News: 1745825406

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

What the **** did you put in that code? The client thinks it's a cyberattack

(2025/04/28)


Who, Me? Welcome to another Monday morning! We hope your weekend could be described in pleasant terms. That's what The Register strives for at this time of week in each installment of "Who, Me?" – the column that shares your stories of making decidedly unpleasant mistakes and somehow mopping up afterwards.

This week, meet a reader who asked to be Regomized as an "Anonymous European Developer" because he works as a DevOps engineer for a firm that creates software for governments and international institutions.

The Anonymous Developer's clients are all in the public eye, so any bugs or flaws are even less welcome than usual.

[1]

"Clients expect our software to be at the highest level of professionalism and quality," the Developer told Who, Me?

[2]

[3]

One day, a customer called to let the company know it had failed to meet that brief.

"They told us they were possibly the target of a cyberattack and requested that we take all their applications offline immediately, even ones unrelated to the symptoms."

[4]

The Anonymous Developer's company complied and set about investigating the incident, which manifested when users hovered their mouse above an interactive element on a web page, and it produced a tooltip that used very strong language to suggest users might enjoy performing a sex act.

"This application was quite a prestigious one and if users read the language, it would tarnish a public agency's image and could have easily become a matter for the press," the Anonymous Developer told Who, Me?

He also feared it could be fodder for meme makers, which could be even more humiliating – although this column fancies The Register would have been plenty humiliating if we had found this ribald tooltip on a government website.

[5]

The client assumed that the rude tooltip had been the result of an attack.

[6]Developer scored huge own goal by deleting almost every football fan in Europe

[7]Static electricity can be shockingly funny, but the joke's over when a rack goes dark

[8]Dev loudly complained about older colleague, who retired not long after

[9]Tech trainer taught a course on software he'd never used and didn't own

The Anonymous Developer investigated and was relieved to find no evidence of hacking or other evil actions.

But after delving through Git repositories, he found the culprit was one of his own junior developers who committed the tooltip a few years ago. Or maybe the whole dev team was to blame because nobody spotted the inappropriate text during several rounds of code reviews.

"The junior got a lecture about professionalism and the importance of not tarnishing the image of clients and the company," the Anonymous Developer told Who, Me? Then everyone else on the team got the same lecture.

"I have implemented a clever machine learning tool that scores each line of code for vulgarity and flags possible issues," he wrote. "It's now part of the static analysis toolset that all company code goes through and gets validated."

Have you been found out leaving inappropriate text in code? And what happened afterwards? Don't make another mistake by failing to [10]click here to email your story to Who, Me? As this week's column shows, we can be trusted to tell your tale without divulging your identity. ®

Get our [11]Tech Resources



[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aA9Ry8SfJO5OfN3j-xV_ugAAAJc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aA9Ry8SfJO5OfN3j-xV_ugAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aA9Ry8SfJO5OfN3j-xV_ugAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aA9Ry8SfJO5OfN3j-xV_ugAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aA9Ry8SfJO5OfN3j-xV_ugAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2025/04/21/who_me/

[7] https://www.theregister.com/2025/04/14/who_me/

[8] https://www.theregister.com/2025/04/07/who_me/

[9] https://www.theregister.com/2025/03/31/who_me/

[10] mailto:whome@theregister.com

[11] https://whitepapers.theregister.com/



Tubz

A colleague of mine had put together a PowerPoint for the top dogs and had used various placeholder names for information for us to put information that he formatted and on the last page he had a placeholder for "any other shit that the bean counting cretins will want" and yes never removed it. Thankfully it must have been a long day and nobody noticed but our boss giving the presentation and quickly blocked the screen before switching slides.

Anonymous Coward

Yup, seen something similar on a corporate presentation by the Worldwide company President, that had supposedly been collated and reviewed by multiple C-Suite people.

I can only believe that their heads are so far up each other's arses that they cannot read.

Doctor Syntax

"multiple"

That's the key word. Everyone assumes they don't need to do it because someone else will.

AKA "If it's everybody's job it's nobody's job."

Jamesit

"AKA "If it's everybody's job it's nobody's job.""

And we all now nobody's perfect!!!

Anonymous Coward

No, Pobody's nerfect.

that one in the corner

Ah, that explains why internal mail returned the nerfect to me, I'd addressed it to Peabody, down in Shipping.

