Hilarious Massive Facebook Privacy Flaw

February 25th, 2010

My girlfriend just acquired a strange bug with sending private messages in Facebook. Firstly, she tries to send a normal private message like so:

And then, it sends it to some completely random person that she’s not even friends with.

So much for "private" messages.

I tested it in a different browser on a different computer, and it still does the same thing, so it’s almost definitely a server-side problem. I also tested it on my account, but it isn’t happening to me.

When she sends a message to me, it gets sent to Chris Hughes who is a co-founder of Facebook! I wonder if that’s a coincidence. When she sends a message to her friend Rhi, it gets sent to another Harvard alumni named “Zach”. It doesn’t appear to be random, because the same intended recipient always produces the same actual (wrong) recipient.

We filed a bug report, so we’ll see how long it takes them to fix this one.

Update: It was fixed in about six hours or less. Not too shabby.

Update 2: All the stray messages have disappeared from the "sent" section, and hopefully from the inbox of the recipients.

SOLID Class Design: The Interface Segregation Principle

February 18th, 2010

This is that last part of a five part series about SOLID class design principles by Robert C. Martin. The SOLID principles focus on achieving code that is maintainable, robust, and reusable. In this post, I will discuss the Interface Segregation Principle.

The Interface Segregation Principle (ISP): Clients should not be forced to depend upon interfaces that they do not use.

Read the rest of this entry »

SOLID Class Design: The Dependency Inversion Principle

December 19th, 2009

This is part four of a five part series about SOLID class design principles by Robert C. Martin. The SOLID principles focus on achieving code that is maintainable, robust, and reusable. In this post, I will discuss the Dependency Inversion Principle.

The Dependency Inversion Principle (DIP): High level modules should not depend upon low level modules. Both should depend upon abstractions.

Read the rest of this entry »

SOLID Class Design: The Liskov Substitution Principle

November 21st, 2009

This is part three of a five part series about SOLID class design principles by Robert C. Martin. The SOLID principles focus on achieving code that is maintainable, robust, and reusable. In this post, I will discuss the Liskov Substitution Principle.

The Liskov Substitution Principle (LSP): functions that use pointers to base classes must be able to use objects of derived classes without knowing it.

Read the rest of this entry »

SOLID Class Design: The Open Closed Principle

November 14th, 2009

This is part two of a five part series about SOLID class design principles by Robert C. Martin. The SOLID principles focus on achieving code that is maintainable, robust, and reusable. In this post, I will discuss the Open Closed Principle.

The Open Closed Principle (OCP): You should be able to extend a classes behavior, without modifying it.

Read the rest of this entry »

SOLID Class Design: The Single Responsibility Principle

November 12th, 2009

This is part one of a five part series about SOLID class design principles by Robert C. Martin. The SOLID principles focus on achieving code that is maintainable, robust, and reusable. In this post, I will discuss the Single Responsibility Principle.

The Single Responsibility Principle (SRP): A class should have one, and only one, reason to change.

Read the rest of this entry »

Why Inline Comments Are Generally a Bad Idea

October 8th, 2009

Bellow is a single function commented in two different ways. Which one is better?

NSString* MD5StringOfString(NSString* inputStr)
{
	//UTF8 encoding is used so the hash can be compared with hashes of ASCII strings
	NSData* inputData = [inputStr dataUsingEncoding:NSUTF8StringEncoding];
 
	unsigned char outputData[CC_MD5_DIGEST_LENGTH];
	CC_MD5([inputData bytes], [inputData length], outputData);
 
	NSMutableString* hashStr = [NSMutableString string];
	int i = 0;
	for (i = 0; i < CC_MD5_DIGEST_LENGTH; ++i)
		[hashStr appendFormat:@"%02x", outputData[i]];
 
	return hashStr;
}
NSString* MD5StringOfString(NSString* inputStr)
{
	//convert the string to UTF8 encoded byte data
	NSData* inputData = [inputStr dataUsingEncoding:NSUTF8StringEncoding];
 
	//calculate the hash
	unsigned char outputData[CC_MD5_DIGEST_LENGTH];
	CC_MD5([inputData bytes], [inputData length], outputData);
 
	//convert hash to a hexadecimal string
	NSMutableString* hashStr = [NSMutableString string];
	int i = 0;
	for (i = 0; i < CC_MD5_DIGEST_LENGTH; ++i)
		[hashStr appendFormat:@"%02x", outputData[i]];
 
	//return the hexadecimal string
	return hashStr;
}

Read the rest of this entry »

Coding Tip: Replace Complicated Conditions With Boolean Variables

October 3rd, 2009

Consider the following if statement:

if(dragOperation != NSDragOperationCopy && NSPointInRect(currentMouseLocation, self.bounds)){
    //do something
}

Even though you may have worked out what the condition represents, it probably took you a little longer than it should. It’s complicated, making it time consuming to read, and prone to bugs upon modification. Thankfully, there is an easy remedy:
Read the rest of this entry »

MD5 Hashes in Cocoa

September 24th, 2009

Let’s jump straight into the code:

#import <commoncrypto /CommonDigest.h>
 
NSString* MD5StringOfString(NSString* inputStr)
{
	NSData* inputData = [inputStr dataUsingEncoding:NSUTF8StringEncoding];
	unsigned char outputData[CC_MD5_DIGEST_LENGTH];
	CC_MD5([inputData bytes], [inputData length], outputData);
 
	NSMutableString* hashStr = [NSMutableString string];
	int i = 0;
	for (i = 0; i < CC_MD5_DIGEST_LENGTH; ++i)
		[hashStr appendFormat:@"%02x", outputData[i]];
 
	return hashStr;
}

Now for the explanation.
Read the rest of this entry »

Coding Tip: Use The Ternary Conditional Operator

September 9th, 2009

The ternary conditional operator (?:) can be used as a short-hand version of an if statement. It is a feature of many languages.

For example, this code:

int height;
if(isTall)
    height = 50;
else
    height = 10;

can be better written as:

int height = isTall ? 50 : 10;

The ?: operator is good for replacing very simple if statements, but is bad for complicated if statements as it can harm readability.