; the exception, but not even a warning in the log? Surely some of the blame lies in making a change like this.</p>
<p>An environment as close to production as possible would have helped in snaring this bug, but obviously there are limits and one could never truly replicate a prod environment, and in this case with a fairly subtle error due to timing issues.  There&#8217;s a reason why Doug Lea&#8217;s excellent util.concurrency was brought into Java 1.5 &#8211; concurrency is hard to get right.</p>
<p>This does remind me of &#8220;The Cuckoo&#8217;s Egg&#8221;, about an astronomer that notices a 2 cent difference between the standard Unix (BSD in this case) accounting program, and a custom accounting program, written to provide a little extra functionality that the standard tool did not provide.  Long story short, it put the author (Clifford Stoll) on the trail of same hackers who gained access into the Lawrence Livermore Lab (Hagbard?).  Fascinating story, there are clips on YouTube, including Cliff&#8217;s story, and a movie about the Germans (one of the guys apparently committed suicide but the circumstances were strange.  Movie is in German but might have subtitles?)  Anyway &#8211; all because this crazy astronomer wanted to figure out why there was a 2 cent difference in his accounting programs!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Sleen</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4315</link>
		<dc:creator><![CDATA[Sleen]]></dc:creator>
		<pubDate>Wed, 23 Nov 2011 07:46:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4315</guid>
		<description><![CDATA[Excellent read.  I am inspired now to go write some code.  Thank you for that.  I will gladly share a water cooler with you.]]></description>
		<content:encoded><![CDATA[<p>Excellent read.  I am inspired now to go write some code.  Thank you for that.  I will gladly share a water cooler with you.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Be a Paranoid Pessimistic Programmer &#124; GrokCode</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4314</link>
		<dc:creator><![CDATA[Be a Paranoid Pessimistic Programmer &#124; GrokCode]]></dc:creator>
		<pubDate>Tue, 22 Nov 2011 06:06:37 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4314</guid>
		<description><![CDATA[[...] less prone to bugs.Libraries are updated, frameworks evolve, requirements change. Programmers are constantly fighting against entropy. Defensive programming guards against the effects of software entropy by reducing the possibility [...]]]></description>
		<content:encoded><![CDATA[<p>[&#8230;] less prone to bugs.Libraries are updated, frameworks evolve, requirements change. Programmers are constantly fighting against entropy. Defensive programming guards against the effects of software entropy by reducing the possibility [&#8230;]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tony Mechelynck</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4313</link>
		<dc:creator><![CDATA[Tony Mechelynck]]></dc:creator>
		<pubDate>Sun, 20 Nov 2011 21:29:48 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4313</guid>
		<description><![CDATA[Yes, I read it like a whodunit.

I think Mike Ferrier has the right nothion: &quot;it reminds you of what you did in the past&quot;.

Once upon a time (30 or 40 years ago), I used to be working in COBOL and assembly language on a 128 KiB mainframe, and someday the machine started halting erratically with invalid operation codes in the resident monitor (the kernel, for you young&#039;uns). After delving deep enough in the code (yes, we had the mainframe&#039;s full OS source in those times, and searching around, even in assembly-language source — C didn&#039;t exist yet — isn&#039;t so hard when you have written down the IP) I found out that two instructions had been written in the wrong sequence, causing an invalid operation code halt in privileged code (so that a &quot;privileged operation code&quot; /exception/ wouldn&#039;t be triggered) if an external interrupt (such as the end of a tape block read, or maybe an interval-timer interrupt) happened while handling an internal interrupt (such as authorizing a certain specific privileged opcode which had been encountered in a usermode program). So I swapped these two instructions in the relevant system macro, recompiled and reinstalled the OS over a weekend, and submitted a software report (by snail mail, of course: no Internet back then). I still remember the exhilaration when the software notice came back, telling me my &quot;temporary solution&quot; had been found equivalent to the official fix.]]></description>
		<content:encoded><![CDATA[<p>Yes, I read it like a whodunit.</p>
<p>I think Mike Ferrier has the right nothion: &#8220;it reminds you of what you did in the past&#8221;.</p>
<p>Once upon a time (30 or 40 years ago), I used to be working in COBOL and assembly language on a 128 KiB mainframe, and someday the machine started halting erratically with invalid operation codes in the resident monitor (the kernel, for you young&#8217;uns). After delving deep enough in the code (yes, we had the mainframe&#8217;s full OS source in those times, and searching around, even in assembly-language source — C didn&#8217;t exist yet — isn&#8217;t so hard when you have written down the IP) I found out that two instructions had been written in the wrong sequence, causing an invalid operation code halt in privileged code (so that a &#8220;privileged operation code&#8221; /exception/ wouldn&#8217;t be triggered) if an external interrupt (such as the end of a tape block read, or maybe an interval-timer interrupt) happened while handling an internal interrupt (such as authorizing a certain specific privileged opcode which had been encountered in a usermode program). So I swapped these two instructions in the relevant system macro, recompiled and reinstalled the OS over a weekend, and submitted a software report (by snail mail, of course: no Internet back then). I still remember the exhilaration when the software notice came back, telling me my &#8220;temporary solution&#8221; had been found equivalent to the official fix.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Pete</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4312</link>
		<dc:creator><![CDATA[Pete]]></dc:creator>
		<pubDate>Sun, 20 Nov 2011 05:11:35 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4312</guid>
		<description><![CDATA[Hi Patrick - minor note, I think that everywhere you used the word &quot;pervasively&quot;, you probably meant &quot;persistently&quot;.

