At my job, we have an error code that is similar to this. On the frontend, it's just like error 123.
But in our internal error logs, it's because the user submitted their credit card, didnt fully confirm, press back, removed all the items out of their cart, removed their credit card, then found their way back to the submit button through the browser history and attempted to submit without a card or a cart. Nothing would submit and no error was shown, but it was UI error.
It's super convoluted. And we absolutely wanted to shoot the tester who gave us this use case.
Better the tester than a user.
Whats the difference?
As of now, I consider you an enemy
Are you from microsoft?
Being prepared for the eventuality, knowing the consequences and deciding what to do about it before it happens for a user.
Different mindset. A user doesn't want to find bugs but get shit done.
I'd argue that is maybe 95% of the time. People get bored.
Brand reputation?
Users are dumb, testers are assholes.
Sometimes testers are also dumb. Most times.
And we absolutely wanted to shoot the tester who gave us this use case.
Why? Because he tested well and broke the software? A user changing their mind during a guided activity absolutely is a valid use case.
I think they meant shoot in like a friendly way. You know, happiness bullets!
Oh, THAT's what "friendly fire" means!
hey that tickles!
Like how I always say to my friends, "Look at me again and I will fucking murder you and rape your family dog".. it's just in good fun.
It's likely a difference of emotion compared to logic. Emotionally they'd think "Damn it, now we need to check for such a weird specific edge-case, this is so annoying" while logically knowing it's better the tester caught it.
Give that tester a raise bro
This makes want to become a tester. It scratches my evil itch just the way I like it.
there's three qualifications to being a testor:
Finding stupid ways to break shit, Being able to accurately explain how you broke shit, and being likeable enough that breaking their shit doesn't make the devs angry.
Being able to accurately explain how you broke shit
This is the most important part. Or look at systems like SpiffingBrit and Josh (Let's Game it Out) look at games
Josh does mostly stress testing though
That too, but also lots of glitching through walls and, most importantly, "doing everything as wrong as possible"
Don’t shoot the tester shoot whoever wrote the code (or the framework / library) that got you into this situation in the first place.
If that broke the software it sounds like you have a very good tester.
What about the test case where I’m using the browser’s dev tools to re-send http requests in random orders?
What the user was doing is that they don't trust that the system truly deleted the account, and they worry it was just deactivated (while claiming it was "deleted"). So they tried to do a password recovery which often reactivates a falsely "deleted" account.
I've done this before and had to message the company and have them confirm the account is entirely deleted.
Many services have a grace period. Mostly it's 30-90 days where they keep your data, just in case somebody else decided to delete your account or you were drunk or something. But it could also be for legal reasons, like websites where you can post stuff for everybody to see, in case you post something highly illegal and the authorities need to find you. Another example is where a webshop is required to keep a copy of your data for their bookkeeping.
But it could also be for legal reasons, like websites where you can post stuff for everybody to see, in case you post something highly illegal and the authorities need to find you. Another example is where a webshop is required to keep a copy of your data for their bookkeeping.
None of these require your account to "exist". There could simply be an acknowledgement stating those reasons with "after X days the data will be deleted, and xyz will be archived for legal reasons".
Mostly it's 30-90 days where they keep your data, just in case somebody else decided to delete your account or you were drunk or something
This is the only valid reason. But even then this could be stated so that the user is fully aware. Then an email one week and another one day before deletion as a reminder, and a final confirmation after the fact. I've used services before that do this. It's done well and appreciated.
This pseudo-deletion shadow account stuff is annoying.
None of these require your account to “exist”.
It's actually much more technical than theoretical. When you delete an account on a website, that is being kept for a little while longer, it merely has field in the database that gets updated. (often with a removal date as well for the automatic removal after x amount of days). This field needs to be checked everywhere the account is used. And account recovery is mostly a part where this is forgotten, or possibly not even wanted.
And to claim this as fact, I just realized that the website I work on allows recovering of banned accounts. (Removed accounts are completely removed though because we don't need to retain any data).
This is the only valid reason. But even then this could be stated so that the user is fully aware.
Keeping the records for a little while longer is actually implied to be known. It's in their privacy policy, and is legal.
Whether or not services should make this easier to know exactly what is happening I definitely agree. Personally I think post history without user identifiable data should also be removed, but this is even less common practice (and is why tools exist to delete all your reddit posts for example).
This field needs to be checked everywhere the account is used.
