A single line of code cost $8000

https://pietrasiak.com/one-line-of-code-that-did-cost-dollar8000

by lordfuckleroy • 1 year ago

305 408 1 year ago

pietrasiak.com

nikanj2• 1 year ago

With public sector procurement, $8000 is a pretty standard price for a line of code.

ant6n• 1 year ago

Do you mean "a" line of code, or "each" line of code?

nikanj2• 1 year ago

A dead-simple 1000-line app? $8 million from Accenture, IBM or similar

saretup• 1 year ago

Not to mention the cost users paid to download 250 MB every 5 minutes.

pests• 1 year ago

It was mentioned, at the bottom. One customer even had their ISP cancel their service.

ghurtado4• 1 year ago

It seems a bit self centered to make their lost $8000 the focus of the article.

The title should have been: "how a single line of code cost our users probably more than $8000"

stevage10• 1 year ago

Totally. I live in a place where many (most?) ISP plans have limited monthly downloads. I'd be so pissed off if my monthly allowance was blown by this series of boneheaded decisions.

poleguy• 1 year ago

Ever consider not using cloud for everything? Hosting this on traditional hosting would have limited the problem and the cost.

M95D• 1 year ago

And in that case, the problem would not be discovered until 1) someone opened a bug report, which rarely happens, because any competent user would just disable auto-updates, and 2) that bug report would be investigated, which also rarely happens.

cess11• 1 year ago

It's not like you are forbidden to monitor your services just because you didn't put them in big clown.

jarym• 1 year ago

Just amazed that ‘better testing’ isn’t one of the takeaways in the summary.

Just amazed. Yea ‘write code carefully’ as if suggesting that’ll fix it is a rookie mistake.

So so frustrating when developers treat user machines like their test bed!

fifilura• 1 year ago

Contrarian approach: $8000 is not a lot in this context. What did the CEO think of this? Most of the time it is just a very small speed bump in the overall finances of the company.

Avoidable, unfortunate, but the cost of slowing down development progress e.g. 10% is much higher.

But agree that senior gatekeepers should know by heart some places where review needs to be extra careful. Like security pitfalls, exponential fallback of error handling, and yeah, probably this.

stevage10• 1 year ago

I'm sure it cost a lot more than $8000. That was only the direct visible cost to them. There were likely users hit with costs for the additional downloads, who never even knew what was the issue. Users working on a mobile hotspot who had to pay for extra data etc etc.

rvz8• 1 year ago

Imagine if that was Meta that had over 1B users with their messenger desktop app update functionality that did just that. The loss would be in the hundreds of millions.

But agree that senior gatekeepers should know by heart some places where review needs to be extra careful. Like security pitfalls, exponential fallback of error handling, and yeah, probably this.

The lesson here is much better use of automated tests (The app likely has no tests at all) and proper use of basic testing principles like TDD would prevent such junior-level embarrassing bugs creeping up in production paid software.

That is the difference between a $100 problem vs a $200M problem.

See the case of Knight Capital [0] who lost $460M, due to a horrific deploy.

[0] https://www.henricodolfing.com/2019/06/project-failure-case-...

latexr7• 1 year ago

What did the CEO think of this?

I doubt there’s a CEO. Despite the use of “we”, pretty sure this is one guy building the app. All the copyright notices and social media go back to one person.

Klaster_1• 1 year ago

How do you adjust your testing approach to catch cases like this? In my experience, timing related issues are hard to catch and can linger for years unnoticed.

doix• 1 year ago

I would mock/hook/monkey patch/whatever the functions to get the current time/elapsed time, simulate a period of time (a day/week/month/year/whatever), make sure the function to download the file is called the correct amount of times. That would probably catch this bug.

Although, after such a fuck up, I would be tempted to make a pre-release check that tests the compiled binary, not any unit test or whatever. Use LD_PRELOAD to hook the system timing functions(a quick google shows that libfaketime[0] exists, but I've never used it), launch the real program and speed up time to make sure it doesn't try to download more than once.

[0] https://github.com/wolfcw/libfaketime

01HNNWZ0MV43FF3• 1 year ago

Similar to doix said, consider reading the time as IO and then rewrite the code in sans-IO style so you can inject the time.

Then it's a unit test that looks too obvious to exist until you read the ticket mentioned in the comment above it

No need for monkey patching or hooking or preload

But before that you add a couple checkmarks to the manual pre-release test list: "1 hour soak test" and "check network transfer meters before and after, expect under 50 MB used in 1 hour (see bug #6969)"

In Linux they're under /sys/class/net I think

ikiris2• 1 year ago

I imagine they’d have to start testing first…

coip4• 1 year ago

not to ~dupe my top-level comment, but ETag headers can be used to manage this from a ~caching perspective

hbsbsbsndk2• 1 year ago

I worked on a product where there was basically no automated testing, just a huge product surface to click around with a bunch of options. Because of technical debt some of the options would trigger different code paths, but it was up to the developer to memorize all the code paths and test accordingly.

After I shipped a bug the Director of Engineering told me I should "test better" (by clicking around the app). This was about 1 step away from "just don't write bugs" IMO.

stevage10• 1 year ago

Yep, my first job was at a company like that. Huge Windows desktop app built in Delphi. No automated testing of any kind. No testing scripts either. Just a lot of clicking around.

stevage10• 1 year ago

Just amazed that ‘better testing’ isn’t one of the takeaways in the summary.

I don't get the impression they did any testing at all.

jlarocco2• 1 year ago

They were using a typed language, so testing was unnnecessary ;-)

rvz8• 1 year ago

Quite shameful if it was a language based on Javascript with zero tests in 2025.

256_2• 1 year ago

I don't think the author is wrong for saying that certain kinds of code should be written carefully. I object to the implication that other code shouldn't.

From TFA: "Write your auto-updater code very carefully. Actually, write any code that has the potential to generate costs carefully." So the focus is on code that "generate[s] costs". I think this is a common delusion programmers have; that some code is inherently unrelated to security (or cost), so they can get lazy with it. I see it like gun safety. You have to always treat a gun like it's loaded, not because it always is (although sometimes it may be loaded when you don't expect it), but because it teaches you to always be careful, so you don't absent-mindedly fall back into bad habits when you handle a loaded one.

Telling people to write code carefully sounds simplistic but I believe for some people it's genuinely the right advice.

danpalmer• 1 year ago

We decided to take responsibility and offer to cover all the costs related to this situation.

Good on them. Most companies would cap their responsibility at a refund of their own service's fees, which is understandable as you can't really predict costs incurred by those using your service, but this is going above and beyond and it's great to see.

weird-eye-issue• 1 year ago

"Luckily, it was not needed"

jer0me• 1 year ago

(2023)

cyprx• 1 year ago

meanwhile the CTOs plan to apply AI into their production codebases :)

spaqin• 1 year ago

I would also put into question if you _really_ need to check for updates every 5 minutes. Once per startup is already enough, and if you're concerned about users who leave it on for days, it could easily be daily or even less often.

ghurtado4• 1 year ago

IIRC, Every 5 minutes used to be the standard interval between email checks, back in the days of dialup and desktop email clients.

