Any clickwrap license which:
(a) is longer than 1000 words, OR
(b) is longer than ten (10) times the height of the text box it is enclosed in, OR
(c) is displayed in a text box that uses less than 5% of the total display area and cannot be resized by the user for easier reading, OR
(d) cannot be selected for copying and pasting into another document, OR
(e) cannot be read before purchase,
IS AUTOMATICALLY NULL AND VOID.

Inspiration abounds, but today it’s the Firefox 3 clickwrap license window’s that fails (c) and probably also (a) and (b) which reminded me of this common UI issue.

Check out the 4th message in the thread, with the big code sample.

• Table based HTML layout, and no CSS at all? Check. Heck, the table width % values don’t even add up to 100%.
• SQL in the JSP? Check.
• Making a new JDBC connection for each page view, instead of using a connection pool? Check.
• Unescaped strings in the SQL? Check. (Not strings coming from the browser in this particular JSP page, but you don’t know where those strings originate. Why wouldn’t you escape it just in case?)
• Failing to use a prepared statement? Check. (That would also solve the escaping problem.)
• Using a string literal in a SQL or command line context, so you can’t log it beforehand? Check. Even better, the code makes a query string first, prints it (commented out), and then uses a different string in the actual query. Nice!
• Using the JdbcOdbc driver? Check. (From Sun’s JDBC Basics: The JDBC-ODBC Bridge driver provided with JDBC is recommended only for development and testing, or when no other alternative is available.) I’m guessing that the use of ODBC here is the only reason why the database username and password aren’t embedded in the code sample and posted for all to see.
• Empty exception catch block? Check.

I’d have a hard time coming up with a fake example of bad code that was worse.

But wait, what else has this person asked about?

No way. Yes! Error in Socket and File Writing!
The post includes the router’s username and password, and its configuration including:

• Its IP address, and all of the routes it contains, and all of its interfaces and where they go
• A couple of other passwords stored in the router
• A crypto key that appears to be to a VPN (looks like a pre-shared key, meaning not a public key but one that must be kept secret)!

I’m not gonna say “you get what you pay for” since open source software has served me very well, but I will say that you get what you bargain for. If your bargain includes not looking at the work product of the people you hire, which is to say, hiring the cheapest people available and not supervising them, you’re not going to be happy with what you get.

Of course, this could have been written by a U.S. citizen who works in a cube on-site and makes $200/hour. Point is, hire carefully, and supervise your workers. It seems simple when put that way, but it’s amazing how often companies are willing to hire software subcontractors carelessly (solely on price?) and then pay little or no attention to the resulting work, when the arrangement involves offshore outsourcing.

By the way, the IP addresses in the original post (with the awful code sample) are listed next to the name “Areva”, implying that this code is part of a project for Areva. Who is Areva? They make nuclear power plants. Sweet dreams!

So I’ve been in a state of analysis paralysis for about a week.

I was trying so hard to be clever and state of the art that I forgot to get something working.

Really, I have an admin login page that’s done poorly, and a list of user visits that is pointless but follows the RESTful paradigm that’s so popular nowadays. The admin login works, because I decided I didn’t care if it was pretty, I just wanted something to work front-to-back, HTML template to database, so I hacked it. The regular login doesn’t work, because I let myself get scared into trying to use advanced stuff that I don’t understand when I also don’t understand the basic stuff intuitively yet.

I dub this antipattern Prefactoring. If premature optimization is the root of all evil, prefactoring is the reason engineering-dominated projects tend to fall over sideways while the developers, like lotus eaters, are perfectly happy to keep playing with bright shiny new doodads and never get anything working.

I’m ready to get some stuff working (ugly code, but with tests so I know it works) now. I’ll refactor it later.

This section is at 21:12 in the podcast:

There are a couple of other interesting markets that I found as I was interviewing people for the book. One of the models was that we found that if there’s an entrenched Java shop that has religion, you’re not going to sell them on Rails; don’t try.

But there was a surprising customer set, and that’s the set of customers that’s been very conservative, and they’re just now getting into Java, and to learn Java they find that they have to learn this set of specifications that’s about 2-3 feet high, right? This stack of binders, you know?

“Okay learn this Servlet thing, which means you’ve got to learn this XML thing to deploy it. Oh this XML thing has added this Namespace thing and this Schema thing, and oh you need some kind of middleware, and the middleware is maybe the Spring framework, or Enterprise JavaBeans, so you have to pick which one. And then once you have that picked, then you have to plug the persistence engine into that. And oh, by the way, after you’ve picked one, and hopefully picked right, you have to do the web UI and model view controller layer and then you’re talking about JSPs. And oh what tag library do you want to use with that?” and it is just absolutely overwhelming.

Definitely. I feel lucky that I got started with Java before J2EE, because I kind of understand where JSP and EJB and XML came in and how they grew, and yet there are so many APIs in J2EE that I haven’t ever used, and honestly I don’t think I’ve ever met anybody who used them. It’s a beast. There’s a reason why startups that don’t need asynchronous message queues and “Java Authorization Contract for Containers” and all that stuff are sticking with PHP or Ruby on Rails. There’s just less stuff to learn.

The S stands for Simple, by Pete Lacey.