Usually something like this would be enforced once in a centralized location (in the data layer / domain model), rather than at every call site.
for the automatic removal after x amount of days
This gets tricky because in many jurisdictions, you need to ensure that you don't just delete the user, but also any data associated with the user (data they created, data collected about them, data provided by third-parties, etc). The fan-out logic can get pretty complex :)
Usually something like this would be enforced once in a centralized location (in the data layer / domain model), rather than at every call site.
True. Although not every endpoint is the same, nor is every website or service.
This gets tricky because in many jurisdictions, you need to ensure that you don’t just delete the user, but also any data associated with the user
GDPR specifically mentions user identifiable data. I don't know about others.
When you’re the reason error log messages are created…
Hoh man what a journey. And I love that this incredibly complex situation is the only reason that status would return. What a fun time debugging that would have been
The type of error where you have to give up trying to understand the user.
It's quite simple actually: The user wanted to delete their account, but forgot their password so they requested a password reset. Before the password reset email was delivered, the user remembered their password and deleted their account. The password reset email is finally delivered and apparently some email clients open all the links in the background for whatever reason, so it wasn't actually the user who clicked the password reset link.
apparently some email clients open all the links in the background for whatever reason
What? Really??
Yes, e.g. outlook replaces links in mails so they can scan the site first. Also some virusscanners offer nail protection, checking the site that's linked to first, before allowing the mail to end up in the user's mail client.
Thats why you never take actions on a GET request, but require a form with button for the user to do a POST.
It can be worse, we had to add a captcha for those link scanners cause they'd submit the forms and invalidate tokens too:(
Wow. That sounds terrible. Good to know.
e.g. outlook replaces links in mails so they can scan the site first. Also some virusscanners offer nail protection, checking the site that’s linked to first, before allowing the mail to end up in the user’s mail client.
Proofpoint does this too, but AFAIK they all just change the link rather than go to it. The link is checked when the user actually clicks on it. Makes sense to do it on-demand because the contents of the link can change between when the email is received and when the user actually clicks it.
Yep. Apparently outlook does this and afaik because some kind of link sniffing/scam detection/whatever, but it does it by changing the first characters of each query argument around.
We spent amazingly long time figuring that one out. "Who the hell has gotten Microsoft service querying our app with malformed query args and why"
Not really the only reason. It would be better to just return "token invalid".
It could occur by someone messing with the URL from the reset password email, like accidently adding an extra character before pressing enter
Or a poor email client that wraps the URL and doesn't send the complete one when clicked.
Or someone attempting to find a weakness in the reset password system and sending junk as the token.
Or an email client where you double click the link text to select it and press copy, and somehow this puts the link plus a trailing space in the clipboard to be pasted into a browser.
Yeah that error status code seems like an odd way to reflect such a scenario.
Trying this every time I need to delete an account
Immediately sue them for DSGVO GDPR
(DSGVO is the German version of GDPR)
Knew something felt of
I might be the one hitting that link just to see what happens.
"Let's see how good their testers are."
Now the dev doesn't need to comment this part of the code, saves him time.
Day 492 of predicting edge cases…
You mean odor?
Sorry typo
Man, actually seeing this in a wild log would make my day.
I can tell by the error msg this wasn't an error before and was the cause of much grief
whats wild is that all the returned values were the same this is only for a log value that probably zero people check
I believe rule of thumb is to track/log at least one level deeper than what you show to the end user, to ease with troubleshooting and debugging.
Beyond that, logs are only useless until they aren't, and then if you don't have them you're in for a universe of pain.
How’d they know it was a he
Maybe there's a specific person who keeps doing this and they wrote this error specifically for him.
Come on Dave sort yourself out.
You know this is a porn site then! 😂
You bitwise OR into the higher end bits the user id, in which you have already encoded the user’s gender. (For which you have a util method to extract. )
What the hell kind of second-rate DBMS doesn't encode gender into its primary keys SMDH!!
Don't be silly; it's obvious that there are different error messages for each gender expression. Error logs need to be detailed and specific in order to be useful.
In case you're serious, not everyone is a native speaker.
I like seeing instances where people have used "she" as the generic pronoun.
They were talking about me. They got my pronouns wrong. It's ok though, because they will have many more opportunities to get it right.
PEBKAC.
definitely a case of the PEBKAC
Is that python? If it's, thank you, finally learned how to format text in a way that can be read on the script and in the execution.