How the times have changed ..

lucb1e• 1 year ago

It's near-instant now not usually because of more incessant polling, but because it simply keeps the connection open (can last many hours without sending a single byte, depending also on the platform) and writes data onto it as needed (IMAP IDLE). This has gotten more efficient if anything

pjmlp2• 1 year ago

And because how expensive they were in Portugal, I never done it, it was always on manual.

atoav2• 1 year ago

Yeah but that should be a variable anyways. Maybe even a variable provided by the server.

atoav2• 1 year ago

Yeah but that should be a variable anyways. Maybe even a variable provided by the server. But in this case it should be on demand. with the old version cached and only downloading the new one when there is a new version once a day.

m3adow• 1 year ago

First thing I thought as well. Every 5 minutes for a screen recording software is an absurd frequency. I doubt they release multiple new versions per day.

Lammy2• 1 year ago

A 5 minute update check interval is usage-reporting in disguise. Way fewer people would turn off a setting labeled “check for updates” than one labeled “report usage statistics”.

Spivak• 1 year ago

Eh, this one is probably ignorance over malice. It's super common to see people who need to make an arbitrary interval choice go with 300 out of habit.

YetAnotherNick• 1 year ago

Do they say that they don't do any usage reporting?

bilekas2• 1 year ago

Don’t give them ideas!!

blitzar• 1 year ago

never attribute to malice what can be attributed to incompetence

knowitnone2• 1 year ago

or they can send report usage statistics without you knowing or being able to disable it.

karhuton• 1 year ago

To be as user friendly as possible, always ask if user wants automatic background updates or not. If you can’t update without user noticing it, please implement manual updates as two mechanisms:

1) Emergency update for remote exploit fixes only

2) Regular updates

The emergency update can show a popup, but only once. It should explain the security risk. But allow user to decline, as you should never interrupt work in progress. After decline leave an always visible small warning banner in the app until approved.

The regular update should never popup, only show a very mild update reminder that is NOT always visible, instead behind a menu that is frequently used. Do not show notification badges, they frustrate people with inbox type 0 condition.

This is the most user friendly way of suggesting manual updates.

You have to understand, if user has 30 pieces of software, they have to update every day of the month. That is not a good overall user experience.

zveyaeyv3sfye2• 1 year ago

You have to understand, if user has 30 pieces of software, they have to update every day of the month. That is not a good overall user experience.

That's not an user issue tho, it's a "packaging and distribution of updates" issue which coincidentally has been solved for other OS:es using a package manager.

wodenokoto2• 1 year ago

Depends on the application. I have my browser running for months at a time.

tom1337• 1 year ago

I'd also question if the updater needs to download the update before the user saying they want it. Why not check against a simple endpoint if a newer version is available and if so, prompt the user that an update could be downloaded and then download it. This would also allow the user to delay the update if they are on metered connections.

firesteelrain2• 1 year ago

notepad++ works this way

canucker20162• 1 year ago

In the previous year 2023 discussion, the founder says that the update interval was changed to 3 hours. lol. see https://news.ycombinator.com/item?id=35873727

If the update interval had been 1 day+, they probably wouldn't have noticed after one month when they had a 5 minute update check interval.

trollbridge• 1 year ago

And if it is necessary, the proper way to do this is via DNS with a record with a TTL less than 5 minutes, not pinging some webserver.

This could have easily been avoided by prompting the user for an update, not silently downloading it in the background... over and over.

stevage10• 1 year ago

It's absolutely way too frequent.

Their users do not care about their screen recording studio anywhere near as much as the devs who wrote it do.

Once a month is probably plenty.

Personally, I disable auto-update on everything wherever possible, because the likelihood of annoying changes is much greater than welcome changes for almost all software I use, in my experience.

sixtyj• 1 year ago

Check for updates every 5 minutes is a bug itself ;)

It is sort of fun (for $8,000) as it was “just” a screenshotter, but imagine this with bank app or any other heavily installed app.

All cloud providers should have alerts for excessive use of network by default. And they should ask developers if they really want to turn alerts off.

I remember Mapbox app that cost much more, just because provider did charge by months… and it was a great dispute who’s fault it was…

hardwaresofton• 1 year ago

Bugs are great chances to learn.

What might be fun is figuring out all the ways this bug could have been avoided.

Another way to avoid this problem would have been using a form of “content addressable storage”. For those who are new, this is just a fancy way of saying make sure to store/distribute the hash (ex. Sha256) of what you’re distributing and store it on disk in a way that content can be effectively deduplicated by name.

It’s probably not so easy as to make it a rule, but most of the time, an update download should probably do this

ghurtado4• 1 year ago

out all the ways this bug could have been avoided.

The most obvious one is setting up billing alerts.

Past a certain level of complexity, you're often better off focusing on mitigation that trying to avoid every instance of a certain kind of error.

HelloNurse3• 1 year ago

Note that billing alerts protect against unexpected network traffic, not directly against bugs and bad design in the software. Update checking remains a terrible idea.

donatj2• 1 year ago

I am always kind of a stickler about code reviews. I once had a manager tell me that I should leave more to QA with an offhand comment along the lines of "what is the worst that could happen" to which I replied without missing a beat "We all lose our jobs. We are always one bad line of code away from losing our jobs"

The number of times I have caught junior or even experienced devs writing potential PII leaks is absolutely wild. It's just crazy easy in most systems to open yourself up to potential legal issues.

canucker20162• 1 year ago

...And if there's no one around to review the code?

The website makes it seem like it's a one person shop.

alias_neo• 1 year ago

When I work on my own code, at home, with no-one to assist or review, I write tests, and open a PR anyway, and review it myself, sometimes the next day with fresh eyes, or even 10 minutes later after a quick walk in and out of the room and a glass of water.

If you're not confident you can review a piece of code you wrote and spot a potentially disastrous bug like the one in OP, write more tests.

ValdikSS2• 1 year ago

Yep, what's in most other jobs is a criminal offense, the most serious issue the individual developer could face is just to lose the job.

monkeyelite10• 1 year ago

If you demand accountability you need to grant authority.

monkeyelite10• 1 year ago

Code reviews kill velocity - introduce context switching, and are make work, it feels like you’re doing something to make a PR etc but your not.

The context it makes the most sense is accepting code from strangers in a low trust environment.

The alternative to trying to prevent mistakes is making it easy to find and correct them. Run CI on code after it’s been merged and send out emails if it’s failed. At the end of a day produce a summary of changes and review them asynchronously. Use QA, test environments, etc.

Capricorn24812• 1 year ago

Code reviews kill velocity - introduce context switching, and are make work

This is the same point three times, and I don't agree with it. This is like saying tests kill velocity, there's nothing high velocity about introducing bugs to your code base.

Everything introduces context switching, there's nothing special about code reviews that makes it worse than answering emails, but I'm not going to ignore an important email because of "context switching."

Everyone makes mistakes, code reviews are a way to catch those. They can also spread out the knowledge of the code base to multiple people. This is really important at small companies.

CI is great, but I have yet to see a good CI tool that catches the things I do.

latexr7• 1 year ago

Code reviews kill velocity

This feels like a strange sense of priorities which would be satirised in a New Yorker/Far Side single-panel comic: “Sure, my mistake brought down the business and killed a dozen people, but I’m not sure you appreciate how fast I did it”.

