HN Explorer

Ask HN: What's your biggest programming mistake?

12 points by lostincode ↗ HN
After reading Flickr's accident deleting user's photos, it got me thinking of my own mistakes running a startup.

About 5 years ago I created my first startup, it was my first time building a application for users and didn't expect it to gain any traction. After the first month it received about 5,000 users. Naturally, I decided to focus on security a bit more and convert all user's passwords to a encrypted version in the database. As I was re-building one of the components (reset password page) I was preparing all the needed queries when I accidentally wrote a MySQL UPDATE query and forgot to put a 'LIMIT 1' at the end. =x Yep, I reset all 5k passwords to the same thing. I remember having a panic attack shortly after as I struggled to think of a remedy. It was a pretty low point in my career as a programmer but I learned quite a few lessons that day (like the importance of backups for starters). In the end, I ended up emailing all our users asking them to update their password via secure link to their email and no harm was done.

What was your biggest mistake as a programmer?

10 comments

[ 4.7 ms ] story [ 26.7 ms ] thread
Khao
My biggest mistake was uploading ASP code right onto a production server to fix an urgent bug when there were a few hundred people passing exams online. I didn't realised that changing pages would not bother but changing code in the APP_CODE section would make the website recompile the code behind and every data stored in cache or in viewstate would be invalid since the dll version had changed. Everybody online then hit a 500 error page when they tried to continue.
RiderOfGiraffes
While testing a live update to a safety-critical traffic monitoring system I had four sessions running. Development, deployment, shadow, and a link to the live system.

I was checking the deployment to the shadow system, repeatedly running over the check-list to ensure that the deployment went smoothly, and then running a comparison between the shadow system and the live system to check that the update took place properly.

Between each test I took down the shadow system and brought it back up in a clean duplicate of the live system. Except on this one occasion when I had a brain-fart and killed the live system.

It all came back as designed within 30 seconds, re-initialised and restarted without loss of data, but it was a scary moment.

svmegatron
Once, on purpose, I wrote a login system that enforced globally unique passwords. Ie. no two users could share the same password. I can't even remember why it seemed like a good idea while I was designing it, but the problem quickly became apparent once anyone started trying to use it.
waqf
Did you store the passwords in cleartext or did you use unsalted hashes? Those are the only ways I can think of to enforce uniqueness, and they're both deprecated practices in themselves.
notaddicted
Before I had figured out VCSs I didn't know how to branch in subversion. I had a site that was based on a checkout from about six months before, but I had made a bunch of hotfixes to it while development continued on the main branch. I wanted to make a backup copy of the code on my workstation so I logged into the server and typed:

    $ tar xzf archive.tgz live-directory
So by typing x for extract instead of c for compress I accidentally overwrote everything right at the moment I wanted to back it up. Two hours later I had the site working again, six hours later I had it back to where it was before I deleted it. It was painful to spend a whole stressful day undoing the damage from a one character typo.
camperman
dd if=outfile of=infile

An entire month to fix.

henryfarbles
I've accidentally done this more times than I'd like to admit:

rm * .png

rfergie
Did this earlier today.

Back to where I started from now; a combination of version control and things going much faster when you've already figured out the answer made things go faster than I thought

bit101bit
Mine... Leaving 'test code' that should have been commented out. When run the code just produces test results not matter the input... and i was telling the panel the code was ok.
bmelton
In the process of working on SUN Java Access Manager, we kept getting application server core dumps. To troubleshoot, I needed to grab all the logs and zip them up to send to SUN support. I'd been up and working on this particular problem for over 30 hours, and was very closely treading the line between asleep and awake.

I wrote something like:

BACKUP_DIR=/home/bmelton/backups $LOG_DIR=/opt/alui/portal/logs mv $LOG_DIR/* $BACKUP_DIR tar -czf `date`.tar.gz $BACKUP_DIR/*

Anybody who's awake has probably already spotted that I tried to SET $LOG_DIR instead of LOG_DIR, and hence, ended up moving the entire operating system into my home folder.

It was a virtual instance, using Sun's zone virtualization, so fixing it proved to be trivial, but it was on a production system serving a federal agency, and that wasn't the only thing on the server.

Oddly enough though, after the script ran, the Access Manager (having loaded everything into memory, I assume) still worked like a champ, though everything else failed completely.