As someone who works in an office environment, I run into a lot of people with Dilbert comic strips tacked or taped to various cubicle surfaces.  After deciding that there must be something to Dilbert, I started reading the strips (posted online daily).  After trying for about two months to figure out why people find Dilbert entertaining, I’ve given up.  In fact I’ve come to the simple conclusion that Dilbert is not funny.  At best, it is highly overrated.  I guess if you draw 365.25 strips per year you are bound to hit on something funny sooner or later, but I’m not sitting through crap like this to get there.

you heard me

Sure coming up with a great algorithm can be fun, but programmers only get true freedom to express themselves in their comments.  And it’s always fun when you are fixing a bug and run across a funny or ironic comment that you don’t recall typing but you can tell without a doubt that you were the one that wrote it.  While looking through some code I wrote about a year ago, I ran across these comments and thought I’d share.

1
2

//this math is right... work it out if you don't believe me. :)
long numSubLists = (numPRC + (MAX_SUBLIST_SIZE - 1))/MAX_SUBLIST_SIZE;

1
2

//this could only be false if something is broken hard...
Assert(numReturned == returnSize);

PS: assertions are awesome.  I’ve found nothing else to be better at preventing future programmers (especially myself) from breaking my code.

There is an intricate social interaction that occurs when walking down a long corridor, such as a hallway at an office building, where architecture allows you to see someone from a greater distance than volume levels appropriate for polite conversation would permit conversing.  As a result, when you see someone you know on the other end, you realize that eventually you must acknowledge him with some form of greeting.  But at this distance, you’d have to shout “HELLO!!” across the building to do so, which would make you look rude.  So you continue walking, looking at the floor or wall or something—anything to avoid staring at him for thirty consecutive seconds.

Now it’s on.  You have chosen your destiny for the next half-minute, and it will involve a hallway hello.  Sure, you could duck into a row of cubicles, and pretend that was your intended destination until the person passes.  But what if there are people in those cubicles?  They will be all “what are you doing here?”  Unless you are good at making up answers to such questions on the fly, your best course of action is probably to continue walking down the hallway.

Before you know it, you are at last in speaking range.  At this point you look towards the other party, wait for him to look at you (which he is expected to do!), then say something like “Hey, [passerby’s name]” or “Hey how’re you?”   Next, if you are dealing with a civilized individual, you can expect to hear “Hey, [your name]”, or just simply “Hey.”  Note:  do not tell the other party how you are doing, even if he asks; he is asking merely out of politeness.  Finally, any eye contact is immediately broken until you have passed said person.

Whew, that was close.  But now you’ve successfully executed a hallway hello.  That makes you a real people person.  That’s why they pay you the big bucks.  And doggone-it, people like you.

PS: I was surprised that spellcheck didn’t have a problem with “how’re”

Last Monday marked two years since Stephanie and I got hitched, an event which was well-documented on this site and others.  Those of you who are fans of The Office are no doubt familiar with the Dwight Schrute bobble head.  Well in honor of our second anniversary, my wife had a bobble-head Kip constructed.  You will see the results below, I think it’s pretty cool, although the bobble-head doesn’t have the I-sit-behind-a-computer-all-day physique of yours truly.  But I don’t think I’d want a realistic representation of my waistline sitting on my desk all day anyway.  Other than the eye color, I think it’s pretty spot-on, at least insofar as that is possible on a bobble head.

It’s me.  I’m the bobble-head. Yes!

While I was on vacation the other week I was talking to my father-in-law, who works for a company that makes transmissions that go in transfer trucks.  He mentioned that he always asks people this question when they are interviewing for a designer position (i.e. mechanical engineer):  How much do you work on your own car?  I thought this was a pretty good question.  If someone is a mechanical engineer, but never spends any time working with their own car, they probably aren’t going to design things as well.  They may design things that work from a technical standpoint and meet specifications, but they’ll have lots of quirks because they simply aren’t thinking about how it will be used.  For instance, they may put some bolts in a place that would require an extra two hours of labor to get to, when they could have just as easily been somewhere accessible by just opening the hood. That may not be the best example, since I’m not a mechanical engineer, but you get the gist.

I was thinking that if I am ever interviewing programmers, I might ask a similar question.  The most obvious modification, “how much time do you spend working on your own computer,” doesn’t really apply to a programming position.  Sure lots of programmers take their computers apart and tinker with them, but so do a lot of people who think a hash table is something you smoke.

I came up with two alterations that I think would work:

1. In an industry where some say fifty percent of what you know is obsolete in five years, what do you do to stay current?
2. How much code do you write in your spare time?

