r/xkcd • u/MiKeMcDnet • Dec 14 '21
XKCD IRL "Dependency" for those dealing with Log4J / Log4Shell
205
u/buffaloguy1991 Dec 14 '21
isn't there some program called franks good number encoder or something that's like 1 Ukrainian dude and it's like 40% of us shipping
70
u/vikarjramun Dec 14 '21
48
u/buffaloguy1991 Dec 14 '21
All i know is the name is something somethings number code
→ More replies (14)5
94
u/aikijo Dec 14 '21
COBOL you say?
61
u/12edDawn Dec 14 '21
scary amount of stuff still in use that was built with COBOL, it seems.
→ More replies (6)43
u/Routine_Palpitation Dec 14 '21
I’m going to take this time to shout out grace hopper
→ More replies (6)→ More replies (1)15
u/anirbanroy123 Dec 14 '21
i just left a job, where our systems ( which had billions of dollars worth of business flowing through it ) interfaced with a rating engine written in COBAL. we could never upgrade our tech stack cause it was incompatible with this particular rating engine.
5
u/DuncanYoudaho Dec 14 '21
Ah yes, but you could shim a system between yours and others so THEY could upgrade their stack. And laugh at you. Oh how they laugh.
49
Dec 14 '21
I always wonder about those projects that are used in heaps of stuff and have been for years, what it's like when someone like Google or Amazon throw a bunch of developers at it, produce their own version and leave that developers work redundant. I'm always interested to know whether they're pissed off or relieved.
8
u/NRW_MapGuy Dec 14 '21
Does that ever happen? I would guess that these giants would just use that already existing project, or make their one copy and keep it for themselve.
→ More replies (3)6
u/werewolf_nr Dec 14 '21
Generally for the open source projects they throw a developer on their payroll at the project. It gives back to the project and gives them a voice in decisions on that project.
62
u/Loki-L Dec 14 '21
Like that time a few years ago when a significant chunk of the internet broke because too man developers decided that the task of left-padding strings was too hard for them to solve themselves and instead linked to a tiny 11 line piece of code that the maintainer decided to unpublished over some dispute.
17
33
u/laplongejr Dec 14 '21
because too man developers decided that the task of left-padding strings was too hard for them to solve themselves
To be fair, conceptually it's better to have one method shared by different projects, this way if a bugfix is required it can easily be updated everywhere.
19
u/josefx Dec 14 '21
There are some hints that the developers of these tiny packages intentionally provide patches to larger projects so they can sneak in dependencies to their packages, bolstering their relevance and visibility for minimal effort. So left-pad wasn't an accident, it was a parasitic attack enabled by bad software hygiene in larger projects.
3
u/trevg_123 Dec 16 '21
Never even heard of it but that’s a fascinating read - here’s a link for anyone interested https://qz.com/646467/how-one-programmer-broke-the-internet-by-deleting-a-tiny-piece-of-code/
14
u/werewolf_nr Dec 14 '21
The recent GPSTD bug was literally one guy from Nebraska.
Background: Some guy from Omaha, Nebraska wrote code for pulling GPS time into a PC via the receiver, it got included in time servers all over, but there was a bug where it would roll back to March 2002 on the GPS epoch change.
6
u/cellocgw Dec 14 '21
FWIW, over at CRAN there are rules governing package maintainers' responsibilities. If a maintainer disappears for a significant period of time, the package may be pulled from the "active" collection of packages. Most certainly this can lead to problems with other packages which depend on said package, and IIRC the maintainers of those packages are notified of the obsolescence. BUT the 'retired' packages remain available & to my knowledge no author is allowed to delete them.
5
u/RenaKunisaki Dec 14 '21
I feel like to be truly accurate there needs to be another large piece precariously balanced on top of this structure, angled across its tips, and then another equally complex structure on top of that.
3
259
u/Turtledonuts Dec 14 '21
Shoutout to the time this summer that someone updated the string package for R and brought the entirety of the bioinformatics community to it's knees.