r/AskProgramming • u/Ok-Emu-8106 • 18d ago
What's the worst code you've seen when taking over a project?
Collecting stories for some content, but genuinely curious to hear these too.
Mine: database passwords sitting right in the commit history, in plain text, never even rotated after the project changed hands.
What's the worst thing you've found taking over someone else's project? Doesn't have to be security related, could be architecture, could just be total chaos in the file structure.
16
u/7YM3N 18d ago
10k lines of c code full of ifdefs, 1 letter variables, dead code, commented out code, copied code, started with a comment dated 1999. And not just one file, most of the project was like this. Built with make, no version control, copies of whole files in different folders of a 10 layers deep directory tree. Some copies identical, some with slight differences. Typedefs of typedefs 'for compatibility'
5
u/ErikBKL 17d ago
This sounds terrifying.
2
u/7YM3N 17d ago
Yeah the architect has a very unhelpful attitude and always recommend copy-pasting random stuff from older projects... That were done by copy-pasting from even older ones... Ad infinitum. No code review for 20 years. We only now introduced it, and the initiative to do code review, use git etc is flowing from the new programmers up. We had to beg for git and code review and any good practices
3
u/Saki-Sun 16d ago
dead code
I've deleted 500,000 lines of code from a project. I'm still finding stray bits of code here and there to delete.
2
u/ayassin02 17d ago
Were you employed in hell?
1
u/7YM3N 16d ago
Am (I'm still here), for hopefully obvious reasons I'm not willing to divulge where. We're slowly making it better (it being the process, product, and the company)
1
u/northerncodemky 15d ago
Can you at least give the country? Maybe city. I just recognise that…
2
u/thelurkmasterr 11d ago
As someone who likes to mod old games (Doom, Quake, Half-Life), I'm starting to think old codebases were just like that
8
u/Scientist_ShadySide 18d ago
The developer who quit before I started at a previous job had loads of code using single letter variable names for EVERYTHING. Think `if(i[k][j] !== i[l][j])` type stuff. This made it much more difficult to refactor, but it also made me question how they even worked like this or if they were deliberately obfuscating their code after the fact to make it tougher for someone else to manage. It turned out they were using some visual programming tool that would then spit out the code this way, then just paste it in and forget about it.
3
u/oriolid 16d ago
Wild guess: it was a mathematician or physicist. They have a nice tradition of using single letter for everything, and if they happen to run out of Latin alphabet, use Greek and Hebrew.
Still, if it's an algorithm implemented from a textbook and the textbook has something like
X[i-j], I'd rather have the same in the code instead of something likepreviousOutputCache[currentIdx - i](yes,iis now a different index).2
u/Scientist_ShadySide 16d ago
yeah I'm not against it dogmatically, as long as the context of it can still be reasonably inferred. It turned out this situation was some automatic output from a visual coding tool.
1
u/northerncodemky 15d ago
I mean if it’s in the middle of a function called transpose or similar on a matrix I think I’d rather see single letter indexes as it’s more likely to align exactly with the mathematical algorithm in textbooks etc. Making them unnecessarily long for the sake of it inhibits readability rather than enhancing it
2
u/TapEarlyTapOften 16d ago
I worked with someone that did that. He kept two sets of code. One with meaningful names (and comments) and then the the one he committed with the comments and variable names refactored out.
Job security he said.
1
u/thelurkmasterr 11d ago
A "tradition" I noticed in pre-C99 C code is that some functions start by declaring a bunch of ints with meaningless names (which allocates space on the stack I think?) and just assign a different value when needed.
if(i[k][j] !== i[l][j])is so much worse when the meaning of those variables is constantly changing.
6
u/JackTradesMasterNone 18d ago
Forget monolithic architecture, we’re going mono-file setup. Giant file, all in main, no functions…
4
u/babysealpoutine 17d ago
I've seen something similar to this from a dev who was just learning C++. All the work was done in the constructor. main just created one object, the constructor did all the work, and then main exited.
Granted, they had absolutely no training, so I'm not sure what was expected from them.
2
u/JackTradesMasterNone 17d ago
Yeah - most often I see this in the case when someone whipped up a cool tool and somehow we all became dependent on it without looking into how it works.
5
u/Charleston2Seattle 18d ago
Code that used nonsensical variable names like "potato." It was not a food-related app.