I’m not saying by any means that a hiring decision should be based on either of these questions, but I do think a candidate’s responses would be telling.  I think it would also be pretty simple to identify whether you are getting BS or a legitimate response.  I think the first question is especially important, because most of the people I know who I don’t think are very good programmers probably have no idea what Ruby or AJAX are.  They’ve barely heard of C#.  You’re lucky if they’ve heard of Firefox.  True, they don’t work in web development, but that’s not the point.  Most good programmers I know tend to follow geek news and they are familiar with the “latest and greatest” technologies, even if they aren’t using them.  You may have been a pretty good COBOL programmer back in the day, but if you didn’t try to keep up with newer stuff, you’re not going to make a good Java programmer.  You’ll be stuck maintaining thirty-year-old COBOL code.  And if you are stuck working on thirty-year-old COBOL code, that’s your own fault.  In the last ten years the internet tubes have been filling up with tons of information:  you don’t have to subscribe to trade magazines or anything like that.  Just reading Slashdot or Digg or Endgadget from time to time goes a long way.  Of course, you’d have to watch out for the person who has heard of Ruby (for example), and lists it as a skill, when all they’ve really done is read the Wikipedia page on it.  I think one of the best pieces of resume advice anyone told me was to separate languages you have a strong proficiency in from those you just have a little experience with or haven’t used in years (thanks Peter).  If someone lists fifty programming languages, they are probably only proficient in maybe three or four of them.  And there are also those who memorize lots of buzzwords and sound smart but really aren’t.  You would need to have a pretty good BS detector.  But I think that is a prerequisite for conducting interviews anyway.

As for the second question, most of the people I would consider to be good programmers can’t just work on code at work.  Most of them have side-projects or a website or something sort of code related that they spend some of their spare time on.  The thing I don’t like about the question (at least the way I phrased it) is that it is too leading.  A candidate might think “uh oh, they want someone who writes Linux kernels for fun” and might give a BS response, even if they don’t intend to.  Incidentally, if you find someone who writes Linux kernels for fun, and they are telling the truth, you should probably hire them even if they drop racial slurs and/or their pants during the interview.

So whadda y’all think?  Good idea/bad idea?  Am I way off-base?  I’ve only been on the interviewee side of an interview before, so I don’t really know what I’m talking about here.  In any case, I think these are better questions than “What is your greatest weakness?”

PS: If they answer, “I’m a perfectionist,” they are probably lying.

I recently was asked to come into work on a Saturday at my place of employ.  I have no problem with coming in to work on a Saturday if my work requires that I come in to finish something that has not fully been completed during normal business hours.  However, this day was a mandatory work day for the entire company, and the area in which I work had nothing pressing to accomplish that day.  Instead, the upstairs lab came in to work solely to clean the lab from top to bottom.  True, it needed this scrub down terribly, but still not badly enough to make us come in on a Saturday.  And that isn’t even the worst of the situation.  We were required to come into work at 5:30 am!!!  On a normal day I don’t go into work until 7:30 am, but on mandatory Saturday workdays, we have to go in two hours earlier, to clean.  We were also in no way compensated for coming into work that day.  Normally I would expect to receive time off back in place for this extra time we were putting in, but no that didn’t happen.  Also, if I decided not to come in on Saturday, they would take a day of vacation from me, even though I already put forty full hours that week.

There were about three other problems I had with coming to work this particular Saturday.  Shall I tell you about them??   I think I will even if you don’t like it.  The first being that I acquired a small chemical burn from the chemical cleaner that we were using to clean the lab.  I accidentally sprayed some of the cleaner on my forearm and about thirty minutes later, I had four or five nickel sized whelps on my arm.  They are now just a few red spots on my arm, but it has been over a week since it happened.  The second thing I had a problem with was that one of the other people I work with somehow managed to do practically no cleaning at all in a full eight hours.  He spent most of the day sitting at his desk chatting with everyone else in the lab while they cleaned around him.  When our bosses came back up to the lab, he continues to simply talk to them instead of clean while the rest of us cleaned our little tooshies off.  Well, needless to say, we cleaned and cleaned and he got the credit for it.  He has made procrastination a true art form.

I know this wasn’t exactly a fun or exciting post, but hey, at least I finally got around to making one!!!  Have a great day!!

About a year ago my company hired a new Chief Executive Officer (what the kids are calling a C.E.O.).  One of the things he started doing is taking five randomly selected people from the company out to lunch every month.  I was randomly selected for this month, so I get to have lunch with the CEO tomorrow (presumably at his expense, since he probably makes more than my annual salary every month).  I don’t really have any hard-hitting questions.  I suppose I could ask if we plan on hiring any more programmers in not-India... but I probably won’t.  Or I could ask something completely irrelevant, like what his opinions are on British literature from the early eighteenth century.  But I probably won’t do that either.  I might post an update later this week, if there is anything worth blogging about.  I do think it’s a pretty cool thing for a CEO to do, even if he’s not exactly Bill Gates or Larry Page (we are something like a two billion dollar company though... I think).  He also has a rule that none of the people invited to lunch can be the boss of any of the other people (so I guess it isn’t purely random).  Which is good, I’d say.

