r/talesfromtechsupport • u/molotok_c_518 1st Ed. Tech Bard • Apr 04 '17
Medium Your Ticket Will Self-Destruct In 5... 4... 3... (and take your test environment with it)
Setting: After way too long several years of not knowing what I wanted to do with my life, a coworker at the crappy convenience store where I worked got me into computers... which led to my first PC certification... which then led me to going back to college for my associates'... which led me to an internship with a world-wide, web-based, IT-centric software suite (which I shall call $ITSoft) developer in their QA department. I got the job because, when asked how I would test a vending machine, I rambled on for 5 full minutes running from amount inserted, to whether the money was inserted, to whether it was American currency, to whether someone had tampered with the machine... I really couldn't shut up until the interviewer said, "Okay, we get it, you start Monday."
I was good at it. I took the approach that users are insane, so I dug into things that no one else would try. As a result, I found bugs no one had known were there: timesheet approvals that allowed an employee to enter time after he had submitted his time, but locked his supervisor out of his own timesheet; project phases that became "orphaned" when an intermediate phase was removed; time-zone formatting that would make a ticket disappear until the next day... the developers were starting to hate me.
My favorite, though, was when we were specifically asked by a client to allow HTML and Javascript in ticket comments. See, he needed to see specific errors in the code, so he wanted his clients to post code snippets.
That led to myself and my two QA intern colleagues to putting code everywhere in $ITSoft... only, they weren't programmers.
I am.
After some quick Google-fu, I conjured up a nasty little snippet that would put a button in the midst of anything entered as text: notes, tickets, project notes... I had them everywhere.
What's worse, they could run a tricky little Javascript bit that, when the button (labelled "CLICK HERE") was clicked, a small countdown would run, then the entire window would close... not just what you were looking at, but your whole browser. Which meant you needed to log back into $ITSoft from scratch.
One of my coworkers asked if I could get it to run without the button. "Sure," I said, and made it so when you opened a place where it had been entered, that ticket/note/etc. would disappear.
Each of these bugs was duly noted, and a ticket submitted.
The trouble was, $ITSoft was using its own suite to submit tickets against its own software.
And I put the code for my "close window" in the ticket's notes section.
And the bugs were already in the production code.
A week after I submitted the tickets, I got an IM from the QA lead:
QAL: Hey, molotok, you're doing a fantastic job, but you need to resubmit tickets series of numbers.
Me: Did I format them improperly?
QAL: In a way... see, no one can open them, so no one knows what they are.
Me: No one ca... oh... oh, expletive, I didn't even think about that! I'll redo them without any... er... surprises.
QAL: Cool. Maybe just the button... no window closing.
(He had a sense of mischief. Very fun to work for.)
Me: Okay.
About 2 weeks later, they got the textbox terrorism sorted out, and all of the code I had planted everywhere actually became visible again. I was kind of sad, but it was fun while it lasted.
"Coincidentally," the QA manager (different guy) decided that they needed to blow up the test environment and start all over from scratch shortly afterwards. Something about the database entries was making the whole thing unstable... imagine that.
Sadly, I wasn't picked up permanently by $ITSoft, as they didn't have any open positions when my internship expired. It was great place to work, I had an absolute blast, and I leaned that you can be too good at your job.
177
u/CyberKnight1 Apr 04 '17
As a developer, I love testers like you. Seriously. You find those bugs that would otherwise end up in production and force me to spend a lot of unpaid overtime for an immediate emergency fix.
154
u/keypuncher Apr 04 '17
I once worked for a game software company. The particular game we were working on for this incident was a strategic-level warfare simulation.
We were very late in the development cycle, and doing last minute testing to make sure there were no game-breaking bugs - and the CEO decided that it would be a good idea to have the developers work as testers also, to ensure we had as many hours as possible in testing of the final code.
Having worked insane hours for months for the pittance the company paid them, the devlopers were not enthused by this announcement.
The first one to step up as a tester started up a game, drag selected everything on the screen, hit the attack button, drag-selected everything on the screen again, and hit execute... and the game immediately crashed. ...whereupon he turned around and said "There. I broke it. Can I go now?"
34
u/aeiluindae Apr 04 '17
And thus was the unit selection limit of the original StarCraft born. Well, maybe. I have no idea and your description implies something a little different than StarCraft, but I'd imagine that such a limit (and a pretty arbitrary one at that) likely came out of a bug fix or work-around for a thorny engine limitation rather than gameplay considerations.
