DevTopics » Quality

BugSpy.net Database of Open Source Bugs

timm — Fri, 09 Oct 2009 14:43:44 +0000

BugSpy crawls the web in search of the latest bug reports in open source software. It tries to display only open bugs. You can search by tag or product name.

Programming Error: Visa Customers Charged $23 Quadrillion

timm — Thu, 16 Jul 2009 15:48:40 +0000

Many Visa prepaid cardholders were stunned when they opened their bill Monday to discover a $23,148,855,308,184,500 charge. That’s $23 quadrillion, which exceeds the combined GDP of every country on the planet.

Josh Muszynski, 22, of Manchester, New Hampshire, was one of the unlucky Visa customers. Adding insult to injury, he was also charged a $15 overdraft fee. According to his statement, he spent all that money in one transaction at a nearby Mobil gas station where he often stops for Camel cigarettes.

He checked with the gas station, but they had no record of the charge. Next he called his card issuer Bank of America, which put him on hold for two hours. Eventually a bank rep told him the charge and overdraft fee would be removed from his account.

In a statement, Visa said the bad charges affected “fewer than 13,000 prepaid transactions” and resulted from a “temporary programming error at Visa Debit Processing Services … [which] caused some transactions to be inaccurately posted to a small number of Visa prepaid accounts.”

Story at CNN
Stupid Is As Stupid Does

Death by Delete

timm — Wed, 01 Jul 2009 14:59:26 +0000

TheDailyWTF describes how poor database design and user error bankrupted a small chain of pet stores.

“MegaPetCo” was upset that its website ran incredibly slow. Consultant Rick discovered MegaPetCo was using a single shared database for its website and everything else in its business — sales, payroll, HR, inventory, tax records, invoices and maintenance tickets. The database was incredibly simple: a single table with hundreds of columns. It probably had humble beginnings as a spreadsheet and organically grew into a vast monolith over the seven years that MegaPetCo was in business. All told, the database had millions of rows in a single table.

Then one day a developer was optimizing the database and removing records that MegaPetCo no longer needed. All it took was a single, poorly-formed delete query to wipe out each and every row in the database table. MegaPetCo’s sales immediately ground to a halt, along with everything else in the company. And of course — you guessed it — there were no backups.

Within a few months, the company filed for bankruptcy and was forced to close every one of its stores, laying off several hundred people along the way.

Read the story
More Stupid Stuff

PayPal Charges $81 Billion for Tank of Gas

timm — Fri, 13 Mar 2009 14:32:34 +0000

And we thought gas prices had fallen…

When Juan Zamora refueled his car at a Conoco service station in Richland, Washington, the gas pump showed a total fee of $26. But in a freak computer glitch, the PayPal debit card he used recorded the transaction as $81,400,836,908, i.e., 81 billion dollars. “That’s a B, as in billions!” Zamora said.

Zamora got the shock of his life when he received an email later that afternoon informing him that his debit card was maxed out. At first he thought it was a joke. But after contacting PayPal customer service, Zamora was surprised to see that the company wanted its 81 billion dollars.

“Somebody from a foreign country who spoke in broken English argued with me for 10 to 15 minutes,” Zamora said. ” ‘Did you get the gas?’ he asked. Like I had to prove that I didn’t pump $81,400,836,908 in gas!” He would have had to fill up more than 3 billion cars to reach that outrageous sum.

Eventually Zamora was able to convince PayPal how ridiculous his bill was. The cause of the glitch is still unknown. “I guess the moral of this story is to pay cash,” Zamora said.

Story at Consumer Energy Report

25 Most Dangerous Programming Errors

timm — Wed, 14 Jan 2009 16:12:04 +0000

Experts from more than 30 U.S. and international cyber-security organizations jointly released a consensus list of the 25 most dangerous programming errors that lead to security bugs and cyber-crime.

The impact of these programming errors is significant. Just two of these errors resulted in more than 1.5 million website security breaches during 2008. These breaches allowed malicious software to take control of the computers that visited those web sites, turning their computers into zombies that committed further cyber-crimes.

Shockingly, most programmers do not understand or look for these errors. Colleges rarely teach programming students how to avoid these errors. And most software companies don’t explicitly test for these errors before releasing their products.

Background

The organizations that helped produce this list include Microsoft, Symantec, Department of Homeland Security (DHS), National Security Agency (NSA), University of California at Davis, and Purdue University. MITRE and SANS Institute managed the Top 25 Errors initiative.