Hope Pobody won't be upset, the nerfect's fur is looking a bit matted after a weekend in the Post Room.

Joe W

I met some suits that actually would have loved for this to stay in the final presentation... :D They will have a beer with you at a company event, be totally relaxed and cool, and join stupid team games.

(Those are the ones not with their heads up their own - or often their CEO's - arse)

I've never understood that

The Man Who Fell To Earth

In over 40 years of working in high tech, I've never understood people who put inappropriate language in code or presentations, even as placeholders. Murphy's Law ("Anything that can go wrong will go wrong.") should just scream at people that it's only a matter of time before it's going to appear at the wrong time in front of the wrong audience. So just don't do it no matter how funny you think it is.

Pascal Monett

Ah, PowerPoint.

As lead Notes developer in a company that was actively transiting to Sharepoint, Outlook and MSSQL (at least one good decision), I had been called upon to present the current uses of major Notes applications and the future of Notes in the company.

I dutilfully put together the memorandum of all the Notes applications being slowly decomissioned, but I just couldn't help my self and, on the last page of the page of the presentation entitled "The Future f Notes at ", I used [1]this kind of image as background with, at the bottom of the slide, the words "Any questions ?".

Even the IT director chuckled at that, so I consider it a total success.

[1] https://eu2-browse.startpage.com/av/anon-image?piurl=https%3A%2F%2Fwallpaperaccess.com%2Ffull%2F3302021.jpg&sp=1745828780Tece2c07c9bae81580ff901a5fbb33dfb8015786abffdb6b69aad2d7071634b4e

"Transiting"

An_Old_Dog

Did your company take the SCSI bus while "transiting" from Lotus Notes to SharePoint, Outlook, and MSSQL?

Anonymous Coward

> "The Future f Notes at ", I used this kind of image as background

Seeing you were f'ing Notes I was reluctant to look at the image, but then your IT director couldn't have been THAT laidback...

Inventor of the Marmite Laser

Direct link:

[1]https://wallpaperaccess.com/full/3302021.jpg

[1] https://wallpaperaccess.com/full/3302021.jpg

Cussing in debug prints

David Newall

Shocked, I'm shocked I say, to think that would ever happen!

Be careful where you type

SVD_NL

I once got the suggestion from higher-ups to allow some large customers limited access to our internal ticketing system to check on project progress.

I did a quick query and showed them some of the things our engineers say in there.

Sticking with weekly reports seemed like the better option to them!

Re: Be careful where you type

Ken Shabby

Always a good game, search the tickets for some choice words.

When the inevitable happens and they get consumed by an LLM, there could be some interesting responses.

Re: Be careful where you type

Doctor Syntax

You mean if you don't find any you add a few?

"Used very strong language to suggest users might enjoy performing a sex act."

Anonymous Coward

One often suspects in these cases it's only the strong language that is objected to... ;)

Paul Herber

"Anonymous European Developer"

I was hoping for a(n)

"Anonymous Regomised Software Engineer"

Most inappropriate message

Caver_Dave

In the early days of Windows we had a program that implemented all the error checking hooks that we could find.

If the user saw a Windows error message pop up and decide to cancel rather than OK the issue, then the our pop up would appear saying "Believe the Microsoft error message!". Any subsequent keyboard or more than minimal mouse movement would return the action that cause the original Windows error message.

I have often wondered over the years whether the text was appropriate.

Oliver Mayes

One of our order forms contained a hidden tick box called "shittyTicky", invisible until one of our customers read the page source and asked about it.

Unfortunately this tick box appeared to be crucial to the website and removing or renaming it caused the whole order system to stop working, we never did figure out why since nothing referenced it.

cookieMonster

One of those “temporary” fixes I’d imagine

Anonymous Coward

Just comment it as "More magic" and tiptoe quietly away.

Anonymous Custard

Sounds more like [1]an FTB issue to me...

Or possibly it's just out of cheese?

GNU Terry Pratchett

[1] https://wiki.lspace.org/Hex

Usually that box will be ticked ...

jake

... if the client is known to be more trouble than he's worth. In other words a client where the Boss is just looking for the final straw to fire them.

The person(s) ticking/accessing/referencing it is likely one with the power to get rid of trouble. They will rarely speak of it.

Usually it will only be visible internally; making that source accessible to the clientele is contraindicated.

Yes, there are much better ways of going about this, but when all you have is a hammer ...