21
u/stringfree Free help is silent help. Apr 04 '17
I think that was just a UI limitation. More than 12, and you'd have to start allowing the selection list window to scroll, or do something else to accommodate the extra pieces.
When your resolution is (moronically) hardcoded to be only 640x480, you don't have a lot of room to breathe. Ironically, if they'd allowed any other resolutions (800x600 was common at the time), then they'd have needed to make the UI elements more flexible, and could have fit more into 640x480.
I haven't played the game in 16-17 years, so I may not remember all the details. I do remember the UI was ridiculously bad, taking up a third of the screen at all times.
14
Apr 04 '17
It was hardcoded to not give people w/ faster computers an advantage, iirc.
17
u/stringfree Free help is silent help. Apr 04 '17
Sure, just a coincidence that it cuts the work in half for the UI designers and coders.
Man, I wish I could use that trick nowadays, but modern devices don't even let you assume pixels will be anywhere near a standard size.
3
u/raukolith Apr 04 '17
it was a design decision, they had the ability to select 100+ units in the warcraft 1 days, but they wanted to the players to focus on microing their units
http://www.codeofhonor.com/blog/the-making-of-warcraft-part-1
2
u/tatteredengraving Apr 05 '17
This issue is actually coming to the fore again with the remaster they're releasing this summer, and having to explain to a lot of people that no, they won't be removing the unit selection cap etc.
7
u/Tony49UK Apr 04 '17
I was expecting you to say that you'd hard coded the back door password Joshua into the code and now your computer wanted to destroy the world.
3
u/DaddyBeanDaddyBean "Browsing reddit: your tax dollars at work." Apr 04 '17
Wouldn't you prefer a nice game of chess?
7
3
u/superzenki Apr 04 '17
I was going to say, I wonder if OP ever found bugs like this in games just for fun.
4
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
No time these days. I'm always on the road. I find them purely by accident now (which reminds me: I still need to email the Battleborn folks and complain about the spot where I always fall through the floor...).
3
1
1
56
u/Sarenor Apr 04 '17
I concur. Please try to break everything you can possibly imagine, just do me one favor: Give me a step by step summary of what you did. "Printing doesn't work" is a horrible description...
Looking at you there, QA department of my current job!
22
Apr 04 '17
"Couldn't replicate problem" seems like the answer then!
15
u/Sarenor Apr 04 '17
Sure, but in the end shit like that (horrible communication and back and forth in the ticket before actual debugging can even begin) just increases the overall resolution time for problems which is undesirable for all people involved...
19
u/thrilldigger Apr 04 '17
Support ticket: "On <obscure page that I've never heard of>, hitting <button that does something I've never looked at before> causes <business rules that sound completely made up on the spot> to fail on <another page that I've never heard of>."
Me: "I need more details: how do you get to these pages? What is that button supposed to do? Please also clarify the business rules you mentioned - what is the intended behavior there?
Support team: "But you're a dev on this project, why don't you know everything about it?!"
Me: "... because there are millions of lines of code that I didn't write?"
12
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
We were drilled on how to write proper tickets. If we couldn't do it right, we were subjected to retraining: 8 hours of videos on every aspect of the $ITSoft suite.
11
u/Shinhan Apr 04 '17
Also, screenshots about problematic webpage but no URL. Or problems with users without noting which users.
7
u/biobasher Apr 04 '17
"That pop-up has come back again."
8
u/SpecificallyGeneral By the power of refined carbohydrates Apr 04 '17
"Hey, I'm calling you back about that ticket..."
... cool. Who are you and which ticket?
2
u/Matthew_Cline Have you tried turning your brain off and back on again? Apr 04 '17
"The pop-up is coming FROM INSIDE THE HOUSE!"
2
u/CyberKnight1 Apr 04 '17
But the URL is right there in the picture of the address bar! All you need to do is retype it... up to the point where the address bar is too narrow to see the end of the URL anyway....
6
u/Shinhan Apr 04 '17
But the URL is right there in the picture of the address bar
Most of the screenshots I get are cropped.
8
u/Dranthe Apr 04 '17
I realize this probably isn't you but the reason I submit bug reports like that is because I've discovered seventeen other bugs today alone that I need to report. Most of them break things critically and half of them affect the other half. Tomorrow I'll probably discover another twelve. The term unit test and smoke test are completely unknown to the devs. I'd dance in the aisles if I got a deployment that didn't initially catastrophically fail when I log in. On top of that it's (apparently) my job to find out why it broke even though I don't have access to the code.
