Tag Archives: programming

javascript, microsoft, software development, Uncategorized

Why programmers should study Microsoft’s random failure and not trust Google search

1 Comment

The bizarre story of the EU-mandated Windows browser choice screen took an unexpected twist recently when it was noticed that the order of the browsers was not truly random.

image

IBM’s Rob Weir was not the first to spot the problem, but did a great job in writing it up, both when initially observed and after it was fixed by Microsoft.

It was an algorithm error, a piece of code that did not return the results the programmer intended.

Unless Microsoft chooses to tell us, there is no way to tell how the error happened. However, as Weir and others observe, it may be significant that a Google search for something like Javascript random sort immediately gets you sample code that has the same error. Further, the error is not immediately obvious, making it particularly dangerous.

I am sure I am not the only person to turn to Google when confronted with some programming task that requires some research. In general, it is a great resource; and Google’s own algorithms help a little with filtering the results so that sites with better reputation or more inbound links come higher in the results.

Still, what this case illustrates – though accepting again that we do not know how the error occurred in this instance – is that pasting code from a Google search into your project without fully understanding and testing it does not always work. Subtle bugs like this one, which may go unnoticed for a long time, can have severe consequences. Randomisation is used in security code, for example.

As an aside, there also seems to be some randomness in the appearance of the browser choice screen. It turned up on my laptop, but not on my desktop, although both have IE as the default.

And who would have guessed that the EU would arrange for so many of us to get an ad for something like the GreenBrowser popping up on our desktop? Apparently it is the “best choice of flexible and powerful green web browser”, though since it is based on IE it is less radical a choice than it first seems.

image

.net, php, software development

XML literals come to PHP via Facebook: XHP

Facebook engineer Marcel Laverdet has written up the XHP project on which he has been working at Facebook, and which he says is “quickly becoming a cornerstone of front-end PHP development at Facebook”. XHP enables XML fragments to be valid PHP expressions. In addition, most HTML elements have been pre-defined as variables. The project is hosted on github and you can read a quick summary here. PHP inventor Rasmus Lerdorf has had a quick look and says:

The main interest, at least to me, is that because PHP now understands the XML it is outputting, filtering can be done in a context-sensitive manner. The input filtering built into PHP can not know which context a string is going to be used in. If you use a string inside an on-handler or a style attribute, for example, you need radically different filtering from it being used as regular XML PCDATA in the html body. Some will say this form is more readable as well, but that isn’t something that concerns me very much.

Lerdorf goes on to express concern about performance, but says that in combination with APC caching it is much better, and with HipHop compilation to native code becomes “a viable approach”.

One of the benefits here is that getting XML markup out of quoted strings means that it can be checked as it is parsed, so that errors are caught earlier. There are parallels with Microsoft’s work on Linq (Language Integrated Query) which pulls database queries into the language, and XML literals in Visual Basic 9.0. Ideally, developers should not have to hide code such as SQL, XML or Javascript within strings that are not checked for valid syntax until runtime.

This might also re-ignite the debate about whether XML literals should be in C#, now also gaining more attention because of the popularity of ASP.NET MVC.