NO! The customer is NOT always right! Sometimes firing them will save a company much money. Recommended.

Giles C

On internal documents I tend drop easter eggs into long documents - a recently design document for the wireless network ran to 80+ pages. Halfway through the document is a reference to new SSID names (which were very silly), and the description of why roaming needed to use a common platform with a multi building campus. The reason given was "better snacks" as for why someone would move between buildings.

However I keep them clean, rather than anything too rude. Although in a previous job I did write in a document that my named boss won't have read this far.... He did and when mentioned I just said it good at least you read until the end...

Strahd Ivarius

It reminds me of the time at a bank where the head of implementation was complaining at a high level meeting that the dev team was providing implementation documents writing with dingbats or the like.

The head of dev answered that since it was obvious that the implementation team was not reading the documents anyway, it had been more that 6 months since he asked his team to change the font for all documents sent to implementation, and it took that time before anybody noticed it...

Neil Barnes

Shades of an 80's compiler (?) which included a free money voucher deep in the instruction manual... it was never claimed.

jake

A friend of mine included a README file in a rather popular shareware title that he wrote. It consisted of one line of text ... roughly "Congrats! If you are reading this, you have won $100! Send email to to collect!".

In the 10 years that he had that email address (roughly his college years), he had no takers. Not one.

Note: This was back in the early 1980s, when $100 was actually a fair amount of money and shareware users were mostly computer literate.

Anonymous Coward

We regularly used to perform peer reviews on stuff destined for customers eyes.

I sent a colleague one document and made the remark "I'll know you've read it all if you find where I've put 'big horses todger'.'

I kept half an eye on him as he read through and gleaned a satisfying reaction when his expression said he'd found it.

(And no, it WAS removed before sending to the client)

Colourful Comments in Code

Michael H.F. Wilkinson

I put some choice words in code comments when I had (yet again) to create a workaround for some bug in MS Pascal. One example was that in a linked list with an even number of of nodes, the statement

current := current^.next^.next;

(i.e. jump forward two nodes), and the code snippet

current := current^.next;

current := current^.next;

produced different results. The former caused random crashes, the latter worked flawlessly. I added some quite colourful comments at this juncture.

In a similar vein, the natural logarithm function was extremely inaccurate. I had to call the version in the MS C library to get correct results. Again, various swear words emanated from my office, and quite a few were included in the comments in the code. They didn't end up visible to users, but were available to any programmer bothering to read the documentation thoroughly.

Re: Colourful Comments in Code

Strahd Ivarius

MS Pascal ?

How to say you are an old IT guy, without saying you are an old IT guy...

Was it on CTOS per chance?

Re: Colourful Comments in Code

An_Old_Dog

How to say you are an old IT guy, without saying you are an old IT guy...

How about, "I used Pascal/MT+ on 8080-based computers", and "I learned FORTRAN on an IBM 1401"?

"I learned FORTRAN on an IBM 1401"

ChrisElvidge

CDC 7600 in my case.

Re: Colourful Comments in Code

Joe W

I used to joke with a colleague that while I learned Fortran (95) he leraned FORTRAN (no year given...)

He was actually quite happy that a young lad learned "the ways" and did complicated stuff that actually got better results than he did. Wonderful guy. Allergic to BS and could then be quite... yeah.. abrasive to say the least. As I said: wonderful guy

Re: Colourful Comments in Code

GeekyOldFart

There was one time when a long-standing bug in a different package, developed in-house but by another team, had gone unfixed for so long it had whiskers.

Then a colleague of mine realised that as a "fresh set of eyes" on it, each of the two teams led the code review of the other's changes. So, every time his code called the other package's API he'd have a comment along the lines of "They still haven't fixed this. Apply dodgy workaround AGAIN."

After a month or two of this it was suddenly fixed - and in the comments of their code when we reviewed it was "Shut up, [colleague's name]"

"Clever" machine obscenity detection...

Anonymous Coward

"I have implemented a clever machine learning tool that scores each line of code for vulgarity and flags possible issues,"

So we're in danger of locking all the people in Scunthorpe off your system! (as legend has it has happened before).

Re: "Clever" machine obscenity detection...

Anonymous Custard

Or Penistone, Staines, Clitheroe, Twatt (in the Orkey islands) and any number of cum locations all over rural England...

Re: "Clever" machine obscenity detection...

