On: Social engineering takeovers of open source projec...

[tschwimmer]

>If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor.

Unforuntately it's easy to sandbag being dumb. Just because someone submits a PR defining constants for 0-999 does not mean they're actually bad at programming.

[vundercind → tschwimmer]

How incredibly wasteful.

You can form most useful numbers with just ten singe-digit constants, some casting, and string concatenation.

[peteradio → vundercind]

Indeed, in python you can just eval.

[andix → tschwimmer]

Sure, but being known for submitting bad code is going to make code reviews more thorough, not less. It's drawing additional attention to yourself.

[MenhirMike → tschwimmer]

> defining constants for 0-999

That person might just be an old school Java <5 developer.

[chipdart → MenhirMike]

That person might just be a regular Java developer who works on a project which onboarded Checkstyle, and can't disable it's MagicNumber check.

https://checkstyle.sourceforge.io/checks/coding/magicnumber....

[raxxorraxor → chipdart]

Man, I hate such tools. Do I run into problems when I try to convert seconds to minutes?

Larger problem than magic numbers ever could be.

[MenhirMike → raxxorraxor]

Yes! Anytime you see a function signature like "int timeout", it's safe to assume that the unit is in femtoseconds and pass a gigantic number while you curse out the incompetence of the developer. Either name your variables correctly (timeoutZeptoseconds), or use a proper data type (like a Duration or Period in Java, TimeSpan in C#, or a user-defined literal in C++).

[andix → chipdart]

Oh, now I get why you need those constants:

  var secondsPerWeek = Math.pow(2, SEVEN) * Math.pow(THREE, THREE) * Math.pow(FIVE, 2) * SEVEN