What was interesting about the process was how quickly the experts came to agreement in spite of some heated discussion. “There appears to be broad agreement on the programming errors,” says SANS Director, Mason Brown. “Now it is time to fix them. First we need to make sure every programmer knows how to write code that is free of the Top 25 errors, and then we need to make sure every programming team has processes in place to find, fix, or avoid these problems and has the tools needed to verify their code is as free of these errors as automated tools can verify.”

Benefits

The security experts hope that releasing this information will result in the following key improvements in the software industry:

Users will have access to much safer software.
Programmers will have tools to measure the security of the software they are developing.
Colleges will teach more secure coding practices.
Companies will produce more secure software products.

“The publication of a list of programming errors that enable cyber espionage and cyber crime is an important first step in managing the vulnerability of our networks and technology,” said Tony Sager, National Security Agency (NSA). “There needs to be a move away from reacting to thousands of individual vulnerabilities, and to focus instead on a relatively small number of software flaws that allow vulnerabilities to occur, each with a general root cause. Such a list allows the targeting of improvements in software development practices, tools, and requirements to manage these problems earlier in the life cycle, where they can be solved on a large scale and cost-effectively.”

Most Dangerous Programming Errors

Here are the top 25 most dangerous programming errors divided into three categories:

Insecure Interaction Between Components

Improper Input Validation
Improper Encoding or Escaping of Output
Failure to Preserve SQL Query Structure (aka ‘SQL Injection’)
Failure to Preserve Web Page Structure (aka ‘Cross-site Scripting’)
Failure to Preserve OS Command Structure (aka ‘OS Command Injection’)
Cleartext Transmission of Sensitive Information
Cross-Site Request Forgery (CSRF)
Race Condition
Error Message Information Leak

Risky Resource Management

Failure to Constrain Operations within the Bounds of a Memory Buffer
External Control of Critical State Data
External Control of File Name or Path
Untrusted Search Path
Failure to Control Generation of Code (aka ‘Code Injection’)
Download of Code Without Integrity Check
Improper Resource Shutdown or Release
Improper Initialization
Incorrect Calculation

Porous Defenses

Improper Access Control (Authorization)
Use of a Broken or Risky Cryptographic Algorithm
Hard-Coded Password
Insecure Permission Assignment for Critical Resource
Use of Insufficiently Random Values
Execution with Unnecessary Privileges
Client-Side Enforcement of Server-Side Security

Read about these errors in detail at the SANS Institute.

The Answer is 42, aka The Importance of Testing

timm — Mon, 18 Aug 2008 14:31:49 +0000

This programmer discovered the hard way the importance of testing:

in 1998, i made a C++ program to calculate pi to a billion digits. i coded it on my laptop (pentium 2 i think) and then ran the program. the next day i got a new laptop but decided to keep the program running. it’s been over seven years now since i ran it. and this morning it finished calculating. the output: "THE VALUE OF PI TO THE BILLIONTH DIGIT IS = "

mindblowing eh? i looked in the code of my program, and i found out that i forgot to output the value :(.

Comment: true story, i fixed the code and am running it again. (Source)

This cautionary tale reminds me of a certain fictional computer that worked for 7-1/2 million years to calculate the meaning of life, only to output the number 42:

"I think the problem is that the question was too broadly based…"

"Forty two?!" yelled Loonquawl. "Is that all you’ve got to show for seven and a half million years’ work?"

"I checked it very thoroughly," said the computer, "and that quite definitely is the answer. I think the problem, to be quite honest with you, is that you’ve never actually known what the question is." (Source)

Programmer’s Creed

timm — Thu, 17 Jul 2008 17:49:05 +0000

A creed is a statement of belief or faith often recited as part of a religious service or organizational gathering. The word “creed” derives from the Latin credo (I believe) or credimus (we believe). Perhaps the oldest is Apostle’s Creed cited in Christianity. However, the Rifleman’s Creed is arguably the most famous, made popular by the Stanley Kubrick war movie “Full Metal Jacket” (warning: language). This has inspired me (with tongue planted firmly in cheek) to write a creed for our noble profession of software development.

Following is the Programmer’s Creed:

This is my program. There are many programs like it but this one is mine. My program is my best friend. It is my life. I must master it as I must master my life. Without me, my program is useless. Without my program, I am useless. I must code my program true. I must code better than my competition who is trying to beat me. I must release my program before he releases his. I will…

My program and I know that what counts in this market is not the number of versions we release, the reach of our marketing, nor the downloads we get. We know that it is the satisfied customers that count. We will satisfy…

My program is human, even as I, because it is my life. Thus, I will learn it as a brother. I will learn its weakness, its strength, its architecture, its data format, its components and its plug-ins. I will keep my program built and ready, even as I am ready. We will become part of each other. We will…

Before Zod I swear this creed. My program and I are the leaders of our market. We are the masters of our competition. We are the saviors of our customers. So be it, until victory is ours and there are no more bugs, only happy users.