It isn't, there are curly braces. It's TypeScript.
Python also have curly bracers, om dictionaries.
Yes, but not for indentation (which is obviously what I meant)
As the other comments have already said it's not Python. Not sure what you mean with text formatting, do you mean that it's multiple strings that are concatenated using +? You don't need the + in Python, you can do
some_function(
"part one of really long string"
" part two of really long string"
)
Which is identical to
some_function("part one of really long string part two of really long string")
Looks like TypeScript to me
No, but you can do the same in python
I was thinking on trying it. Need to see how it works with f formatting.
At my job, we have an error code that is similar to this. On the frontend, it's just like error 123.
But in our internal error logs, it's because the user submitted their credit card, didnt fully confirm, press back, removed all the items out of their cart, removed their credit card, then found their way back to the submit button through the browser history and attempted to submit without a card or a cart. Nothing would submit and no error was shown, but it was UI error.
It's super convoluted. And we absolutely wanted to shoot the tester who gave us this use case.
Better the tester than a user.
Whats the difference?
As of now, I consider you an enemy
Are you from microsoft?
Being prepared for the eventuality, knowing the consequences and deciding what to do about it before it happens for a user.
Different mindset. A user doesn't want to find bugs but get shit done.
I'd argue that is maybe 95% of the time. People get bored.
Brand reputation?
Users are dumb, testers are assholes.
Sometimes testers are also dumb. Most times.
Why? Because he tested well and broke the software? A user changing their mind during a guided activity absolutely is a valid use case.
I think they meant shoot in like a friendly way. You know, happiness bullets!
Oh, THAT's what "friendly fire" means!
hey that tickles!
Like how I always say to my friends, "Look at me again and I will fucking murder you and rape your family dog".. it's just in good fun.
It's likely a difference of emotion compared to logic. Emotionally they'd think "Damn it, now we need to check for such a weird specific edge-case, this is so annoying" while logically knowing it's better the tester caught it.
Give that tester a raise bro
This makes want to become a tester. It scratches my evil itch just the way I like it.
there's three qualifications to being a testor:
Finding stupid ways to break shit, Being able to accurately explain how you broke shit, and being likeable enough that breaking their shit doesn't make the devs angry.
This is the most important part. Or look at systems like SpiffingBrit and Josh (Let's Game it Out) look at games
Josh does mostly stress testing though
That too, but also lots of glitching through walls and, most importantly, "doing everything as wrong as possible"
Don’t shoot the tester shoot whoever wrote the code (or the framework / library) that got you into this situation in the first place.
If that broke the software it sounds like you have a very good tester.
What about the test case where I’m using the browser’s dev tools to re-send http requests in random orders?
What the user was doing is that they don't trust that the system truly deleted the account, and they worry it was just deactivated (while claiming it was "deleted"). So they tried to do a password recovery which often reactivates a falsely "deleted" account.
I've done this before and had to message the company and have them confirm the account is entirely deleted.
Many services have a grace period. Mostly it's 30-90 days where they keep your data, just in case somebody else decided to delete your account or you were drunk or something. But it could also be for legal reasons, like websites where you can post stuff for everybody to see, in case you post something highly illegal and the authorities need to find you. Another example is where a webshop is required to keep a copy of your data for their bookkeeping.
None of these require your account to "exist". There could simply be an acknowledgement stating those reasons with "after X days the data will be deleted, and xyz will be archived for legal reasons".
This is the only valid reason. But even then this could be stated so that the user is fully aware. Then an email one week and another one day before deletion as a reminder, and a final confirmation after the fact. I've used services before that do this. It's done well and appreciated.
This pseudo-deletion shadow account stuff is annoying.
It's actually much more technical than theoretical. When you delete an account on a website, that is being kept for a little while longer, it merely has field in the database that gets updated. (often with a removal date as well for the automatic removal after x amount of days). This field needs to be checked everywhere the account is used. And account recovery is mostly a part where this is forgotten, or possibly not even wanted.
And to claim this as fact, I just realized that the website I work on allows recovering of banned accounts. (Removed accounts are completely removed though because we don't need to retain any data).
Keeping the records for a little while longer is actually implied to be known. It's in their privacy policy, and is legal.
Whether or not services should make this easier to know exactly what is happening I definitely agree. Personally I think post history without user identifiable data should also be removed, but this is even less common practice (and is why tools exist to delete all your reddit posts for example).
