Hacker News Reader

Comment by intrasight | Hacker News Reader

Wow, just wow. I can't wonder how common such securing coding slip ups are these days.

This isn't a 'coding slip up.' The original issue, as egregious and terrible as it is, could have been a a mistake. However, whoever implemented 'the fix' is someone acting acting with unforgivable malice and deceit.

Anyway its on HN now. FAFO

This doesn't strike me as a slip-up, it strikes me as complete apathy on behalf of the developer(s).

On inspecting the page where they list restaurants, I can see a several versions of jQuery code like this, for each cuisine.

$('#Fish & Chips').on('change', function () {

  if ($('#Fish & Chips').is(':checked')) {

    $('.Fish & Chips').css('background-color', '#3a606e;');

    $('.Fish & Chips').css('color', '#fff;');

  } else {

    $('.Fish & Chips').css('background-color', '#fff');

    $('.Fish & Chips').css('color', '#3a606e;');

 }

});

I have a good feeling this is more of copy-pasta code from either Copilot or ChatGPT or StackOverflow. That also explains why they handled encryption the way described in the article.

Dev: "Hey LLM, how do I pass data around in a secure way ?"

Bot: "You can encrypt the data before you send it, so that only users who have the relevant keys can read them"

Dev: "Hey LLM, it is not possible to access the data I have encrypted on the frontend"

Bot: "Here is the javascript code to decrypt the data you have passed then"

"This is what you mean by CSS-in-JS, right?"

But seriously, those selectors are making me cringe. Does it even work with the spaces?

  $('[id="Fish & Chips"]')
  $('[class="Fish & Chips"]')

with attribute selectors like what you have mentioned it would work. But `$('#Fish & Chips')` most certainly will not, since jQuery would throw a syntax error.

It makes sense to throw a syntax error but I wasn't sure what the actual behavior would be. Made me wonder if jquery did some magic to understand what is being queried.

jQuery first came-out long before browsers had querySelector: it used a 100% JS reimplementation of a CSS selector parser and evaluator, which was eventually spun-off into its own library: Sizzle.js: https://github.com/jquery/sizzle - Surprisingly, jQuery didn't fully remove Sizzle until 2019 ( https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ ) - if that seems surprisingly recent, don't forget that querySelector wasn't added to the DOM API until 2013 - with only IE11 supporting it: some places were still using even IE6 well past then, so it makes sense for jQuery to support it for so long.

So using newer CSS selector features, like attribute value selectors, will work fine in post-Sizzle jQuery versions.

This kind of code is very common among folks who learned JS using jQuery ten years ago and never tried to learn anything else since that time.

I don't think this site was the work of an LLM. I think it was the result of somebody who just learned frontend JavaScript trying to hack together a website and business, with next to no practical knowledge.

There's all sorts of weird stuff, and it definitely looks like the kind of thing you'd see a beginner copy-pasting code and trying things out would create. The site sets a cookie containing the key-value pair "key":"value", for example.

> key-value pair "key":"value"

This reminds me of when I first started programming professionally. I’d write loops in PHP like

  foreach($orders_by_id as $key => $value) {
    $id = $key;
    $order = $value;
    # ...
  }

This was at a small logistics company you’ve never heard of (read: not the best development practices) so the habit was eventually caught in a code review and corrected. I must have written a dozen or so of those prior to that.

Assuming this is human-written, it only makes sense to me as something cooked up by someone who understands a bit of JS but sincerely has no clue how browsers work. A smart and ambitious, if somewhat incurious, junior engineer at work.

This is not a slip up-it’s basically malpractice.

Is it really malpractice if there are zero education requirements, going as far as purposely not calling it software engineering since there is zero standards for the 'engineering' being done.

Perhaps not, but negligence and malpractice are different. Average joe can be negligent and legally liable (driving for example).

No idea what the legal precedent for negligent software engineering would be…

You can be negligent because there are rules of the road you sign up for, and get a license for. But if it's just a job you take with zero qualifications required, how can you be liable? The company, maybe. The programmer? Aren't called code monkeys for nothing.

Oh, I see what you’re saying. I agree. Although even with driving, an unlicensed driver would still be liable.

I suppose it depends what you consider agreement to social rules and how you define liability. I can certainly be held liable for damages for my actions to others which do not require me to hold any license - merely break the law.

Did I agree to the “rules of the road” when I was born? Do I consent by not emigrating?

(nits, picked…)

Use of payment networks and keys are protected by contractual agreements that have quite a lot to do with liability.

Reply on news.ycombinator.com