At work, several people have left in the last year or so, and no one has been hired (at least, no one in not-India) to replace them.  This has resulted in several empty cubicles with equipment sitting in them going unused.  So a few weeks ago, just before Christmas, I took an extra monitor that was just lying around and set up my computer for a two-screen display.  You may recall from a previous post that I have four computers under my desk.  Well I came up with a way to use two switch boxes to give myself access to three of the four machines (the other I’ll still use remote administration for), while still keeping my main machine outputting on two screens.  Check out my schematic (blue lines are video, black are keyboard/mouse):

If that seems a little complicated, that’s because it is. :)  Here is a table of which switch box needs to be switched to what in order to use different arrangements:

The only problem I’m running into is from daisy-chaining the keyboard from one switchbox to another.  The mouse seems to work okay though.  Maybe it’s because the mouse is natively USB, but the keyboard runs through a PS/2->USB adapter (these are USB-only switch boxes).  I suppose a four-way switch box would be a much better option, then I could just have one screen run straight to my main computer and run the switchbox on the other.  But I wanted to do this without having to ask IT for any stuff that isn’t lying around in empty cubes.

I’m currently using the top half of this image as my two-screen display (as seen below).

So I mentioned quite a while back that I had been reading The Daily WTF.  Well a little over a year ago I sent something in.  Not bad code, but a funny story about an interview experience I had.  Last Friday (on my birthday, ironically), Alex (who runs the site) decided to run my story along with four other interview stories.  He also decided to take a poll of which story was the best, and the submitter of the winning story would win a bean bag chair from Sumo Lounge.  Well my story won (seen here, the one titled “Are You An Astronaut?”).  Be forewarned:  the version of the story shown on the site has been edited a little bit from what I sent in (which will be faithfully reproduced at the end of this post).  I kinda feel bad that I stopped reading the site a few months ago because I got bored with it... but I got an e-mail this week saying that I won an Omni bean bag chair, I just needed to pick a color (I went with Charcoal Green).  These things are supposed to be pretty nice (and at $150, they’d better be!); I’ll be sure to let you, o faithful reader of my blog, know what I think of it.  Hopefully the blonde comes with it.

As promised, here is the original version of the story that I sent in:

Fresh out of college, I was interviewing for a junior programming job at a company that develops software for aerospace/automotive companies.  So far the day was going well.  I interviewed for about an hour with someone from HR, then interviewed for another hour with the person who might be my manager, and that interview went really well.  Then to close the day I interviewed with the project manager (the previous manager’s manager).  Again, things were going well.  There was a lull in the interview where the guy was looking up something on his computer, so I started looking at the things he had up around his office.  On one wall he had a collage of NASA stuff.  Without thinking, I guess to make conversation or something, I asked him if he was an astronaut!  It was one of those situations where I was regretting it even as it was coming out of my mouth.  He looked at me like I was retarded, then said “no, I was a project manager at NASA.”

As it turns out, I was somehow still offered that job, and it’s where I’m working now (a little over a year later).  I don’t know if the guy remembers me asking that or not, but he’s my manager’s manager so I don’t really see him that often.

Here is a database query that has a potentially huge problem:

1

select * from users where username = '$username' and password = '$password'

If you’re not a programmer, bear with me, I’m sure you can still follow the problem here.  In the line above, $username contains the value the user gave for their username, and $password contains the value given for their password.  Let’s say my username is “kip” and my password is “12345”.  That gives us:

1

select * from users where username = 'kip' and password = '12345'

So far so good, a database can execute that just fine.  But what if my password is “My dog’s name is spot”?  That gives us this:

1

select * from users where username = 'kip' and password = 'My dog's name is spot'

See the problem?  The database will think the password is just “My dog”, since there is a single-quote in the password.  It will additionally not know how to handle the rest of the statement and probably return an error, preventing the user from ever logging in.

Nothing I’ve said here of this should be news to a programmer.  In introductory programming courses, students are often asked to write a program where the user is asked for input (let’s say, a number from 1-10), and the program must not fail if the user enters something entirely different (let’s say, “judicious”).  What is happening in my example is in no way fundamentally different.

If you’re thinking to yourself, “Hey Kip... you’re not writing this post because you just figured this out... are you?”, rest assured that I am not.  I am writing this because (a) I like to pretend that my blog has more than a dozen readers; and (b) because I have seen several sites discussing this type of bug lately.  The implication is that many programmers—presumably the paid, professional types (not just amateurs)—would put user input inside single-quotes without entertaining the possibility that the user might enter text with single quotes in it.  It seems like one of those things that you shouldn’t need to be taught—you should logically know to validate user input, even if you have never received formal training in programming.

Thus far, I haven’t even talked about the security hole caused by this code:  someone could intentionally use a single-quote in their password to exploit this bad code.  For just one of many examples, giving a password of “‘ or ‘abc’ = ‘abc” will let you into any existing user’s account (this is called SQL Injection).  I can understand why a programmer might not see that security hole immediately.  But the security hole is just an abuse of a bug that a logical human being should have seen in the first place.

</soapbox>