A bug might be considered &quot;pervasive&quot; if it showed up in every part of your application (or was visible in many different parts of your source code) - while &quot;persistent&quot; would be for something that keeps on happening (even if, as in this case, it keeps happening only 1% of the time).

A bug that&#039;s pervasive would probably also be persistent, but not necessarily vice-versa. :)]]></description>
		<content:encoded><![CDATA[<p>Hi Patrick &#8211; minor note, I think that everywhere you used the word &#8220;pervasively&#8221;, you probably meant &#8220;persistently&#8221;.</p>
<p>A bug might be considered &#8220;pervasive&#8221; if it showed up in every part of your application (or was visible in many different parts of your source code) &#8211; while &#8220;persistent&#8221; would be for something that keeps on happening (even if, as in this case, it keeps happening only 1% of the time).</p>
<p>A bug that&#8217;s pervasive would probably also be persistent, but not necessarily vice-versa. :)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Vadim P.</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4311</link>
		<dc:creator><![CDATA[Vadim P.]]></dc:creator>
		<pubDate>Sun, 20 Nov 2011 05:10:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4311</guid>
		<description><![CDATA[Great read, thanks!]]></description>
		<content:encoded><![CDATA[<p>Great read, thanks!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Howard</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4310</link>
		<dc:creator><![CDATA[Howard]]></dc:creator>
		<pubDate>Sun, 20 Nov 2011 03:07:09 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4310</guid>
		<description><![CDATA[Great story, Patrick! I once had to deal with deadblock in a multithreading Ruby script. I was actually just using EventMachine, and spinning workers to do tasks. It turned out that there was a race condition in the postgres C extension.

That&#039;s day I swore never to use Thread in Ruby again. Now whenever I need concurrency, I just spin out processes. Redis is my hammer.]]></description>
		<content:encoded><![CDATA[<p>Great story, Patrick! I once had to deal with deadblock in a multithreading Ruby script. I was actually just using EventMachine, and spinning workers to do tasks. It turned out that there was a race condition in the postgres C extension.</p>
<p>That&#8217;s day I swore never to use Thread in Ruby again. Now whenever I need concurrency, I just spin out processes. Redis is my hammer.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: lolaturfaec</title>
		<link>http://www.kalzumeus.com/2011/11/17/i-saw-an-extremely-subtle-bug-today-and-i-just-have-to-tell-someone/#comment-4309</link>
		<dc:creator><![CDATA[lolaturfaec]]></dc:creator>
		<pubDate>Sat, 19 Nov 2011 14:12:52 +0000</pubDate>
		<guid isPermaLink="false">http://www.kalzumeus.com/?p=1269#comment-4309</guid>
		<description><![CDATA[lol ur stupid]]></description>
		<content:encoded><![CDATA[<p>lol ur stupid</p>
]]></content:encoded>
	</item>
</channel>
</rss>
