Apple's "goto fail" was one duplicated line. Would you have caught it in review?

forqx — Mon, 17 Aug 2026 10:03:37 +0000

In February 2014 Apple shipped an SSL bug that let attackers intercept supposedly-secure traffic on iOS and macOS. The patch, when it came, was essentially a one-line deletion. Here is the famous fragment from Apple's published source:


if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)
    goto fail;
if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
    goto fail;
    goto fail;
if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
    goto fail;

The indentation is lying to you. The second goto fail; lines up as if it belongs to the if above it, but C without braces attaches only the first statement to the condition. The duplicated line runs unconditionally, jumps to the cleanup label with err still 0, and the signature verification below never executes. Every connection "verified" successfully.

No compiler error. Tests passed, because the happy path was genuinely happy. The code even looks reviewed: it is neat, consistent, follows the file's style. The bug is not in what the code does, it is in what it skips.

Why this bug aged well

Twelve years later this exact shape is back, for a new reason. AI assistants generate guard-clause code all day: early returns, validation chains, cleanup jumps. The code is always tidy. The failure mode is the same as Apple's: a control-flow path that silently bypasses the one check that mattered, in a diff that reads perfectly line by line.

Reviewing that kind of code is a skill of its own. You are not asking "is each line correct", you are asking "which paths reach the sensitive operation without going through the check". Line-by-line reading does not surface it; path-thinking does.

Try it on a modern version

I rebuilt the goto-fail pattern as a Node webhook verifier and put it into DiffDojo, a trainer I am building where you review realistic AI-generated PRs, leave inline comments, give a verdict, and find out whether you caught the planted bug.

The goto-fail-shaped one is here: webhook signature verification challenge. No signup needed, free during early access.

If you want the honest experience: do not go in knowing "it is the goto fail bug". Open the library, pick a few at random, and see how your eye does when nobody tells you there is a bug at all. Some of the PRs are clean, because saying "this is fine" with confidence is also part of the job.

What is the closest you have come to shipping a goto fail of your own?

Reviewing AI code is most of the job now, so I built a gym for it

forqx — Wed, 29 Jul 2026 13:03:00 +0000

You know the situation already: the assistants got good, most PRs in the queue are AI-written now, and we all spend more of the day reviewing than writing. No need to dwell on that. What's worth talking about is the part people mention less, which is why this kind of reviewing is so much more tiring than the old kind.

When a tired person writes code, the code looks tired, and the weird names and leftover experiments tell you exactly where to slow down and read twice. A model gives you no such signal: the formatting is clean, the naming is confident, and there's a helpful docstring sitting on top of a function that does the wrong thing. So you're left with two options, reading everything at full attention, which stops working around the fifth PR of the day, or skimming and approving, which is what most of us quietly end up doing.

The failures aren't random, though. After enough of these reviews you keep meeting the same characters: async work that nobody awaits, a method that reads exactly like the ten real ones around it except the library never shipped it, code that does something adjacent to the requirement instead of the requirement. I collected six of these patterns in a separate post, and the point of naming them is that anything with a recognizable shape can be trained for.

And here's the absurd part: we spend years grinding LeetCode to get good at writing code, which is the half machines just took over, while for the half that's left to us, the judgment behind the approve button, there's no gym at all. You learn it live, on real PRs, where your mistakes ship to production.

So I built the gym

On DiffDojo you get a realistic AI-generated PR together with the requirements it claims to implement. You leave comments where you think it's broken, give a verdict, approve or request changes, and then see how you did against a canonical review. The grading is deliberately generous: if you clearly saw the problem but phrased it your own way, you get the credit.

The part I'm most proud of is that some PRs are clean, and approving them is graded too, because a reviewer who rejects everything is as useless as one who approves everything. Claiming a bug that isn't there costs you, while a fair question costs nothing.

The daily PR is free with no signup and takes about five minutes. If you sign in, you get a profile measured against the planted bugs: your catch rate per failure category and the blind spots you keep missing. That's a number a real repo can never give you, because in a real repo you never find out what you failed to see.

Did AI code get past me while I was building this?

It did. The recommendation engine suggests your next challenge based on your weakest category, computed from past attempts, and the code for it read fine, the tests passed, and I approved it. What I missed was that attempts on challenges since retired from the pool still counted toward the weakness profile, so the recommender could confidently point people at content that no longer existed. Nothing in the diff looked wrong, because the bug lived in an assumption about data that wasn't in the diff at all; an adversarial review caught it, not me. I was the human in the loop, building literally this product, and plausible-looking code still walked past me. The eye needs training, mine included.

Try it

Today's PR is at app.diffdojo.com, free, no signup. One ask if you do: the canonical reviews are the product's trust surface, so if you disagree with a grade, tell me about it. That feedback is worth more to me than a signup.

DEV Community: forqx

Apple's "goto fail" was one duplicated line. Would you have caught it in review?

Reviewing AI code is most of the job now, so I built a gym for it

So I built the gym

Did AI code get past me while I was building this?

Try it