Skip to content

Comment on How Primedice was exploited for $1M in Bitcoinparent

Comments

Testing is important, but I don't think that's enough for this sort of problem. What this needs is in-depth code review. Tests are only as good as the tests you write, and if there was no test to account for this particular issue nothing would have been caught.

For concurrency issues someone thinking real hard is as important as testing.

someone thinking real hard is as important as testing

With one caveat.

The "thinking real hard" has to happen before and as the code is written.

If you try to catch fundamental design problems and misconceptions during a code review, you're much too late. At that point there is a "status quo" i.e. the existing code, and a defensive resistance to change, even if you can demonstrate clear problems with said code. The end result is band-aids on top of band-aids, rather than a proper solution to the problems.

Edit: the article itself alludes to band-aids:

   our developer had improperly patched the glitch
i.e. they attempted a quick fix, instead of understanding at a fundamental level the overall mistakes in what they were doing.
AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.