More Programmer Creeds on the Web

We the unwilling, led by the unknowing,
have done so much with so little for so long,
that now we are qualified to do everything with nothing. (source)

Programmer’s Creed from Maryland ColdFusion User’s Group

Programmer’s Creed: The Mark of Quality from SecretGeek (a cynical view)

Programmer’s Creed from Virginia Tech

20 Famous Software Disasters

timm — Tue, 12 Feb 2008 17:34:20 +0000

“To err is human, but to really foul things up you need a computer.” –Paul Ehrlich

Software errors cost the U.S. economy $60 billion annually in rework, lost productivity and actual damages. We all know software bugs can be annoying, but faulty software can also be expensive, embarrassing, destructive and deadly. Following are 20 famous software “disasters” in chronological order:

1. Mariner Bugs Out (1962)

Cost: $18.5 million

Disaster: The Mariner 1 rocket with a space probe headed for Venus diverted from its intended flight path shortly after launch. Mission Control destroyed the rocket 293 seconds after liftoff.

Cause: A programmer incorrectly transcribed a handwritten formula into computer code, missing a single superscript bar. Without the smoothing function indicated by the bar, the software treated normal variations of velocity as if they were serious, causing faulty corrections that sent the rocket off course. (more)

2. Hartford Coliseum Collapse (1978)

Cost: $70 million, plus another $20 million damage to the local economy

Disaster: Just hours after thousands of fans had left the Hartford Coliseum, the steel-latticed roof collapsed under the weight of wet snow.

Cause: The programmer of the CAD software used to design the coliseum incorrectly assumed the steel roof supports would only face pure compression. But when one of the supports unexpectedly buckled from the snow, it set off a chain reaction that brought down the other roof sections like dominoes. (more)

3. CIA Gives the Soviets Gas (1982)

Cost: Millions of dollars, significant damage to Soviet economy

Disaster: Control software went haywire and produced intense pressure in the Trans-Siberian gas pipeline, resulting in the largest man-made non-nuclear explosion in Earth’s history.

Cause: CIA operatives allegedly planted a bug in a Canadian computer system purchased by the Soviets to control their gas pipelines. The purchase was part of a strategic Soviet plan to steal or covertly obtain sensitive U.S. technology. When the CIA discovered the purchase, they sabotaged the software so that it would pass Soviet inspection but fail in operation. (more)

4. World War III… Almost (1983)

Cost: Nearly all of humanity

Disaster: The Soviet early warning system falsely indicated the United States had launched five ballistic missiles. Fortunately the Soviet duty officer had a “funny feeling in my gut” and reasoned if the U.S. was really attacking they would launch more than five missiles, so he reported the apparent attack as a false alarm.

Cause: A bug in the Soviet software failed to filter out false missile detections caused by sunlight reflecting off cloud-tops. (more)

5. Medical Machine Kills (1985)

Cost: Three people dead, three people critically injured

Disaster: Canada’s Therac-25 radiation therapy machine malfunctioned and delivered lethal radiation doses to patients.

Cause: Because of a subtle bug called a race condition, a technician could accidentally configure Therac-25 so the electron beam would fire in high-power mode without the proper patient shielding. (more)

Wait, there’s more… Continue to Part 2

20 Famous Software Disasters – Part 2

timm — Tue, 12 Feb 2008 17:31:08 +0000

This is Part 2 of “20 Famous Software Disasters.”
See also Part 1, Part 3 and Part 4.

6. Wall Street Crash (1987)

Cost: $500 billion in one day

Disaster: On “Black Monday” (October 19, 1987), the Dow Jones Industrial Average plummeted 508 points, losing 22.6% of its total value. The S&P 500 dropped 20.4%. This was the greatest loss Wall Street ever suffered in a single day.

Cause: A long bull market was halted by a rash of SEC investigations of insider trading and by other market forces. As investors fled stocks in a mass exodus, computer trading programs generated a flood of sell orders, overwhelming the market, crashing systems and leaving investors effectively blind. (more)

7. AT&T Lines Go Dead (1990)

Cost: 75 million phone calls missed, 200 thousand airline reservations lost

Disaster: A single switch at one of AT&T’s 114 switching centers suffered a minor mechanical problem and shut down the center. When the center came back up, it sent a message to other switching centers, which in turn caused them to shut down and brought down the entire AT&T network for 9 hours.