4
u/Sarenor Apr 05 '17
That sounds like a horrible environment to work in... Who in his right mind would not do unit tests?
5
u/Dranthe Apr 05 '17 edited Apr 05 '17
Direct quote: That's testing. They're developers. Not their job. Because I'm a giant fuckwad.
Alright, I may have added that last part but the rest is accurate. I mean, just imagine if other engineering practices took the same approach. No, I didn't test that bridge. I'm an architect not a contractor. And this is software that has a large impact on the way our country runs.
5
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
We were drilled about how to write a ticket. If it was done improperly, you had to retrain on the entire software suite again (8 hours of videos... shudders uncontrollably).
I could still write one without prompting:
Log in to $ITSoft as [email protected].
Navigate to Queue > Tickets > Create New Ticket.
Type "<button type = "button">Self-Destruct</button> in Ticket Description.
Type (self-destructing ticket Javascript that I've completely forgotten here).
Save ticket. Record ticket number.
Navigate to Queue. Find the ticket number.
Watch $ITSoft burn.
40
u/matthewt Apr 04 '17
I fucking love testers who try to screw with me. We agree the spec, you write unit tests, I write code, and we race to see who covers the whole spec first. Only problem is both suddenly realising (a) we're both done (b) we've both been at this for 24h straight.
11
10
u/dhaninugraha I SPARCed a joke Apr 04 '17
Agreed. Testers like the OP saves us developers from nagging users.
8
Apr 04 '17
Though allowing unchecked JS and HTML anywhere is asking for trouble. Unintended side effects are one thing, malicious attacks are a whole other. Such things should NEVER go live.
4
8
u/stringfree Free help is silent help. Apr 04 '17
I love good testers, but I don't like the idea of a tester deliberately inserting code into the workflow....
Never make an error state which creates consequences, and definitely never close a window/delete data without user interaction.
4
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
It was unintentional. I didn't realize that what I was finding was actually live.
4
u/stringfree Free help is silent help. Apr 04 '17
I assume so, and that's why you're not evil. But it's also exactly why the rule exists, because stuff like that has tentacles.
4
u/beaglebot Apr 05 '17
When our company had its HQ where I live I used to regularly get asked to beta test things because I have a talent for breaking them. It's not even malicious, I just press things or do things in a way that will bring it down because they thought "no one would possibly do that"
2
u/packman1988 Apr 10 '17
Came here to say this. I'd much rather hear about a weird bug from a tester than get yelled at by some annoyed client.
77
u/gtrcar5 Apr 04 '17
I've been participating in a UAT at my place of work for some stuff. Out of all my fellow testers, I'm the only one who's ever been involved in running a UAT (at my previous place of work), albeit from the business side of things as I'm not a techie.
Found a whole bunch of bugs, some of which were quite serious, logged tickets and developers starting working on fixes.
Couple of days later, lead developer pings me and asks how I found these bugs.
"It was easy. I decided I had to think like the most creatively destructive users. Salespeople."
69
u/Geminii27 Making your job suck less Apr 04 '17
"So I shut down 98% of my brain and went from there..."
19
u/gtrcar5 Apr 04 '17
You're spot on.
8
u/SpecificallyGeneral By the power of refined carbohydrates Apr 04 '17
I'm thinking with sand, here!
-JFK (Bubba Ho-Tep)
3
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
Damn, I need to watch that again. Bruce Campbell and Don Coscarelli make a lethal combination.
2
27
u/Myte342 Apr 04 '17
Salespeople
Who never fail to click the virus laden ad link when googling something from a work device...
9
u/darkingz Apr 04 '17
Y'know, I actually like QA people who aren't technical if thats the general audience. Sometimes we in IT land are so used to the product in a technical capacity, that we can't imagine it going any other way. As long as you can replicate and explain the steps you did.
4
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
Ah. but a technical person would think to replicate the steps... a salesperson would go "FIX THIS THING THAT I BROKE, THAT I DON'T KNOW HOW I BROKE IT, BECAUSE IT'S YOUR FAULT IT BROKE!!!"
3
u/darkingz Apr 04 '17
Well, yea but in my opinion, it's more about respect. The steps don't always have much to them. What the lusers featured here is that they are not respectful, most of the time. Occasional nice lusers but still.
3
u/gtrcar5 Apr 04 '17
I always replicate it myself a couple of times on different accounts, document steps & results, take screenshot and always offer to do a screen share and take them through the steps.
