Woeing Starliner still stuck

>sad-trombone-noises<

tromboeing

Ooooo

OOOOO thjats BRILLIANT !!!

Tweet that shit up and go viral !

do it do ti do it

Odd (and inconsistent) behaviour with datetime/datetime2 comparisons

Mixing data types was a mistake

Demo: dbfiddle.uk/kGKQQRA7

I hope they fix that soon. Different results with and without an index is just embarrassing

Oof

🗿

Bugs were a mistake

Get Things Right First Time

datetime is just a super-confusing type to work with

resolution is 1/300s ('tick') but it's rounded for display to .000, .003, or .007

just a mad scheme

Yes. This was one of my earliest SQL memories. Using closed-open intervals for time filters

@Zikato You find this intuitive? dbfiddle.uk/H8Ik8GMu

(sorry for pings)

absolutely not

the commas are trailing

Isn't this principally the same problem as float vs decimal?

SELECT
    IIF
    (
        CONVERT(datetime, '2000-01-01 00:00:00.003') > CONVERT(datetime2(7), '2000-01-01 00:00:00.0033333'),
        'Yes',
        'No'
    );

That prints 'Yes' 🤯

Math is hard

This is crazy

SELECT
    DATEDIFF_BIG
    (
        NANOSECOND,
        CONVERT(datetime2(7), '1900-01-01'),
        CONVERT(datetime2(7), '1900-01-01 00:00:00.0033333')
    )
    / 100
    * 3;

SELECT
    DATEDIFF_BIG
    (
        NANOSECOND,
        CONVERT(datetime, '1900-01-01'),
        CONVERT(datetime, '1900-01-01 00:00:00.003')
    )
    / 100
    * 3;

Both those return 99,999

But the internal calculation in sqlTsEs!CXVariantPerformCompare<61,42>::Compare returns 100,000 and 99,999

Where type 61 is datetime and 42 is datetime2

WTF

Similarly, 1900-01-01 00:00:00.007 as datetime = 200,000 but 1900-01-01 00:00:00.0066667 as datetime2(7) = 200,001

No wonder index equality seeks don't work

Fair enough (sort of) if we're treating 1/300s as an infinite decimal, but that means there's literally no datetime2 value that will compare equal with a datetime value ending in .003 or .007

My conclusion is that this is by design. The rewrite for an index seek with a datetime column and a datetime2 value is bugged. It computes the wrong range. Either the same exact value which can't exist, or both boundaries the same when they should be the closest points outside the datetime value in both directions.

@SeanGallardy Did the compiler change strictly only affect floating point operations?

@PaulWhite wow...

@PaulWhite AFAIK it affected everything

It's been a few years and I've seen inlining not happening, stack usage quadruple and cause overflows, etc.

@SeanGallardy Thanks. I suppose that means there's a faint chance this is a compilation behaviour change, but I'm sticking with my primary conclusion for now

One of the biggest issues with the compiler upgrade was the way destructors work (or, didn't work)

Who relies on destructors anyway

(yikes)

Not QO/QE/QP

What's all those scalar deleting destructor and vector deleting destructor things then?

Replacements?

I can barely spell C++, remember

Not entirely sure in their area to be honest. I just know that I'm not supposed to assume that any destructor would run in their area upon query completion/cleanup.

Oh right, that

I'm just more used to seeing ~

Yeah, and then there was the change to how destructors throw

That caused a lot of issues

There was an uptick of floating point items in 2019 IIRC but I havent seen many in 2022

I would think throwing an error in a destructor would be bad

Apparently it didn't used to be, but now it is :D

Some of these meetings the people really get deep into the C++ spec and I tend to zone out

'finally'

I can do ~30 minutes of it, but after 1.5 hours I'm just mentally drained

Also because most of the meetings are from 6-8pm my time, so I've already put in 12 hours

I've heard that if you really get deep enough into it, almost everything's undefined behaviour

That's basically correct

How did Raymond put it?

Pithily, I bet

"Undefined bahvior vs ill-formed behavior"

Must be someone's idea of fun

devblogs.microsoft.com/oldnewthing/20240802-00/?p=110091

Also, did you see these gems?

feedback.azure.com/d365community/idea/…

feedback.azure.com/d365community/idea/…

@SeanGallardy What?!

How do you deal with stuff like this

I literally was one of the people who dealt with that and I was like... wtf is this?

Basically asking for a way to cherry pick what fixes they want to what version they want.

I hope they have an enormous budget

Like tens or hundreds of millions

I suspect they do not

It basically came down to the fact that they have no patching policy for their customers, some of which had a GDR update applied because no IT admins at their facilities disabled SQL updates via Windows Update (which is GDRs only for unpatched systems) and they were complaining that they can't "certify" a specific CU because it takes this company over 1 year to "test" their software on a CU.