Code should be correct and efficient. Monkeys banging their heads against a keyboard may produce code fast, but it will be brittle and you’ll have to pay the cost for it later. Of course, too many people view “later” as “when I’m no longer here and it’s no longer my problem”, which is why most of the world’s software feels like it’s held together with spit.

mugsie2• 1 year ago

Code reviews kill velocity

Yes, they kill your velocity. However, the velocity of a team can be massively increased by shipping small things a lot more often.

Stable branches that sit around for weeks are the real velocity killer, and make things a lot more risky on deployment.

ljm5• 1 year ago

The up-front cost of code review can be easily be tripled or quadrupled when it’s distributed over several weeks after the fact in the form of unplanned work, each instance of which incurs its own cost of context switching, as well as the cost of potential rework.

The purpose of such a review is a deliberate bottleneck in the earlier stage of development to stop it becoming a much larger bottleneck further down the line. Blocking one PR is a lot cheaper than blocking an entire release, and having a human in the loop there can ensure the change is in alignment in terms of architecture and engineering practices.

CI/CD isn’t the only way to do it but shifting left is generally beneficial even with the most archaic processes.

sevg• 1 year ago

Why in the world does it need to check for updates every 5 minutes?

The author seemed to enjoy calculating the massive bandwidth numbers, but didn’t stop to question whether 5 minutes was a totally ridiculous.

knowitnone2• 1 year ago

that's how frequent they find bugs in their app?

metaphor• 1 year ago

(2023)

Previous discussion: https://news.ycombinator.com/item?id=35858778

pornel2• 1 year ago

It would also be nice if the update archive wasn't 250MB. Sparkle framework supports delta updates, which can cut down the traffic considerably.

mathverse• 1 year ago

This is an electron app.

dahcryn2• 1 year ago

which is their design choice, not an obligation.

Electron really messed up a few things in this world

pornel2• 1 year ago

Which is even better for incremental updates.

If just some JavaScript files change, you don't need to redownload the entire Chromium blob.

Jonovono• 1 year ago

You can still get delta updates with Sparkle in an electron app. I am using it, and liking it a lot more than Electron Updater so far: https://www.hydraulic.dev

turbonaut• 1 year ago

‘Simple’ bugs get a bit more expensive than this…

https://en.m.wikipedia.org/wiki/Knight_Capital_Group#2012_st...

440m usd

voidUpdate2• 1 year ago

whyyy does wikipedia not redirect mobile links to the desktop website when you have a desktop UA?

xigoi• 1 year ago

Why do they have a separate mobile website at all instead of writing proper CSS to make one website work on all devices?

wodenokoto2• 1 year ago

Because people on desktops asking for the mobile site should be able to view the mobile site.

The url specifically asks Wikipedia to serve the mobile site.

vishnudeva• 1 year ago

The scale is astounding. I was briefly interested in the person that caused the error then immediately realized it was irrelevant because if a mechanism doesn't exist to catch an issue like that, then any company is living on borrowed time.

creatonez• 1 year ago

See also: Every time a small error in a spreadsheet has caused a huge problem https://eusprig.org/research-info/horror-stories/

bryanrasmussen• 1 year ago

I read that as "A single line of code costs $8000" which, from the comments seems like a few others had the same thought. Reading the article it is not costs and the original title is "One line of code that did cost $8,000", so as some others have pointed out it is a bug that cost $8000.

stevage10• 1 year ago

I was expecting it to be about a good line of code that cost $8,000 in development time to write, which might be an interesting story.

jensenbox• 1 year ago

You need https://www.vantage.sh

Set up daily emails.

Set up cost anomaly alerts.

bilekas2• 1 year ago

While refactoring it, I forgot to add the code to stop the 5-minute interval after the new version file was available and downloaded.

I’m sorry but it’s exactly cases like these that should be covered by some kind of test, especially When diving into a refactor. Admittedly it’s nice to hear people share their mistakes and horror stories, I would get some stick for this at work.

handfuloflight• 1 year ago

Would have cost $0 on Cloudflare's R2.

jumploops• 1 year ago

Oh boy, I know of at least one case where a single line of code cost ~$500k…

Curious where the high-water mark is across all HNers (:

short_sells_poo• 1 year ago

$1.2mln, gone in about 30 minutes.

explodes• 1 year ago

Others have reported higher already, but for data:

Our team had a bug that cost us about $120k over a week.

Another bug running on a large system had an unmeasurable cost. (Could $K, could be $M)

agos• 1 year ago

I would be surprised if half of the user on this site did _not_ create or personally see a bug where a line cost way more than $8000

navigate8310• 1 year ago

So did you pay or Google showed you mercy by chewing their potential earnings?

coffeeenjoyer• 1 year ago

I assume most of that 2PB network traffic was not egress, right? Otherwise how did it "only" cost you $8k on Google Cloud? Even at a cost of 0.02$ per GB, which is usually a few times lower than the actual prices I could find there, that would still result in an invoice of about $40k...

CodesInChaos• 1 year ago

The first 500TB should have cost $35k already. At that point pricing goes from $0.06/GB to "contact us". So I'd have expected google to charge $80k or so for the whole thing. (Unless google decided to forgive most of the cost)

jiggawatts• 1 year ago

These articles are great, but I have to one-up the blog: I recently helped a small dev team clean up a one-line mistake that cost them $95,000... which they didn't notice for three months.

The relevance is that instead of checking for a change every 5 minutes, the delay wasn't working at all, so the check ran as fast as possible in a tight loop. This was between a server and a blob storage account, so there was no network bottleneck to slow things down either.

It turns out that if you read a few megabytes 1,000 times per second all day, every day, those fractions of a cent per request are going to add up!

mimimi31• 1 year ago

Add special signals you can change on your server, which the app will understand, such as a forced update that will install without asking the user.

I understand the reasoning, but that makes it feel a bit too close to a C&C server for my liking. If the update server ever gets compromised, I imagine this could increase the damage done drastically.

jve• 1 year ago

Screen Studio is a screen recorder for macOS. It is desktop app. It means we need some auto-updater to allow users to install the latest app version easily.

No, it doesn't mean that.

Auto updater introduced series of bad outcomes.

- Downloading update without consent, causing traffic for client.

- Not only that, the download keeps repeating itself every 5 minutes? You did at least detect whether user is on metered connection, right... ?

- A bug where update popup interrupts flow

- A popup is a bad thing on itself you do to your users. I think it is OK when closing the app and let the rest be done in background.

- Some people actually pay attention to outgoing connections apps make and even a simple update check every 5 minutes is excessive. Why even do it while app is running? Do on startup and ask on close. Again some complexity: Assume you're not on network, do it in background and don't bother retrying much.

- Additional complexity for app that caused all of the above. And it came with a price tag to developer.

Wouldn't app store be perfect way to handle updates in this case to offload the complexity there?

socalgal2• 1 year ago

Does the app store handle staged rollouts?

