Skip to main content

Assert This!

Long ago we all went to college and learned about the assert() function in C and later, C++. At the time, assert() was a great little tool for quickly bailing out of your program when you thought it could not finish.  I used it when my calls to malloc() would fail.  Lately, though, I’ve seen commercial software vendors proclaiming their use of assert() as a way of writing safer code.  This is madness.

First of all, the assert() function is just a print and exit macro.  Your assertion message is printed to the tty, and then your application exits with an error code.  That’s it, no segmentation fault, no core dump, nothing else, just exit.

Imagine your surprise when your favorite game all of a sudden just exits back to shell right in the middle of fighting the super.  You would likely not play that game again.  When there’s a GUI, the tty is redirected to the /dev/null device, which means there is no output.  So much for that assert message getting to your users.

Now let’s imagine a more sinister scenario that is commonplace today.  You are using a library in your web application that performs something like PDF generation.  It works just great until one day all of your web sites crash for no reason.  If you’re like me, you have them programmed to send you email when they fail, and now you’ve got a thousand emails in your inbox and more waiting at the server.  Plus, your client is calling you asking why your crappy software doesn’t work.  Crap!

No logs are generated, nothing written to the web server’s error log, nada.  Only when you find the system log (or the Event Viewer in Windows), do you see a lone message from your library proclaiming “assert() at line XX in a/b/c/d.c raised.”  Wonderfully descriptive and helpful in diagnosing why the assert() was triggered.

Worst of all, you have to restart the entire web server, kick out what could be thousands of users to your site, and hope that it won’t happen again. To rub salt in your wound, your client has lost what could be thousands of dollars in business.

When this happened to me, I contacted the software vendor about their assert().  They only responded with “give us a sample program that demonstrates the problem.”  Uh, hello? Either they are completely clueless about when to use assert(), or else I am missing something.  The purpose of the assert() is to catch instances where your program can not continue.  That should be less than 0.001% of the processing time.  It would be impossible for me, or anyone for that fact, to reproduce a sample program that exemplifies the assert!  So I pressed them further and made them actually investigate the problem.  In this case, their library could not handle multiple objects with the same name in the PDF catalog.  Instead of throwing an exception, they just asserted!  Yeah, asserted an ERROR condition.

Too many times, young programmers who are fresh out of college think that what they learned can be directly translated to a commercial product. We all know that this is not the way to produce commercial software.  So, bad on me for paying for that software, but bad on them for not knowing better.  The Internet has made it far too easy for mediocre programmers to produce even more mediocre software at a price that is comparable to that paid to exceptional programmers.  The next time you are in the market for a PDF library, stay clear of ABCpdf from WebSupergoo.  They use asserts when they should be using exceptions.  That misunderstanding will cost you more than the $500 they charge for their software.

Popular posts from this blog

DNS Custom Logs and selinux

If you google "named custom logs selinux" you will find quite a bit of chatter about setting up custom logs outside of /var/log for DNS (named). These posts are interesting, but they tend to be run on posts about learning selinux and becoming an expert on named. What you need to know? If you have setup custom logging locations in your /etc/named.conf file, such as:     channel default_file {         file "/var/log/named/default.log" versions 3 size 5m;         severity dynamic;         print-time yes;     }; Then you will likely see errors like this in /var/log/messages: Oct 26 11:41:13 namedsvr setroubleshoot: SELinux is preventing /usr/sbin/named from write access on the directory /var/named/chroot/var/log/named. For complete SELinux messages. run sealert -l 6eab4aaf-e615-4ade-9e88-4efdc789eaf2 Then you run the sealert command as suggested by the very friendly selinux audit log and you are told: #============= named_t ============== #!

THE RISE OF FASCIST SOCIAL MEDIA

The Merriam-Webster dictionary defines fascism as: a tendency toward or actual exercise of strong autocratic or dictatorial control .  The phrase "dictatorial control" is important for the case that I am going to make about fascism in social media. The word "dictatorial" means "of or relating to a dictator," and a dictator is "one ruling in an absolute and often oppressive way." In 2020, social media has seen a rise in the number of autocratic events of censorship. The two social media outlets that I am going to focus on are Facebook and Twitter.  Background Facebook is a semi-private curated blogging platform where you, the user, share information at your leisure. The public part of Facebook is in Facebook Groups. With a group, outside people who are not privy to your "Facebook Wall" will join your group and establish a communal discourse. This can be private, by invitation only, or public. The Facebook is auth-walled so that you must

Outlook Configuration

To read all email in text and be able to extract the mail using mail headers: > regedit HCU/Software/Microsoft/Office/16.0/Outlook/Options/Mail   MinimalHeaderOn = 0 (dword)   ReadAsPlain = 1 (dword)   SaveAllMIMENotJustHeaders = 1 (dword) restart Outlook afterwards, maybe even reboot just for good measure. Now you get to see all of those phishy urls in the emails and you can get all of those embedded image attachments as raw encoded binary when you get the header details on the message. Put the Message Options button in the hot button task bar so you can quickly get this info. No more phishy phish from the numbskulls. I take payment in coffee. It's been a long time since I've had Jamaica Blue Mountain. Just saying. If you know how to disable the jpeg thumbnail render of attachments, please share on twitter. That's an obvious vector.