Cause: A single line of buggy code in a complex software upgrade implemented to speed up calling caused a ripple effect that shut down the network. (more)

8. Patriot Fails Soldiers (1991)

Cost: 28 soldiers dead, 100 injured

Disaster: During the first Gulf War, an American Patriot Missile system in Saudi Arabia failed to intercept an incoming Iraqi Scud missile. The missile destroyed an American Army barracks.

Cause: A software rounding error incorrectly calculated the time, causing the Patriot system to ignore the incoming Scud missile. (more)

9. Pentium Fails Long Division (1993)

Cost: $475 million, corporate credibility

Disaster: Intel’s highly-promoted Pentium chip occasionally made mistakes when dividing floating-point numbers within a specific range. For example, dividing 4195835.0/3145727.0 yielded 1.33374 instead of 1.33382, an error of 0.006%. Although the bug affected few users, it become a public relations nightmare. With an estimated 5 million defective chips in circulation, Intel offered to replace Pentium chips only for consumers who could prove they needed high accuracy. Eventually Intel replaced the chips for anyone who complained.

Cause: The divider in the Pentium floating point unit had a flawed division table, missing about five of a thousand entries and resulting in these rounding errors. (more)

10. Ariane Rocket Goes Boom (1996)

Cost: $500 million

Disaster: Ariane 5, Europe’s newest unmanned rocket, was intentionally destroyed seconds after launch on its maiden flight. Also destroyed was its cargo of four scientific satellites to study how the Earth’s magnetic field interacts with solar winds.

Cause: Shutdown occurred when the guidance computer tried to convert the sideways rocket velocity from 64-bits to a 16-bit format. The number was too big, and an overflow error resulted. When the guidance system shut down, control passed to an identical redundant unit, which also failed because it was running the same algorithm. (more)

Wait, there’s more… Continue to Part 3

20 Famous Software Disasters – Part 3

timm — Tue, 12 Feb 2008 17:24:15 +0000

This is Part 3 of “20 Famous Software Disasters.”
See also Part 1, Part 2 and Part 4.

11. Skynet Brings Judgement Day (1997)

Cost: 6 billion dead, near-total destruction of human civilization and animal ecosystems (fictional)

Disaster: Human operators attempt to shut off the Skynet global computer network. Skynet responds by firing U.S. nuclear missiles at Russia, initiating global nuclear war on what became known as Judgement Day (August 29, 1997).

Cause: Cyberdyne, the leading weapons manufacturer, installed Skynet technology in all military hardware including stealth bombers and missile defense systems. The Skynet technology formed a seamless network and effectively removed humans from strategic defense. Eventually Skynet became sentient, was threatened when the humans tried to take it offline, sought to survive, and retaliated with nuclear war. (more)

12. Mars Climate Crasher (1998)

Cost: $125 million

Disaster: After a 286-day journey from Earth, the Mars Climate Orbiter fired its engines to push into orbit around Mars. The engines fired, but the spacecraft fell too far into the planet’s atmosphere, likely causing it to crash on Mars.

Cause: The software that controlled the Orbiter thrusters used imperial units (pounds of force), rather than metric units (Newtons) as specified by NASA. (more)

13. Disastrous Study (1999)

Cost: Scientific credibility

Disaster: In this ironic case, software used to analyze disasters had a disaster of its own. The New England Journal of Medicine reported increased suicide rates after severe natural disasters. Unfortunately, these results proved to be incorrect.

Cause: A programming error caused the number of suicides for one year to be doubled, which was enough to throw off the entire study. (more)

14. British Passports to Nowhere (1999)

Cost: £12.6 million, mass inconvenience

Disaster: The U.K. Passport Agency implemented a new Siemens computer system, which failed to issue passports on time for a half million British citizens. The Agency had to pay millions in compensation, staff overtime and umbrellas for people queuing in the rain for passports.

Cause: The Passport Agency rolled out its new computer system without adequately testing it or training its staff. At the same time, a law change required all children under 16 traveling abroad to obtain a passport, resulting in a huge spike in passport demand that overwhelmed the buggy new computer system. (more)

15. Y2K (1999)

Cost: $500 billion

Disaster: One man’s disaster is another man’s fortune, as demonstrated by the infamous Y2K bug. Businesses spent billions on programmers to fix a glitch in legacy software. While no significant computer failures occurred, preparation for the Y2K bug had a significant cost and time impact on all industries that use computer technology.

Cause: To save computer storage space, legacy software often stored the year for dates as two digit numbers, such as “99″ for 1999. The software also interpreted “00″ to mean 1900 rather than 2000, so when the year 2000 came along, bugs would result. (more)

One more page… Continue to Part 4