Yes, well I'm sure they can have the custom builds they want for a few hundred million

Or, they could operate like a sensible vendor

:D

Alright, trying to mess with git patch and git apply, this won't end well.

> If a program contains IFNDR, the standard imposes no requirements on the behavior when you run the resulting program. The program is fundamentally invalid, and no good will come out of running it.

Raymond is awesome. My facebook friends will be sooo glad I posted that article.

@PaulWhite i wanna do a video to boost martin's bug report. mind if i used your demos in it? (all credited of course)

@ErikDarling Of course I don't mind

Feel free to tidy or modify as you feel

Windows calculator tells me 1/300 = 0.00333333333333333333333333333333

@PaulWhite thank you

All my valuable IP lost

It's a sad day

Serves me right for contributing it CC BY-SA, I suppose

I should make yous all subscribe to my chat room

we already do

hm

But did you ring the chat bell?

Or even follow?

I'd say leave a comment for the algorithm, but Paul doesn't like comments

ok, git format-patch and apply failed spectacularly as expected. This is dumb.

git is dumb

that's why it's called git

git -quit

git -out

git -gone

Git innit?

tig

Crowd Strike finally provided some real details

> On July 19, 2024, a Rapid Response Content update was delivered to certain Windows hosts, evolving the new capability first released in February 2024. The sensor expected 20 input fields, while the update provided 21 input fields. In this instance, the mismatch resulted in an out-of-bounds memory read, causing a system crash.

Off by one 🤣

> Validation for the number of input fields has been implemented to prevent this issue from happening.

Super!

> Bounds checking was added on July 25, 2024, with general availability expected August 9, 2024.

Sounds advanced

crowdstrike.com/…

I'm surprised they didn't mention any interns

Did they buy everyone a happy meal as an apology?

Seems like it took a very long time to own up to a very common software bug

> Avoiding code paths with undefined behavior is something you do all the time.

// Check the pointer before using it
if (p != nullptr) p->DoSomething();

// Avoid division by zero
return (n == 0) ? 0 : 100 / n;

int a[5]{};
// Check array index before using it
if (n < 5) return a[n];

prescient

You have to czech every angle so you can spin it. Think of the shareholders

And why did Windows report such an obscure error code?

Almost all proprietary code is secret to avoid embarrassment

People were trusting a company that didn't validate array access to provide advanced threat detection

that's saying the quiet bit out loud

Just finished reading the detailed PDF

Still not clear how something that would fail immediately was not tested and released

perhaps it was AI

I suppose that's their way of saying the Template Instance wasn't tested

i've read some legal opinions that that might constitute "gross negligence"

and i don't mean wiping your hands on your pants

well, its certainly not "pro"

@PaulWhite But you see, they wined, dined, and blew the CSOs which is why everyone uses them

Wonder who approved that PR...

"I see here you were the three that approved this change..."

that assumes they are using source control, which at this point might be a leap too far

Probably using git

you would hope

I thought he was called Sean

@PaulWhite better explanation youtube.com/watch?v=JgKbe5tcgZ0

Yes off by one covers it too, but more specifically there was a wildcard match in a regex that used to work

Regex was updated to remove the wildcard

and then array[21] didn't work specifically because there was only 20 items in the array

whereas the wildcard just worked.

so yes its an off-by-one, in the same way that a headon carcrash is caused by a car in the wrong lane..... what put it there ?

I believe there were other issues than just that "official" statement, based on the dumps

100% agree - their RCA is about the bare minimum they can hope to get away with.

We wrote some shit code, tested it poorly, and let some gack get distributed worldwide

Its not the first showstopper either.... they ralphed all our redhat 9.4 hosts dead

fortunately we hadn't cut over to them

that was about 2 months ago

the really interesting stuff will come out during discovery in the law suits

unless it's gag ordered, of course

It'll be years till that happens cynic

Yeah the Delta lawsuit is hilarious, if you want some funny reads, go look at the public letters back and forth

I don't want to give my employer any ideas

Employers are only interested in bad ideas

fuck are they ever!!! I mean, they employ me !

we run crowdstuck too.

and 9 other items of security-ware too

Apparentyly we've got 4 years of logs in Splunk, but no active processing of anything. Its just archived "in case we need it"

Why not just drop it in a Glacier bucket then? Splunk isn't bulk data storage

Splunk sounds like it should be censored in this chat

Lest we're descended upon by teenage moderators

It seems to be a requirement for open source projects to have "catchy" and edgy names

> Are you -f- serious? Lowercase letters? Twitter, lowercase "t"; Google, lowercase "g"; Facebook, lowercase "f". Every -f- company in the Valley has lowercase letters! Why? Because it's safe. But we're not gonna do that. We're gonna go with Chuy, unless any of you gringos want to go out there and tell a guy with three assault convictions that we're not going to give him the money we promised him. Hm? That's what I thought.

@Criggie gotta bring the pizazz and razzmatazz

mmmm pizza