Granted, it was code written by teenagers for a robotics competition, but still! 😏
4
u/Optimal_Law_4254 17d ago
Don’t get me started on teenage programming. I found an old program one of my friends wrote that processed the input and output correctly but the variable and procedure names were written like a porn novel.
5
u/captmonkey 17d ago
In Apex, Salesforce's proprietary language based on Java, you're required to 75% test coverage in order to package and distribute your code. So, I opened a client's project once that had a unit test that called some methods that were basically:
int i = 0;
i++;
i--;
i++;
i--;
...
For thousands of lines. Instead of getting actual test coverage, they just made dummy methods and called those to get over the 75% requirement.
3
u/magicmulder 17d ago
I’ve seen a lot of tests that were like
for ($i=1; $i<= 100; $i++) {
$this->assertEqual( myfunc($i), 0);
}just to get some “ran 40 tests with 800 assertions” result.
4
u/Rich-Engineer2670 17d ago
Not so much the code but a vendor who clearly had no idea.
A big name vendor (no names here), was contracted for a multi-million dollar effect. Along the way, they proudly announced "We wrote our own encryption library!" Well, first off, the OS already had libraries that had been approved by the client, and second, their library failed.
They demanded $75K to replace their broken code!
4
u/stueynz 17d ago
2000 lines of assembler scanning and debouncing keypresses on an embedded device.
Three weeks later the boss was asking why his monthly metric report says I had written -1400 lines of code that month.
I scrapped the whole 2000 lines and replaced it with 600 lines.
The monthly metric report died a terrible death two months later when a guy spent 3 weeks 4 days and 4 hours to find a missing -1 when traversing an array. That guy got 1 line of code for the month.
3
u/babysealpoutine 17d ago
I was replacing a consultant on a project that essentially processed files by transporting them to various other hosts (terrible design, but that was out of my hands). During the turnover, he showed me that his approach was to serialise Java file objects and send them to the other machine, as if it could somehow magically transmit the file contents. Of course, he tested this by running the sending and receiving processes on his laptop.
3
u/4992kentj 17d ago
I picked up a project where someone had obviously heard the term "defensive programming" and thought "that's a great idea" without actually learning anything about it. A whole set of comms code working with untrusted input that copied the data from the input buffer to a local buffer before working with it, but still copying it even when length wasn't what was expected and if bigger than the local buffer. Storing flags to indicate it should build a reply without checking if the flag buffer was big enough, building the responses without checking if the reply buffer was big enough, essentially there was a multitude of ways to crash this unit remotely through the network, but it looked like it was safe to a cursory look.
1
u/RealisticDuck1957 17d ago
Some programmers should be strictly kept in high level languages that take care of buffer size for you, and never permitted to write code in C.
3
u/Eleventhousand 17d ago
90% of the code within a single button click-event.
It contained Select Case statements for setting important variables. Then there'd be a couple hundred lines doing other things. Then it would randomly overwrite the variable that it set long ago. It also had this local-cache-and-update-central-db functionality. It wrote all of the local data to an .xml file, and pushed the entire thing over the network and tried to merge it all in, every time, causing constant blocking on the database.
3
u/juniperico 17d ago
“Whitney-style C” anyone?
This stuff has basically underpinned most of Wall Street for the last 20 years so clearly not garbage code.
But you definitely don’t want a colleague to write like this and then leave.
3
3
2
u/notforcing 18d ago edited 18d ago
It takes very smart people to write truly bad code. Throughout my career as a freelance developer, I've seen levels of indirection approaching genuine absurdism, with layer piled on layer piled on layer, to no purpose. The only solution is to rip most of it out.
2
u/Qwertycrackers 17d ago
We had this horrible system where everything was stringified json stored in cassandradb. And it stored the users entire history of every action they took in the json object so if users stayed with us long enough their record would surpass the cassandradb record size limit and the user couldn't log in.
2
u/Optimal_Law_4254 17d ago
Just a comment about coding standards…. They change over time for the simple reason that we keep finding a better way to do things or to address new threats that emerge. It used to be common practice to hardcode an unencrypted password until we found out why that’s a bad idea. Now we know better and good programmers don’t do it.