That was a thing I thought was missing from this writeup. Ideally you only roll up the update to a small percent of users. You then check to see if anything broke (no idea how long to wait, 1 day?). Then you increase the percent a little more (say, 1% to 5%) and wait a day again and check. Finally you update everyone (who has updates on)

djxfade• 1 year ago

Yes it does support this

dahcryn2• 1 year ago

yes obviously something as mature as the App store supports phased rollout. I believe it is even the default setting once you reach certain audience sizes. Updates are always spread over 7 days slowly increasing the numbers

HelloNurse3• 1 year ago

App store updates are perfect: no unnecessary complications, no unnecessary work (assuming Screen Studio is published and properly updated in the app store), and the worst case scenario is notifications about a new Screen Studio version ending up in a Screen Studio recording in progress.

Thinking of it, the discussed do-it-yourself update checking is so stupid that malice and/or other serious bugs should be assumed.

ryandrake6• 1 year ago

Exactly. The AppStore already exists and does updates (either automatically or manually, configurable by the user). The developer didn't have to lift a finger to get this functionality. Imagine sitting down and spending time adding functionality to your application that is already provided for free by the operating system, and then after all that, doing it incorrectly!

bearjaws• 1 year ago

Yeah no, publishing to the App Store is a nightmare in cost and time. I can 100% guarantee they still saved money on 30% fees even after this $8000 snafu.

Screen Studio has 32k followers, lets say 6% are end users, 2000 users at $229, that is $137k in App Store fees.

I am going to say writing your own app update script is a wash time wise, as getting your app published is not trivial, especially for an app that requires as many permissions as screen studio.

Telemakhos• 1 year ago

malice and/or other serious bugs should be assumed

Going back to the blog post and re-reading it with this possibility in mind is quite a trip.

It turns out thousands of our users had the app running in the background, even though they were not using it or checking it for weeks (!). It meant thousands of users had auto-updater constantly running and downloading the new version file (250MB) over and over again every 5 minutes

This could easily have been data exfiltration from client computers instead, and few (besides the guy whose internet contract got cancelled for heavy traffic) would have noticed.

Nition• 1 year ago

While we're listing complaints... 250MB for a screen recorder update?

crest• 1 year ago

And even when nothing changed?!? Fucking lazy developers aka "I have an idle ≥1Gb/s pipe to the download server". What happened to rsync/zsync/zstd (with dictionary)? There are so many good tools freely available to reduce wasted bandwidth when you insist on reinventing the wheel. sigh

yojo5• 1 year ago

That’s pretty much the floor for an Electron app.

If you’re a small shop or solo dev, it is real hard to justify going native on three platforms when electron gives it for (near) free. And outside of HN, no one seems to blink at a 250MB bundle.

There are alternatives like Tauri that use the system browser and allow substantially smaller bundles, but they’re not nearly as mature as Electron, and you will get cross platform UI bugs (some of which vary by user’s OS version!) from the lack of standardization.

ivanjermakov2• 1 year ago

Screen recorder under 100 bytes: ffmpeg -video_size 1024x768 -framerate 25 -f x11grab -i :0.0+100,200 output.mp4

dist-epoch2• 1 year ago

Wouldn't app store be perfect way to handle updates

But then the HN crowd would complain "why use an app store? that's gate keeping, apple could remove your app any day, just give me a download link, and so on..."

You literally can't win.

wqaatwt3• 1 year ago

You can? Don’t check for updates every 5 minutes. Daily or even weekly would be sufficient for an app like this (if auto-updater is even necessary at all.. just show a notification)

amelius2• 1 year ago

As a user I hate auto updates. It feels like someone pulling the rug from under me.

insin• 1 year ago

Knowing where to put the line: $7999 (is sadly not the story)

silverfrost• 1 year ago

In other news a screen recorder app is a 250MB (presumably compressed) download...

zveyaeyv3sfye2• 1 year ago

FWIW, OBS is ~150 MB, not an electron app and actually open source.

https://obsproject.com/

byyll• 1 year ago

I'll let my employer know to update my salary or reduce my workload.

aranw• 1 year ago

I have Screen Studio and I don't leave it open but all I wish for now is that you disable the auto updater. Provide an option for it to be disabled and allow for manual update checking. Checking for an update every 5 minutes is total overkill and downloading the update automatically is just bad. What if I was on mobile internet and had limited bandwidth and usage. The last thing I want is an app downloading it's own update without my consent and knowledge.

huksley• 1 year ago

They had no cost usage alerts. So they even did not know that the thing was happening, just realized with the first bill.

I think that is the essence of what is wrong with the cloud costs. Defaulting to possibility for everyone to scale rapidly while in reality 99% have quite predictable costs month over month.

indrex• 1 year ago

Plenty of (valid) criticism in the comments, but I appreciate the developer for publishing it.

stevage10• 1 year ago

I feel a bit iffy about turning the shitty experience you imposed on your users into content for your blog.

pandemic_region• 1 year ago

This 1000 times. It takes courage to open up to mistakes. As a relatively young industry, we have a lot to learn still to move away from the instinctive blaming culture surrounding such failures. In this case, it's only a file being downloaded a couple of times, nobody died or got injured.

For those interested in this topic, and how other industries (e.g. Airline industry) deal with learning from or preventing failure: Sidney Dekker is the authority in this domain. Things like Restorative Just Culture, or Field guide to understanding human error could one day apply to our industry as well: https://sidneydekker.com/books.

moi2388• 1 year ago

Why on earth are you checking for updates every 5 minutes to begin with?!

Seriously this alone makes me question everything about this app.

dkdbejwi383• 1 year ago

Probably product owner wants to show off a nice chart at their next meeting showing how quickyl users upgrade, as some kind of proxy metric for "engagement"

indymike• 1 year ago

We just put a header for version in our app, and when we deploy new code the client checks against the version header and upgrades if the version is mismatched. No extra get requests required. Bonus: we just use the last git commit hash as the version. Stupid simple.

01HNNWZ0MV43FF3• 1 year ago

I saw some project that used a DNS TXT field to check its version

That way I guess you get the caching of the DNS network for free, it uses basically one packet each way, encryption is still possible, and it can reduce the traffic greatly if a big org is running a thousand instances on the same network

I think it was written in Go. Might have been Syncthing

stevage10• 1 year ago

I'm really surprised this could happen. As they note:

Write your auto-updater code very carefully.

You have to be soooo careful with this stuff. Especially because your auto-updater code can brick your auto-updater.

It looks like they didn't do any testing of their auto update code at all, otherwise they would have caught it immediately.

Bluescreenbuddy• 1 year ago

Meanwhile over at Knight Capital...

misiek08• 1 year ago

So it is 2PB less of bytes written lifetimes on users disks? Interesting to count that.

albert_e• 1 year ago

What about the bandwidth burned needlessly for thousands of users on their data plans.

At some scale such careless mistakes are going to create real effects for all users of internet through congestion as well.

If this was not a $8000 mistake but was somehow covered by a free tier or other plan from Google Cloud, would they still have considered it a serious bug and fixed it as promptly?

How many such poor designs are out there generating traffic and draining common resources.

bee_rider2• 1 year ago

They mention specifically handling the situation for one user. So, I guess it is a case-by-case thing.

watusername• 1 year ago

Needs (2023) in the title.

abstractspoon• 1 year ago

I find it ludicrous that the developers of an app as insignificant as a screen recorder would think it's necessary to check for updates every 5 minutes.