Usually something like this would be enforced once in a centralized location (in the data layer / domain model), rather than at every call site.
This gets tricky because in many jurisdictions, you need to ensure that you don't just delete the user, but also any data associated with the user (data they created, data collected about them, data provided by third-parties, etc). The fan-out logic can get pretty complex :)
True. Although not every endpoint is the same, nor is every website or service.
GDPR specifically mentions user identifiable data. I don't know about others.
When you’re the reason error log messages are created…
Hoh man what a journey. And I love that this incredibly complex situation is the only reason that status would return. What a fun time debugging that would have been
The type of error where you have to give up trying to understand the user.
It's quite simple actually: The user wanted to delete their account, but forgot their password so they requested a password reset. Before the password reset email was delivered, the user remembered their password and deleted their account. The password reset email is finally delivered and apparently some email clients open all the links in the background for whatever reason, so it wasn't actually the user who clicked the password reset link.
What? Really??
Yes, e.g. outlook replaces links in mails so they can scan the site first. Also some virusscanners offer nail protection, checking the site that's linked to first, before allowing the mail to end up in the user's mail client.
Thats why you never take actions on a GET request, but require a form with button for the user to do a POST.
It can be worse, we had to add a captcha for those link scanners cause they'd submit the forms and invalidate tokens too:(
Wow. That sounds terrible. Good to know.
Proofpoint does this too, but AFAIK they all just change the link rather than go to it. The link is checked when the user actually clicks on it. Makes sense to do it on-demand because the contents of the link can change between when the email is received and when the user actually clicks it.
Yep. Apparently outlook does this and afaik because some kind of link sniffing/scam detection/whatever, but it does it by changing the first characters of each query argument around.
We spent amazingly long time figuring that one out. "Who the hell has gotten Microsoft service querying our app with malformed query args and why"
Not really the only reason. It would be better to just return "token invalid".
It could occur by someone messing with the URL from the reset password email, like accidently adding an extra character before pressing enter
Or a poor email client that wraps the URL and doesn't send the complete one when clicked.
Or someone attempting to find a weakness in the reset password system and sending junk as the token.
Or an email client where you double click the link text to select it and press copy, and somehow this puts the link plus a trailing space in the clipboard to be pasted into a browser.
Yeah that error status code seems like an odd way to reflect such a scenario.
Trying this every time I need to delete an account
Immediately sue them for
DSGVOGDPR(DSGVO is the German version of GDPR)
Knew something felt of
I might be the one hitting that link just to see what happens.
"Let's see how good their testers are."
Now the dev doesn't need to comment this part of the code, saves him time.
Day 492 of predicting edge cases…
You mean odor?
Sorry typo
Man, actually seeing this in a wild log would make my day.
I can tell by the error msg this wasn't an error before and was the cause of much grief
whats wild is that all the returned values were the same this is only for a log value that probably zero people check
I believe rule of thumb is to track/log at least one level deeper than what you show to the end user, to ease with troubleshooting and debugging.
Beyond that, logs are only useless until they aren't, and then if you don't have them you're in for a universe of pain.
How’d they know it was a he
Maybe there's a specific person who keeps doing this and they wrote this error specifically for him.
Come on Dave sort yourself out.
You know this is a porn site then! 😂
You bitwise OR into the higher end bits the user id, in which you have already encoded the user’s gender. (For which you have a util method to extract. )
What the hell kind of second-rate DBMS doesn't encode gender into its primary keys SMDH!!
Don't be silly; it's obvious that there are different error messages for each gender expression. Error logs need to be detailed and specific in order to be useful.
In case you're serious, not everyone is a native speaker.
I like seeing instances where people have used "she" as the generic pronoun.
They were talking about me. They got my pronouns wrong. It's ok though, because they will have many more opportunities to get it right.
PEBKAC.
definitely a case of the PEBKAC
Is that python? If it's, thank you, finally learned how to format text in a way that can be read on the script and in the execution.
It isn't, there are curly braces. It's TypeScript.
Python also have curly bracers, om dictionaries.
Yes, but not for indentation (which is obviously what I meant)
As the other comments have already said it's not Python. Not sure what you mean with text formatting, do you mean that it's multiple strings that are concatenated using
+? You don't need the+in Python, you can doWhich is identical to
Looks like TypeScript to me
No, but you can do the same in python
I was thinking on trying it. Need to see how it works with f formatting.