Hacker News Reader

Comment by snarfy | Hacker News Reader

The space at the end of the password entry was found in QA testing. Since we are an agile shop and run two week sprints that bug was left in and put on the backlog to be prioritized later. Gotta release every two weeks, even if it's utter crap. As long as the PBIs are completed, who cares about the users?

It's a sad day when I have to sneak bug fixes that annoy me in on my free time, but this seems to be the norm in an agile driven software world, at least my experience with it for the last ten years.

View on HN

well .. that bugfix have associated a few risks..

1. let's suppose a user have a password: (note the space)

    " 123"

2. also you store the password using some hashing function, which prevents you from knowing the password.

3. two weeks later the bugfix goes live, the user cannot longer access the service.

Also, you cannot easily estimate how much benefit/annoyed users your _fix_ will endup having .. which makes it a higly risk change.

Absolutely true for regular passwords. In the specific case of the blog post, it can work however, because it's just the numeric two-factor part.

This is going to sound a bit horrible...

Fixing the space issue will help more people than it hurts. People that have spaces at the beginning or end of their password can simply reset their password or call customer support. Users forget or mistype passwords all the time.

This is about 2fa, not passwords.

With 2fa, you control the allowed character set, and as such can make sure that what you mention cannot happen.

Mind you, 2fa is stupid for a whole lot of other reasons, but that's another matter.

A minor soapbox of mine: agile doesn't say anything about release cycle. What it says is that the goal is working software, not released software.

Software can be working but not released until it's working well.

Any criticism of Agile, and the definition changes.

The definition of Agile is the Agile Manifesto. It doesn't change.

It's sort of like religion. The definition of Christianity is the Bible. The amount of Christian religions that actually care about what's written in the Book is minuscule.

> The definition of Christianity is the Bible.

The closest thing actually within Christianity to this is a relatively new idea ("new" in the context of how long Christianity has existed) particular to a subset of Protestant Christianity, and generally rejected by the rest of Christianity, to wit, the doctrine of sola scriptura. [0]

[0] http://en.wikipedia.org/wiki/Sola_scriptura

it may sound silly, but look how far they got with these two ideas:

- why believe in god? because the bible said so..

- why believe in the bible? because god wrote it..

Very true, but I've yet to see it practiced that way.

Also very true unfortunately. Hence the soapbox :-)

There's a huge swath of the industry where it doesn't make sense to release any faster than a few times a year. Think Office applications, RDBMS products, email servers, accounting apps, etc, etc. Even the fastest cadence apps (like browsers) are on more of a 6-week cycle. The web is unique in that every visit is an opportunity to deliver new code, but there's way to much friction with most application types to do that.

Out of interest, what was the goal of any other methodology?

Requirements ;-)

Software is a hell of a lot easier to write and test if you have a decent well thought out set or requirements. Getting that is far harder than any coding.

All methodologies have the goal of working software. Where they differ is in how they try to get there.

Agile came about because people started saying "hey, this process we have for creating working software isn't actually creating working software. Maybe we should try another process."

That reminds me of a bug I found during my first internship. The company had it's own niche social network centered around it's main product. On it, you were able to change your display name at any time, and if you added any spaces to the beginning or end of your username, you could hijack another users profile. That is, I could change my username to " snarfy", and if you clicked my display name to go to my profile, it would actually go to yours. A malicious user could use this to make inflammatory posts posing as a high profile user.

The bug was that the display name was first checked to see if it already existed before white space was stripped. Luckily this was fixed very quickly after it was found, as it existed in production.

Reply on news.ycombinator.com