Once a day would surely be sufficient.

Yeri• 1 year ago

a thousand times this.

amelius2• 1 year ago

one time should be sufficient

EvanAnderson2• 1 year ago

Once a day would surely be sufficient.

Weekly or monthly would be sufficient. I'd also like "able to be disabled manually, permanently" as an option, too.

ryandrake6• 1 year ago

How about never? If I want to update my software, I'll update it. I don't need the application itself to hound me about it, at any frequency.

dist-epoch2• 1 year ago

You can use that as a hidden way of tracking how many active users you have at any time.

Good way of showing adoption and growth.

panki27• 1 year ago

That's stretching my definition of "good" quite a bit.

mystified5016• 1 year ago

You can still do that with daily, weekly, or monthly checks.

Nobody under any circumstances needs usage stats with 5 minute resolution. And certainly not a screen recorder.

closewith2• 1 year ago

You definitely can, although it would be unlawful under the GDPR without user consent, so you could never release the figures publicly.

smallpipe• 1 year ago

I make CPUs for a living. I'm happy these people exists, we'll always need faster CPUs.

VWWHFSfQ2• 1 year ago

The big clouds love these people too. So much of the software industry is just an outrageous combination of inexperience and "YOLO". Every problem can be solved by just giving AWS another $100,000 this month because we don't have time (and don't know how) to make even basically optimized software. So just burn the gas and electricity and give more money to the YAML merchants at Amazon.

VladVladikoff• 1 year ago

I honestly lost so much respect for the author after reading this that I completely bailed on the article. Every 5 minutes update check is entirely unhinged behaviour.

ljm5• 1 year ago

Why pay for your own runners when you can do CI/CD on your users’ machines?

chris_va• 1 year ago

I generally find that these things are put in during development, and then people forget to take them out.

hennell• 1 year ago

Ironically the only real call for an update check every 5 mins would be so you can quickly fix a problem like everyone downloading the update every 5 mins.

pcthrowaway3• 1 year ago

Once a day would surely be sufficient.

Well they might need to rush out a fix to a bug that could be harmful for the user if they don't get it faster.

For example, a bug that causes them to download 250MB every 5 minutes.

ryukoposting• 1 year ago

It's a fucking screen recorder. Why does it need to check for updates more than once a month? Why does it need to check for updates at all? It's an appliance. It either records your screen, or it doesn't.

jmull• 1 year ago

I'm pretty conservative about adopting third-party libraries (due to the long-term issues each one has the potential to cause), but an app updater is probably worth it.

It's just tricky, basically one fat edge case, and a critical part of your recovery plan in case of serious bugs in your app.

(This bug isn't the only problem with their home-grown updater. Checking every 5 min is just insane. Kinda tells me they aren't thinking much about it.)

Zambyte3• 1 year ago

Or better yet, let the system package manager do it's job.

wqaatwt3• 1 year ago

You’d be forced to use Apple’s App-Store, though? I don’t think there is an other package manager

wolrah• 1 year ago

I'm pretty conservative about adopting third-party libraries (due to the long-term issues each one has the potential to cause), but an app updater is probably worth it.

Especially for a Mac-only application where Sparkle (https://sparkle-project.org/) has been around for almost two decades now and has been widely used across all sorts of projects to the point that it's a de facto standard. I'd be willing to bet that almost every single Mac "power user" on the planet has at least one application using Sparkle installed and most have a few.

kimbernator• 1 year ago

This cost -you- $8000. It probably cost users a lot more.

zelon88• 1 year ago

As a designer, I value the experience product I create provides to the users. And this was not even a bad experience; it was actually harmful.

$229 per year on a closed source product and this is the level of quality you can expect.

You can have all the respect for users in the world, but if you write downright hazardous code then you're only doing them a disservice. What happened to all the metered internet plans you blasted for 3 months? Are you going to make those users whole?

Learning from and owning your mistake is great and all, but you shouldn't be proud or gloating about this in any way, shape, or form. It is a very awkward and disrespectful flex on your customers.

Fokamul2• 1 year ago

Did you see? It's "Designed for macOS" I would put premium edition for 3999$ at least.

Fokamul2• 1 year ago

Truth to be told, Google Cloud console is horrible mess for new people, who just wants quickly setup API, pay and don't have time to care about it anymore.

Well, you should hire contractor to set console for you.

"Designed for MacOS", aah don't worry, you will have the money from apes back in the no time. :)

Hobadee• 1 year ago

Why is nobody talking about what a shady business practice it is that cloud providers don't alert you to this kind of overage by default? Sure, you can set up alerts, but when you go 10x over your baseline in a short period of time, that should trigger an alert regardless of your configured alerts.

firesteelrain2• 1 year ago

Or treat it like the stock market and shut it down.

bee_rider2• 1 year ago

They could compare against the baseline, I guess.

In the grand scheme of things, $8k is not much money for a business, right? Like we can be pretty sure nobody at Google said “a-ha, if we don’t notify the users, we will be able sneak $8k out of their wallets at a time.” I think it is more likely that they don’t really care that much about this market, other than generally creating an environment where their products are well known.

ValdikSS2• 1 year ago

I'm running an anti-censorship proxy service which uses Proxy Auto-Configuration (PAC) file which you can configure OS-wide or in the browser.

If the file contains invalid JS (syntax error, or too new features for IE on Win7/8), or if it's >1MB (Chromium-based browsers & Electron limit), and the file is configured system-wide, then EVERY APP which uses wininet starts flooding the server with the requests over and over almost in an endless loop (missing/short error caching).

Over the years, this resulted in DDoSing my own server and blackholing its IP on BGP level (happened 10+ times), and after switching to public IPFS gateways to serve the files, Pinata IPFS gateway has blocked entire country, on IPFS.io gateway the files were in top #2 requests for weeks (impacting operational budget of the gateway).

All of the above happens with tight per-IP per-minute request limits and other measures to conserve the bandwidth. It's used by 500 000+ users daily. My web server is a $20/mo VPS with unmetered traffic, and thanks to this, I was never in the situation as the OP :)

mieko• 1 year ago

For people finding this thread via web search in the future:

screen.studio is macOS screen recording software that checks for updates every five minutes. Somehow, that alone is NOT the bug described in this post. The /other/ bug described in this blog is: their software also downloaded a 250MB update file every five minutes.

The software developers there consider all of this normal except the actual download, which cost them $8000 in bandwidth fees.

To re-cap: Screen recording software. Checks for updates every five (5) minutes. That's 12 times an hour.

I choose software based on how much I trust the judgement of the developers. Please consider if this feels like reasonable judgement to you.

VWWHFSfQ2• 1 year ago

I would be so embarrassed about this bug that I would be terrified to write it up like this. Also admitting that your users were forced to download 10s or 100s of gigabytes of bogus updates nearly continuously. This is the kind of thing that a lot of people would just quietly fix. So kudos (I guess) to blogging about it.

vrosas4• 1 year ago

When I built an app that “phones home” regularly, I added the ability for the backend to respond to the client with an override backoff that the client would respect over the default.

aziaziazi3• 1 year ago

Could you expend on what is an "override backoff" ?