Alan J. Wylie

I once had an email blocked by one university because it referenced [1]The University of Sussex (or was it [2]Essex?)

[1] https://www.sussex.ac.uk/

[2] https://www.essex.ac.uk/

Candid error message

Prst. V.Jeltz

I wrote a script that the desktop support staff would use to remotely query a machine via WMI and it would return lots of useful info: whose on it, the phone number of whose on it , uptime, OS ver , where it is , IP address , etc etc .

.

...UNLESS there was some kind of DNS error / conflict , when the script would establish that it had been routed to the wrong machine , apologise to the user and suggest they go and berate the server team responsible for the DNS tables.

Captain of server team was less than impressed when they themselves were using the script for something and this occurred .

funny code comments

Anonymous Coward

I've been known in the past for putting funny comments in my code, yes. Nothing any end users had any chance of seeing, though, like comments in C code.

Not vulgar or inappropriate but funny vs. other team members.

The satisfaction came, when those were unearthed, 10 years later, and an ex-colleague told me he had a good laugh, when porting said code to a new platform :)

The crudeness was ok, but not the trace message

Anonymous Coward

Back in the 80's I joined a team to work on an Expert System shell for the IBM PC, which already had a few less than professional messages coded in:

If the engine hit a problem, the status/progress box recorded that "shit" had happened; if the problem was in the text-UI-handling code then it was "deep shit" (the devs up to that point were happy with the maths in the engine but weren't great with UIs!).

But those weren't what I recall having a user complaining about (well, we did *try* to fix those problems and stop the messages before a release).

One of the small demo scripts was to decide "which sport would you prefer?", so "football" or "tennis" or "running" or ... The user was upset that, no matter what he input, it always gave the same suggested sport - so how could he trust the decision engine was working and could run his own script properly?

Turned out that when the script completed, it did a fast traversal up its stack and, as this in C code, the status text was given to the user was that we had decided to do - the "long jump".

Why always build Client DBs from Scratch

Anonymous Coward

Many years ago, I was told this second or third hand - Software company setting up the Phone booking system for a cinema, and rather create a clean database they used a copy of a internal test database.

First phone call was made by CEO and the audio message describing the film was "this film was s*** I don't know why anyone would see it" - now add customer was Disney related, lets just say someone got sacked over it.

Lesson - always keep things clean and nondescript, you never know who'll see/hear it.

::perks up::

jake

"I have implemented a clever machine learning tool that scores each line of code for vulgarity and flags possible issues,"

Challenge accepted.

Juha Meriluoto

I was once in a team developing some research software, in times when a '386 at 33 MHz was considered high-end hardware. As M$ C 6.0 memory allocator was a piece of cr*p we had to work around it... When the workaround ran into an impossible situation, it would give a 'Red Screen Of Death' saying 'Fatal internal system error: Press any key to reboot, or any other key to continue.'

Not rude but still hard to look the user in the eye

Anonymous Coward

Writing a UI to fit a text-mode screen, added an INI file guard to enable turning on extra config features for developers to use, like being able to replace an area of the display with internal stats, enabling commands/actions that were useful but could cause damage if not used carefully, search options we thought were a bit complex for the user. The normal sorts of things that make life easier. No guard entry, no developer mode and these features' config options were inactive.

Until the inevitable, when it is realised by our consultants that a few of these features would be really useful to the clients' installs: "Does it work with the versions they already have?"

"As it happens, yes, yes it does. All you do is add "enable-xxx" to the INI file (in those days, users were quite capable of editing INI files) just replace "xxx" with the name of the feature, here is the list of the safe(ish) items."

"Sounds good; ah, you're looking a little shifty, is there anything else I should know?"

"Um, well, you see, to actually allow any of these to work, you have to tell the program to run in developer mode"

"And?"

"You tell the user to put at the top of the INI file, um, ah, the line"

"Yesss?"

"MeProgrammerYouJane"

""[1]

[1] note: this predates HTML and you didn't need to pronounce the closing slash in those days.

In the logfiles...

K555

I can't quite remember the exact text or circumstance now, but in the OpenVPN implementation of some old Yealink handsets, if it couldn't connect because of (IIRC) some generic issue like lack of DNS resolution, the line in the log said "shit happd"

Persistence in one opinion has never been considered a merit in political
leaders.
-- Marcus Tullius Cicero, "Ad familiares", 1st century BC