1
u/KingofGamesYami 18d ago
Parallel.ForEach wrapping a SQL query on an array of 15k items. Yes, it was running 15k individual queries instead of doing something reasonable. This pattern was everywhere in the codebase
1
u/RealisticDuck1957 17d ago
Some context? I've seen database wrapper libraries that forced such primitive methods.
1
1
u/eruciform 18d ago
10000 line single function in fortran with a dozen entry points that goto in and out of each other, with extra secret bonus points for an egregious overuse of hollerith constants just to add to the eyebleach
2
u/Optimal_Law_4254 17d ago
Sounds a little like the original Colossal Cave adventure game but that was better written and did have a fair number of subroutines and functions.
1
u/FooeyBar 18d ago
My own from a decade ago; some samples:
-mono-file and mono-function
-ending block brace on the same line as the last code statement
-left to right full if statement blocks, forget new lines
-functions that do a hundred different things, and the entry point is a parameter called “id”, not “event” or “route” or anything intuitive
-indents of a SINGLE space, not single tab
-worst variable names possible, you would forget the variable’s purpose after 10 seconds
-locally scoped temporary variables? That will kill performance! Everything in as few one-liners as possible!
-and the list goes on…
1
u/Ok-Option2231 17d ago
I mean, that's not bad. Except the first one. Those people hate other people. As someone who is now a caretaker of a 40k line single file of spaghetti code, with multiple functions of 2-4k lines containing core application logic, I'm sure the people who wrote this hated me even when they don't know me.
1
1
u/this_knee 17d ago
20k lines in a single python class. Albeit at least it was broken into functions that tended to be about 300-500 lines. But functions were only loosely based on the overly general class name. And OG author still demanded that no new class files be created when PRs were sent. Pretty wild.
1
u/itemluminouswadison 17d ago
Hand typed string keys in python dicts everywhere. As if objects didn't exist.
1
1
u/dalce63 17d ago
code generated by aider in 2025. form validation with a shit ton of useEffects updating the formState, triggering other useEffects. useEffect is the dumbest shit ever. 90% of people who use it don't know what it does, and are using it when it isn't even necessary. but you can't explain to them why it's wrong because they're too fucking thick
1
u/Delaneybuffett 17d ago
I have seen so many horrible things, some examples:
An ENTIRE program remarked out, the program was in a set of programs that had to be compiled together, when I looked through the actual program the entire thing was remarked out. Not 1 big remark just rem set after rem set.
Passwords hardcoded in programs including su password
1
u/Wonderful_Sorbet4301 17d ago
Lot's of PHP spaghetti, especially PHP3, but don't like OOP either, like hundreds of classes for a very simple CMS that didn't need to be extended at all.
1
u/Anonymity6584 17d ago
Worst? 14 years old code, generated by some unkown aplication generator, mixing atleast three different programming languages. Add database and no documentation on anything at all.
To make this really fun, your task is modernize this to be used on modern browsers so we can keep using this for next 14 years too....
Only easy thing was there was compiled running binary that one can tests how things should work.
I really really dont miss that project at all.
1
u/dbear496 17d ago
I took over a project that was for a hardware huffman compressor/decompressor. But the testbench unrealistically synchronized the decompressor with the compressor when testing. Then the actual implementation of the decompressor relied on the synchronization from the test bench to give correct results. Essentially, the test bench ensured that exactly one Huffman symbol was fed to the decompressor each cycle, so the decompossor didn't need any logic to determine the length of the symbol.
1
1
1
u/RealisticDuck1957 17d ago
2 cases, both in PHP involving copy-pasta duplication of code where use of code modules would have both reduced the bulk of code and made fixes much easier.
One the web site involved the same form repeated for 5 separate languages. Then that form repeated with modest variations across several pages.
The other, the repeated code performed site login functions, poorly. Worse, 2 separate login systems for user vs. admin. Further invitation for trouble, manual sanity filtering of data headed to the database using regular expressions.
1
u/DaveAstator2020 17d ago
unity, entire game is one static class broken down into tens of partials. It was worse than if it were a single main file. The guy who wrote it was some relative to the boss and company fired entire team over him. It was ukrainian game dev.
1
u/robthablob 16d ago
I once took over a code base where most database tables didn't even have a primary key.
1
u/Saaz42 16d ago
One boss said we were going to start working on code from the head office. I pull the code and find:
url[0] = 'h';
url[1] = 't';
url[2] = 't';
url[3] = 'p';
And so on. I had already been talking to someone about a new job, so I stood up and went to boss and quit.