SnorkelTan• 1 year ago

Why not just use http retry-after? then you can use middleware/proxy to control this behavior. Downside here is that system operation becomes more opauqe and fragmented across systems.

nyarlathotep_2• 1 year ago

Wish people would actually do things like this more often.

Plenty of things (like playstation's telemetry endpoint, for one of many examples) just continually phones home if it can't connect.

The few hours a month of playstation uptime shows 20K dns lookups for the telemetry domain alone.

gblargg• 1 year ago

Seems like the proper fix would have been to remove the file from the server when they realized the increased traffic. Then clients would just fail to check the update each time and not tie up bandwidth.

silverwind• 1 year ago

There is a standard HTTP header for this: Retry-After.

ryandrake6• 1 year ago

Yea, it seems like the wrong lesson was learned here: It should have been "Don't abuse your users' computers," but instead it was, "When you abuse your users' computers, make sure it doesn't cost the company anything."

infogulch• 1 year ago

That's a good summary and explains many ills in the software engineering industry.

benwilber0• 1 year ago

their software also downloaded a 250MB update file every five minutes

How on earth is a screen recording app 250 megabytes

lawgimenez• 1 year ago

I don’t use their software but if someone has they should be able to decompile it.

mobilemidget3• 1 year ago

Or.. Why on earth you need to check for updates 288x per day. It sounds and seems more like 'usage monitoring' rather than being sure that all users have the most recent bug fixes installed. What's wrong with checking for updates upon start once (and cache per day). What critical bugs or fixes could have been issued that warrant 288 update checks.

pixl972• 1 year ago

Because developers can suck.

I work with developers in SCA/SBOM and there are countless devs that seem to work by #include 'everything'. You see crap where they include a misspelled package name and then they fix it by including the right package but not removing the wrong one!.

ericmcer2• 1 year ago

The app itself is probably much bigger than 250mb. If it is using Electron and React/other JS library like a million other UIs just the dependencies will be almost that big.

aziaziazi3• 1 year ago

Just my hypothesis: some softwares includes video tutorial accessible offline. A short but not-compressed-high-res video can easily go big.

latexr7• 1 year ago

As I recall, it’s an Electron app. I just checked and the current version of Google Chrome is 635 MB, with its DMG being 224 MB.

So yes, it’s insane, but easy to see where the size comes from.

AndrewStephens• 1 year ago

> their software also downloaded a 250MB update file every five minutes
How on earth is a screen recording app 250 megabytes

How on earth is a screen recording app on a OS where the API to record the screen is built directly into the OS 250 megabytes?

It is extremely irresponsible to assume that your customers have infinite cheap bandwidth. In a previous life I worked with customers with remote sites (think mines or oil rigs in the middle of nowhere) where something like this would have cost them thousands of dollars per hour per computer per site.

256_2• 1 year ago

It was probably written by the type of programmers who criticise programmers like me for using "unsafe" languages.

ranger_danger3• 1 year ago

I would bet money it's electron

js22• 1 year ago

Unpacked, it's actually 517M on disk:

   517M  ─┬ Screen Studio.app                     100%
   517M   └─┬ Contents                            100%
   284M     ├─┬ Resources                          55%
   150M     │ ├── app.asar                         29%
   133M     │ └─┬ app.asar.unpacked                26%
   117M     │   ├─┬ bin                            23%
    39M     │   │ ├── ffmpeg-darwin-arm64           8%
    26M     │   │ ├── deep-filter-arm64             5%
    11M     │   │ ├─┬ prod                          2%
  10.0M     │   │ │ └── polyrecorder-prod           2%
    11M     │   │ ├─┬ beta                          2%
  10.0M     │   │ │ └── polyrecorder-beta           2%
  10.0M     │   │ ├── hide-icons                    2%
   9.9M     │   │ ├─┬ discovery                     2%
   8.9M     │   │ │ └── polyrecorder                2%
   5.6M     │   │ └── macos-wallpaper               1%
    16M     │   └─┬ node_modules                    3%
    10M     │     ├─┬ hide-desktop-icons            2%
  10.0M     │     │ └─┬ scripts                     2%
  10.0M     │     │   └── HideIcons                 2%
   5.7M     │     └─┬ wallpaper                     1%
   5.7M     │       └─┬ source                      1%
   5.6M     │         └── macos-wallpaper           1%
   232M     └─┬ Frameworks                         45%
   231M       └─┬ Electron Framework.framework     45%
   231M         └─┬ Versions                       45%
   231M           └─┬ A                            45%
   147M             ├── Electron Framework         29%
    57M             ├─┬ Resources                  11%
  10.0M             │ ├── icudtl.dat                2%
   5.5M             │ └── resources.pak             1%
    24M             └─┬ Libraries                   5%
    15M               ├── libvk_swiftshader.dylib   3%
   6.8M               └── libGLESv2.dylib           1%

hi_hi• 1 year ago

For context, the latest iOS update is ~3.2GB, and the changelog highlights are basically 8 new emojis, some security updates, some bug fixes. It makes me want to cry.

zahlman4• 1 year ago

Not everyone even has an Internet connection that can reliably download 250MB in 5 minutes.

Yes, even in metropolitan areas in developed countries in 2025.

f1shy3• 1 year ago

Germany?

Hikikomori• 1 year ago

Even doable on very long range ADSL, guess there are still some dialup users.

Tade0• 1 year ago

Several months ago I was dealing with huge audio interruption issues - typical sign of some other, blocking, high-priority process taking too long.

Turns out Adobe's update service on Windows reads(and I guess also writes) about 130MB of data from disk every few seconds. My disk was 90%+ full, so the usual slowdown related to this was occurring, slowing disk I/O to around 80MB/s.

Disabled the service and the issues disappeared. I bought a new laptop since, but the whole thing struck me as such an unnecessary thing to do.

I mean, why was that service reading/writing so much?

bredren• 1 year ago

Little Snitch catches these update request checks and I realize now that it should have an additional rule meta which is *how often* this endpoint request should be allowed (LS should allow throttling not just yes / no)

tough4• 1 year ago

murus+snail?

ljm5• 1 year ago

$8000 for 2 petabytes of traffic is pretty cheap for them also.

There are plenty of shitty ISPs out there who would charge $$ per gigabyte after you hit a relatively small monthly cap. Even worse if you're using a mobile hotspot.

I would be mortified if my bug cost someone a few hundred bucks in overages overnight.

aidenn04• 1 year ago

It got one of their customers booted off of their ISP; they did cover that person's overage costs though (and hopefully that person could get their account back).

outsidein2• 1 year ago

Microsoft InTune WUDO has a similar bug costing my department 40000 € internal charging per month for firewall log traffic of blocked tcp 7680 requests. 86000 requests per day per client, 160 million per day total. MS confirmed the bug but did nothing to fix it.

skirge• 1 year ago

how? Do you investigate each blocked packet as separate alert?

hulitu5• 1 year ago

MS confirmed the bug but did nothing to fix it.

