Hacker News Reader

Comment by tjogin | Hacker News Reader

A huge mistake, but Tumblr's staff are probably quite experienced, nonetheless.

How about that gotcha though? A single character is mistakenly changed from "<" to "i" and that exposes the source code to the browser. Think about that.

View on HN

I wonder if the 'i' has anything to do with vim

Clearly they should ban vim from their development process! ;-)

No, joking aside, the normal way to handle this is to have the perimeter server (nginx or varnish) catch any 5* responses and turn them into a user-friendly error-page. That way you never expose sensitive stack traces to your users.

So, this is standard stuff and easy to fix. However who of us hasn't screwed up on a similarly trivial issue before? I wouldn't judge them too hard on this one, happens to the best of us.

That wouldn't have caught this though, this code wasn't even executed, just sent as plain text.

Nginx/varnish can also catch Content-type: text/plain (or text/php?) and treat that like a 5xx response. Yes, that's a bit of a hack, but unless tumblr needs to serve text-files (which I doubt) it's a legit safeguard.

I know you were kidding, removing all text editors from your production servers might be a good idea

Clearly they should make vim mandatory on every machine;-) I guess the 'i' comes from someone who is used to use vim but in this case using another editor.

That was my first thought as well, as a long time vim user I kind of cringed.

This is my guess. Anyone who's used VIM for years knows that the first couple of times using a different editor, your text is littered with "i" and ":w".

It could simply come from forgetting to exit from insert mode, and then coming back thinking the editor is in normal mode.

Well, a single character change + a developer not testing their code locally + not running high level unit tests + deploying untested code to production.

Tumblr has at least one full time sysadmin. I think it's more reasonable to suppose he made the change to a production config file, rather than a developer. A definite failing in their deployment process, but it really says nothing about the quality of the application code or developer testing.

Reply on news.ycombinator.com