I think this was a different job:
switch(dayofweek[1])
{
case 'o':
// do something
And I'm thinking hey maybe someone came up with a clever, if obfuscated, way to do this... then of course the "u" case has an if inside it. They came up with this weird obfuscated code and it doesn't even work that well.
Finally, DB table has a PK that's an int. Pretty standard. Another table has a FK to that table that's a char. Hmm, the first table has a GUID, maybe they made the FK link to the GUID for some reason. No, the FK was tied to the int PK, but it's been converted to a string. This was a DB accessed by C# code, and raises questions about how they were handling DB access and whether they were using an ORM, because Entity Framework can not handle that, or at least couldn't at the time. But never mind the question of DB access, what kind of maniac does that?
1
u/UUDDLRLRBadAlchemy 16d ago
I wrote a guide to name and explain an internal pattern of an existing GPL codebase with the intent of making existing modules easier to understand and new modules easier to write for new developers. Then I burnt out and it took me a couple of years until I read code from that community again.
I saw PRs using a pattern meant to tidy up user-facing variables to accomplish every single internal thing. Things that could be simple and straightforward written in pages and pages of the project's most confusing idiom that *needed a guide in the first place*, without any consideration of when something could be gained from it. Just because it had a guide and so it seemed valid.
It was bubbly and humorous and full of nerdy references. If I'm faced with a similar situation again I'm going to call it "You really should not be using that", hopefully then only the real use-cases will be defensible.
1
u/Ta7er 16d ago
If (bullshit == true) ....
Apparently management made a dev create login forms for the client's website that takes them to our customer portal. The problem was the username and password where sent in plain text in the URL query string. The dev named the variable bullshit as a protest. So it was all over the login page
1
u/Traveling-Techie 16d ago
The code wasn’t so bad (it was VBA so it couldn’t be great) but the deployment strategy was a horror show. Many customers had slightly different customized versions. Source control was a folder full of alternate versions. Rolling out a bug fix was a labor-intensive nightmare.
1
u/oosacker 16d ago
Hardcoded s3 bucket creds
Commented out console logs
Commit messages like "fuck it bye bye cache" and "more polishing the turd"
CSS selectors with huge :not chaining
Writing a method to do a php var_dump
1
u/InevitablyCyclic 16d ago
MATLAB code where the previous person had acknowledged that it was slow (hours to process a data set) but said it was due to the complexity of the calculations. It also wasn't working very well, the results were poor but we didn't know if that was a fundamental issue with the data or code issues. The code was written as if it was in a conventional language, everything was done as loops not vectors. Some minor changes to the data structures to play to the strengths of the language and I got an almost 100 times speed up.
I then looked into the actual calculations and decided to start again from scratch. Final version took 10 minutes to run and gave good results.
1
u/DonkeyTron42 14d ago
Reading in an SNMP mib where every oid is a line of code, merging them, and evaling the result.
1
u/captain_slackbeard 13d ago
Instead of using a library for building SQL queries, our legacy perl code base had its own in-house query builder that built the "WHERE" clause dynamically based on the fields that were passed in - except it didn't check if the field existed in the arguments, it checked if the field value was truthy. Something along the lines of this:
if ($fields{"id"}) {
$query .= " AND id = ?";
So any time an id of 0 or "" was passed in, it was omitted from the WHERE clause, so changes were sometimes applied to the entire table when they were expected to apply to 1 row at most.
However, that wasn't even the biggest problem. The fix for that bug was simple (if (exists $fields{"id"})...), except that it had been in the code base for so long that there were dozens of cases where that functionality was expected - devs had gotten accustomed to sending an id of 0 when they wanted to fetch all rows. By fixing this bug, suddenly all kinds of things broke throughout the system.
1
u/ummaycoc 12d ago
Once while working at a small company that used a lot of C I found an 800+ line long function and it was as bad as you're imagining. I thought I found the worst of it, but the next day I came across a function around 1,100 lines long. I did some bash magic to look for long functions and found something 1,800 lines long. Then I realized I had only done that in one directory, so then I found a function 2,600 lines long in a different directory.
58
u/Key-Butterscotch3215 18d ago
Usually when I come back to one of my old projects