They are building features right now. There are a lot of bugs which Microsoft will never fix, or it fixes them after years. (Double click registered on mouse single clicks, clicking "x" to close the window, closes also the window underneat, GUI elements rendered as black due to monitor not recognized etc).

arvindh-manian• 1 year ago

Obviously five minutes is unnecessarily frequent, but one network request every five minutes doesn't sound that bad to me. Even if every app running on my computer did that, I'm not sure I'd notice.

hulitu5• 1 year ago

but one network request every five minutes doesn't sound that bad to me

Even if it is made to CIA/GRU/chinese state security ? /s

alpaca1282• 1 year ago

People complaining about 5 minute update checks hopefully don't use Windows 10/11.

A while ago I did some rough calculations with numbers Microsoft used to brag about their telemetry, and it came out to around 10+ datapoints collected per minute. But probably sent in a lower frequency.

I also remember them bragging about how many million seconds Windows 10 users used Edge and how many pictures they viewed in the Photo app. I regret not having saved that article back then as it seems they realized how bad that looks and deleted it.

homebrewer• 1 year ago

It's probably their way of tracking active users without telling you so, so it makes a lot of sense to "check for updates" as frequently as possible.

crazygringo• 1 year ago

Every 5 minutes is too often yes, but it hardly matters for a tiny HTTP request that barely has a body.

So yes it should only be once a day (and staggered), but on the other hand it's a pretty low-priority issue in the grand scheme of things.

Much more importantly, it should ask before downloading rather than auto-download. Automatic downloads are the bane of video calls...

sandworm101• 1 year ago

Thats only half as bad as a certain company that had all thier users download an unwanted OS upgrade on the theory that one day they might click the install button by accident.

"We will stop filling your drives with unwanted windows 14 update files to you once you agree the windows 12 and 13 eulas and promise to never ever disconnect from the internet again."

esalman2• 1 year ago

* 12 times per hour per user.

therealpygon• 1 year ago

I don’t know this software, but my sense is that this would be exactly the type of desired functionally in order to bypass rejected user metric sharing by parsing update request metrics, but maybe you are right and the Developers really do believe you can’t go more than 5 minutes on an out-of-date version…

londons_explore5• 1 year ago

Well designed software does not poll for anything - everything is event based.

In this case, that means an update should have been sent by some kind of web socket or other notification technology.

Today no OS or software that I'm aware of does that.

treve• 1 year ago

So your conclusion is all software that polls is badly designed?

Keeping a TCP socket open is not free and not really desirable.

gus_massa• 1 year ago

From the article:

Add special signals you can change on your server, which the app will understand, such as a forced update that will install without asking the user.

I don't like that part neither.

vachina• 1 year ago

Does the developer release a tag for every ctrl+s.

9999000009995• 1 year ago

Sloppy coding all around. If you don't want to program something right, why don't you just direct users to the website to manually update it?

On one hand it's good that the author owns up to it, and they worked with their users to provide remedies. But so many things aren't adding up. Why does your screen recorder need to check for updates every 5 minutes? Once a day is more than enough.

This screams "We don't do QA, we shorts just ship"

Cthulhu_• 1 year ago

Or, given it's a Mac app, just have the Mac app store take care of updates. That's part of the value that using the app store service gives you, the other one being not spending thousands in accidental data transfer when you do auto updates wrong.

rvz8• 1 year ago

Or, given it's a Mac app, just have the Mac app store take care of updates. That's part of the value that using the app store service gives you,

And pay Apple their 30% cut on your revenue? No thanks.

the other one being not spending thousands in accidental data transfer when you do auto updates wrong.

Or just actually write proper automated tests for basic features first, before a large refactor to prevent introducing issues like this from happening again?

While I respect the author's honesty in this mistake, the main takeaway here is not mentioned and that is just writing proper automated tests as their impression on this post is that there aren't any.

ryandrake6• 1 year ago

Software doesn't need to check for updates at all. If I want to update my software, I'll update it. I don't need or want the software to be doing it on its own. All OS's have a native package manager at this point that can handle updates. We don't need applications going around it.

9999000009995• 1 year ago

A quick warning "Hi User, your out of date, please update." Is fair.

What's really scary here is the lack of consent. If I want to record videos I don't necessarily have an extra 250mb to spend( many users effectively pay by the gig) everytime the developer feels like updating.

coip4• 1 year ago

sad how many places take the position of "prod is QA and users are the best testers" lol

9999000009995• 1 year ago

No meaningful consequences exist.

So why not ?

kovac• 1 year ago

CI/CD at it's finest :p I guess the 5-minutely updates is correlated with the rate of bug fixes they need to push... Surely, that can't be for new features.

Looking at the summary section, I'm not convinced these guys learned the right lesson yet.

rvz8• 1 year ago

CI/CD is part of the solution, but it is really just proper testing.

Nothing has been learned in this post and it has costed him $8,000 because of inadequate testing.

mgkimsal2• 1 year ago

The app checks for the update every 5 minutes or when the user activates the app. Normally, when the app detected the update - it downloaded it and stopped the 5 minutes interval until the user installed it and restarted it.

This is still bad. I was really hoping the bug would have been something like "I put a 5 minute check in for devs to be able to wait and check and test a periodic update check, and forgot to revert it". That's what I expected, really.

aserafini• 1 year ago

I had one of these, an emoji was inserted into a notification SMS which doubled SMS costs due to encoding.

leoapagano• 1 year ago

Ignoring the obvious question of "why does a screen recorder that checks for updates every 5 minutes need to be installed if macOS already has a screen recorder built in"—writing your own (buggy) auto updater for a macOS app, in 2025, is nuts considering you also have two existing options for auto updates at your disposal, the Mac App Store and Sparkle (https://sparkle-project.org/), both of which are now nearly two decades old.

codeulike• 1 year ago

This 'single line of code' headline trend is dumb. Of course a single line of code can fuck everything up, code is complicated and thats how it works. Its not knitting.

gwbas1c2• 1 year ago

In comparison, when I shipped a Mac desktop application:

We used Sparkle, https://sparkle-project.org/, to do our updates. IMO, it was a poor choice to "roll their own" updater.

Our application was very complicated and shipped with Mono... And it was only about ~10MB. The Windows version of our application was ~2MB and included both 32-bit and 64-bit binaries. WTF are they doing shipping a 250MB screen recorder?

So, IMO, they didn't learn their lesson. The whole article makes them look foolish.

ericmcer2• 1 year ago

People are willing to trade performance/size for convenience. Writing your application using Electron + React means it is going to probably ship a > 500mb app that will suck up 500mb ram while running, but you have a much easier dev experience and can deliver a "flashy" UI with minimal effort.

gwbas1c2• 1 year ago

Our 10MB was also for a "much easier dev experience" on Mac. The framework we shipped was basically 4x the size of the application.

latexr7• 1 year ago

WTF are they doing shipping a 250MB screen recorder?

250 MB is just the download DMG, the app itself is almost 550 MB. It’s an Electron app.

BeFlatXIII2• 1 year ago

550 megs?!?!?? On Apple’s unreasonably stingy SSD sizes?

Who would be foolish enough to download that?

rvz8• 1 year ago

The Windows version of our application was ~2MB and included both 32-bit and 64-bit binaries. WTF are they doing shipping a 250MB screen recorder?

Electron.

So, IMO, they didn't learn their lesson. The whole article makes them look foolish.