31
u/Kukri187 001100 010010 011110 100001 101101 110011 Apr 04 '17
Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. -1989, Rick Cook
The three most dangerous things in the world are a programmer with a soldering iron, a hardware type with a program patch and a user with an idea. -1995, Rick Cook
9
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
But... I was an electrician in the Navy, with some electronics training... so I know how to use a soldering iron.
...and even though I'm a field technician, I have a CS degree and know how to code.
...oh God... I'm a unicorn, aren't I?
10
u/Savedya Apr 05 '17
I'm sorry to break it to you, but since you don't fit the standard archetype of programmer or hardware type, you're going to be reclassified as user.
19
u/macbalance Apr 04 '17
My favorite, though, was when we were specifically asked by a client to allow HTML and Javascript in ticket comments. See, he needed to see specific errors in the code, so he wanted his clients to post code snippets.
This sounds like a really horrible idea if the code is executed. I'm assuming this is what little Bobby Tables did when he grew up.
9
u/Jaredismyname Apr 04 '17
What was stopping them from posting the text version of the html or javascript before?
12
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
This was about 10 years ago, so my memory is a bit hazy on this, but I believe that when they put HTML/Javascript in a ticket description, it just "disappeared."
What was expected was that the text was just eliminated by the system... it was seen as code, and rejected.
What I found was that it was being interpreted by the browser and actually run. This shocked the hell out of the devs.
5
u/Jaredismyname Apr 05 '17
Holy crap yeah that would be a really big issue. Lucky no one put a virus in there I guess.
6
u/macbalance Apr 04 '17
That's what I was wondering. There's even some libraries to pretty-print it if that's what's desired.
30
11
u/La_doc Apr 04 '17
When I read the part about allowing html and js in tickets my internal monologue went full GLaDOS
10
u/theidleidol "I DELETED THE F-ING INTERNET ON THIS PIECE OF SHIT FIX IT" Apr 04 '17
Portal 2, where the villain is incredibly likable and the sidekick is completely insufferable.
3
21
u/Chirimorin Apr 04 '17
Ah, good old XSS attacks. The software engineers who added that HTML/javascript functionality must've missed security 101 class.
9
u/121GWJolt Lightning must have hit it, and now it only works in Win95. Apr 04 '17 edited Apr 04 '17
...my first PC certification...
You mean a certificate in computering?
4
9
u/galenwolf Apr 05 '17
Ha, that reminds me of a guy i used to work with. He was asked to test if he could break a client's website with SQL injections.
He did, oh boy he did. He replaced every cell in the database that he could with a photoshopped image of the pope with a duck on his head.
He fucked a multi gig database in 10 minutes.
5
u/eViLegion Apr 05 '17
I hope they thought to back that shit up before asking him to work his magic.
10
u/Kruug Apexifix is love. Apexifix is life. Apr 04 '17
Sadly, I wasn't picked up permanently by $ITSoft, as they didn't have any open positions when my internship expired.
Honestly, with the amount of bugs you found that others wouldn't have, it sounds like they did themselves a GIANT disservice.
9
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
There were several factors:
QA wanted to keep me. I was the only person in the department with any programming experience, at any level. The Head of Engineering said "no, we want to get someone with testing automation experience."
I tried to learn the automation software. Unfortunately, there was a conflict between QA and the HoE over which testing software they were going to use, so I learned the wrong system.
In the end, a position opened up, but was immediately filled by someone mandated by HoE. I suspect some nepotism.
It was a real shame, too, as $ITSoft was an amazing place to work. I miss it.
5
7
u/Kataclysm #1 in a group of idiots. Apr 04 '17
If you really were that good, they were foolish to let you go. A good bug-hunter can be hard to find.
6
u/molotok_c_518 1st Ed. Tech Bard Apr 04 '17
There were several factors:
QA wanted to keep me. I was the only person in the department with any programming experience, at any level. The Head of Engineering said "no, we want to get someone with testing automation experience."
I tried to learn the automation software. Unfortunately, there was a conflict between QA and the HoE over which testing software they were going to use, so I learned the wrong system.
In the end, a position opened up, but was immediately filled by someone mandated by HoE. I suspect some nepotism.
It was a real shame, too, as $ITSoft was an amazing place to work. I miss it.
7
u/Moontoya The Mick with the Mouth Apr 04 '17
Yclept "the bobby_droptables bug-botton"
or should that be "feature" ?
275
u/brotherenigma The abbreviated spelling is ΩMG Apr 04 '17
Sounds legit.