The lesson is to do better testing and write automated tests and don't roll your own updater.

felineflock• 1 year ago

From the article: "While refactoring it, I forgot to add the code to stop the 5-minute interval after the new version file was available and downloaded. It meant the app was downloading the same 250MB file, over and over again, every 5 minutes."

epolanski• 1 year ago

I'm actually surprised by how cheaply they got away with.

enceladus76• 1 year ago

For me this shows once again that proper testing is neglected by many developers and companies. Sadly, it is not even mentioned in the advice at the end of the article.

rvz8• 1 year ago

Exactly. No mention of writing automated tests or even TDD at all.

It's best to save everyone by writing tests that prevent a $100 issue on your machine from becoming a costly $10M+ problem in production as the product scales after it has launched.

This won't be the last time and this is what 'vibe coding' doesn't consider and it it will introduce more issues like this.

rvz8• 1 year ago

There you have it: Another vibe coding catastrophe, 13 days later: [0]

[0] https://news.ycombinator.com/item?id=43970607

oldgregg• 1 year ago

What's in that payload when they check for updates every 5 minutes?!

Novel dark pattern: You unchecked "Let us collect user data" but left "Automatically Update" checked... gotcha bitch!

mmmlinux• 1 year ago

Or you could use the built in screen recorder...

charlie0• 1 year ago

I wonder if that line of code was vibed.

jlarocco2• 1 year ago

More anecdata that commercial software is garbage, especially if it's targetting consumers.

I'll stick with open source. It may not be perfect, but at least I can improve it when it's doing something silly like checking for updates every 5 minutes.

a_t48• 1 year ago

I’ve done worse. At my very first job I wrote some slow login rewards calculation code for a mobile game that caused a black screen on startup for long enough that users thought the app was broken and closed it out. (I was simulating passing time one minute at a time in lua or some BS. Oops!) It cost the company some large fraction of my salary at the time. My boss very kindly said that it was okay, everyone ends up mucking up like that at some point in the career, and no I wasn’t fired because the company just spend a large sum teaching me a lesson. We sat down at a whiteboard and I quickly came up with a solution that could just calculate the rewards one should get between two dates - there was some complexity that made this harder than it sounds on paper, but simulating time manually was not the answer.

Olshansky• 1 year ago

Reminds me of some Twitter lore from 2012. I was just an intern....

This is back in the Rails days, before they switch to Scala.

I heard that there was a fail-whale no one could solve related to Twitter's identity service. IIRC, it was called "Gizmoduck."

The engineer who built it had left.

They brought him in for half a day of work to solve the P0.

*Supposedly*, he got paid ~50K for that day of work.

Simultaneously outrageous but also reasonable if you've seen the inside of big tech. The ROI is worth it.

That is all.

Disclaimer: don't know if it's true, but the story is cool.

ikiris2• 1 year ago

If a half day fix from a former employee costs that much, it’s likely because the company deserved it for some reason.

philomath_mn• 1 year ago

While this unfortunate, I am sure I also have single lines in production with greater cost and equivalent value (close to none) -- and I've only worked at small companies. I am sure some of y'all can beat this by ~2 orders of magnitude.

Databricks is happy to have us as a customer.

timhigins• 1 year ago

Screen studio does make the best-looking demo videos I've seen. Any favorite alternatives? Points for free or open source.

latexr7• 1 year ago

Posted two days ago.

https://news.ycombinator.com/item?id=43816419

gitroom• 1 year ago

Honestly, that's a rough one. I've written dumb bugs like that before, cost nowhere near $8k tho lmao. Kinda makes me extra paranoid about what my code's actually doing in the background.

Always42• 1 year ago

$8000 is nothing for most companies, if you have 10 developers making 100k a year your burn rate is $4000 a day just for salaries.

dimatura• 1 year ago

$8000 also seems pretty cheap for 2PB of traffic? Looking at google cloud storage egress rates, $0.02/GiB (which is on the lower end, since it depends on destination) would be about $40k for 2PB.

zarzavat2• 1 year ago

Bug notwithstanding, checking for updates every 5 minutes is exactly the wrong way to do it.

You want to spread out update rollouts in case of a catastrophic problem. The absolute minimum should be once a day at a random time of day, preferably roll out updates over multiple days.

arm32• 1 year ago

This is SUCH an Electron moment!

loeg2• 1 year ago

We've had single characters cost, you know, millions of $. (If you're familiar with C++ and the auto keyword, it's relatively obvious why that character is "&".)

hollow-moe• 1 year ago

Lesson learned: use OBS Studio

ForOldHack2• 1 year ago

Just $8000?

A giant ship’s engine failed. The ship’s owners tried one ‘professional’ after another but none of them could figure out how to fix the broken engine.

Then they brought in a man who had been fixing ships since he was young. He carried a large bag of tools with him and when he arrived immediately went to work. He inspected the engine very carefully, top to bottom.

Two of the ship’s owners were there watching this man, hoping he would know what to do. After looking things over, the old man reached into his bag and pulled out a small hammer. He gently tapped something. Instantly, the engine lurched into life. He carefully put his hammer away and the engine was fixed!!!

A week later, the owners received an invoice from the old man for $10,000.

What?! the owners exclaimed. “He hardly did anything..!!!”.

So they wrote to the man; “Please send us an itemised invoice.”

The man sent an invoice that read:

Tapping with a hammer………………….. $2.00

Knowing where to tap…………………….. $9,998.00

meta87• 1 year ago

rookie numbers

mcoliver• 1 year ago

Add special signals you can change on your server, which the app will understand, such as a forced update that will install without asking the user.

Ummm no. Even after this they haven't learned. Auto update check on app load and prompt user for download/update.

surfmike• 1 year ago

Contact a rep at Google, they can probably reverse a good portion of the $8000 as a one-time thing.

chinchilla2020• 1 year ago

"A single line of code caused <BUG>"

Yes, a single line of code is in the stack trace every time a bug happens. Why does every headline have to push this clickbait?

All errors occur at a single line in the program - and every single line is interconnected to the rest of the program, so it's an irrelevant statement.

sota_pop• 1 year ago

Didn’t read the article, but why would an app not just check for updates on startup/shutdown?

kaiwenwang• 1 year ago

Or use the free https://github.com/lihaoyun6/QuickRecorder

ForOldHack2• 1 year ago

Obligatory: "You are not expected to understand this:" -Dennis Ritchie

coip4• 1 year ago

wonder why they're not making use of the ETag header

mudkipdev• 1 year ago

Add special signals you can change on your server, which the app will understand, such as a forced update that will install without asking the user.

Seems like a great idea, surely nothing can go wrong with that which will lead to another blog post in the near future

n_ary2• 1 year ago

Here is the example of why LLMs need to replace some douchbag SWE. But then again, unless there is a nutcase product owner involved, update check every 5min and downloading automatically is pure symptom of bad engineering practices and fear driven development(if anything breaks update is 5min away and we can laugh at the user when their app is updated and they are baffled).

Good thing, this was not shopify/Duolingo/Msft, else the news would be, how AI saved us $8k by fixing a dangerous code and why AI will improve software quality.

Avlin67• 1 year ago

ssd wear ?

damnever• 1 year ago

Now that I know, I’ll never attempt using this fancy app.

A single line of code cost $8000

Related Stories