For people finding this thread via web search in the future:

screen.studio is macOS screen recording software that checks for updates every five minutes. Somehow, that alone is NOT the bug described in this post. The /other/ bug described in this blog is: their software also downloaded a 250MB update file every five minutes.

The software developers there consider all of this normal except the actual download, which cost them $8000 in bandwidth fees.

To re-cap: Screen recording software. Checks for updates every five (5) minutes. That's 12 times an hour.

I choose software based on how much I trust the judgement of the developers. Please consider if this feels like reasonable judgement to you.

I find it ludicrous that the developers of an app as insignificant as a screen recorder would think it's necessary to check for updates every 5 minutes.

Once a day would surely be sufficient.

> Screen Studio is a screen recorder for macOS. It is desktop app. It means we need some auto-updater to allow users to install the latest app version easily.

No, it doesn't mean that.

Auto updater introduced series of bad outcomes.

- Downloading update without consent, causing traffic for client.

- Not only that, the download keeps repeating itself every 5 minutes? You did at least detect whether user is on metered connection, right... ?

- A bug where update popup interrupts flow

- A popup is a bad thing on itself you do to your users. I think it is OK when closing the app and let the rest be done in background.

- Some people actually pay attention to outgoing connections apps make and even a simple update check every 5 minutes is excessive. Why even do it while app is running? Do on startup and ask on close. Again some complexity: Assume you're not on network, do it in background and don't bother retrying much.

- Additional complexity for app that caused all of the above. And it came with a price tag to developer.

Wouldn't app store be perfect way to handle updates in this case to offload the complexity there?

I would also put into question if you _really_ need to check for updates every 5 minutes. Once per startup is already enough, and if you're concerned about users who leave it on for days, it could easily be daily or even less often.

What about the bandwidth burned needlessly for thousands of users on their data plans.

At some scale such careless mistakes are going to create real effects for all users of internet through congestion as well.

If this was not a $8000 mistake but was somehow covered by a free tier or other plan from Google Cloud, would they still have considered it a serious bug and fixed it as promptly?

How many such poor designs are out there generating traffic and draining common resources.

In comparison, when I shipped a Mac desktop application:

We used Sparkle, https://sparkle-project.org/, to do our updates. IMO, it was a poor choice to "roll their own" updater.

Our application was very complicated and shipped with Mono... And it was only about ~10MB. The Windows version of our application was ~2MB and included both 32-bit and 64-bit binaries. WTF are they doing shipping a 250MB screen recorder?

So, IMO, they didn't learn their lesson. The whole article makes them look foolish.

I am always kind of a stickler about code reviews. I once had a manager tell me that I should leave more to QA with an offhand comment along the lines of "what is the worst that could happen" to which I replied without missing a beat "We all lose our jobs. We are always one bad line of code away from losing our jobs"

The number of times I have caught junior or even experienced devs writing potential PII leaks is absolutely wild. It's just crazy easy in most systems to open yourself up to potential legal issues.

I'm pretty conservative about adopting third-party libraries (due to the long-term issues each one has the potential to cause), but an app updater is probably worth it.

It's just tricky, basically one fat edge case, and a critical part of your recovery plan in case of serious bugs in your app.

(This bug isn't the only problem with their home-grown updater. Checking every 5 min is just insane. Kinda tells me they aren't thinking much about it.)

Just amazed that ‘better testing’ isn’t one of the takeaways in the summary.

Just amazed. Yea ‘write code carefully’ as if suggesting that’ll fix it is a rookie mistake.

So so frustrating when developers treat user machines like their test bed!

"A single line of code caused <BUG>"

Yes, a single line of code is in the stack trace every time a bug happens. Why does every headline have to push this clickbait?

All errors occur at a single line in the program - and every single line is interconnected to the rest of the program, so it's an irrelevant statement.

Sloppy coding all around. If you don't want to program something right, why don't you just direct users to the website to manually update it?

On one hand it's good that the author owns up to it, and they worked with their users to provide remedies. But so many things aren't adding up. Why does your screen recorder need to check for updates every 5 minutes? Once a day is more than enough.

This screams "We don't do QA, we shorts just ship"

I'm running an anti-censorship proxy service which uses Proxy Auto-Configuration (PAC) file which you can configure OS-wide or in the browser.

If the file contains invalid JS (syntax error, or too new features for IE on Win7/8), or if it's >1MB (Chromium-based browsers & Electron limit), and the file is configured system-wide, then EVERY APP which uses wininet starts flooding the server with the requests over and over almost in an endless loop (missing/short error caching).

Over the years, this resulted in DDoSing my own server and blackholing its IP on BGP level (happened 10+ times), and after switching to public IPFS gateways to serve the files, Pinata IPFS gateway has blocked entire country, on IPFS.io gateway the files were in top #2 requests for weeks (impacting operational budget of the gateway).

All of the above happens with tight per-IP per-minute request limits and other measures to conserve the bandwidth. It's used by 500 000+ users daily. My web server is a $20/mo VPS with unmetered traffic, and thanks to this, I was never in the situation as the OP :)

> The app checks for the update every 5 minutes or when the user activates the app. Normally, when the app detected the update - it downloaded it and stopped the 5 minutes interval until the user installed it and restarted it.

This is still bad. I was really hoping the bug would have been something like "I put a 5 minute check in for devs to be able to wait and check and test a periodic update check, and forgot to revert it". That's what I expected, really.

Why in the world does it need to check for updates every 5 minutes?

The author seemed to enjoy calculating the massive bandwidth numbers, but didn’t stop to question whether 5 minutes was a totally ridiculous.

Didn’t read the article, but why would an app not just check for updates on startup/shutdown?

> We decided to take responsibility and offer to cover all the costs related to this situation.

Good on them. Most companies would cap their responsibility at a refund of their own service's fees, which is understandable as you can't really predict costs incurred by those using your service, but this is going above and beyond and it's great to see.

More anecdata that commercial software is garbage, especially if it's targetting consumers.

I'll stick with open source. It may not be perfect, but at least I can improve it when it's doing something silly like checking for updates every 5 minutes.

We just put a header for version in our app, and when we deploy new code the client checks against the version header and upgrades if the version is mismatched. No extra get requests required. Bonus: we just use the last git commit hash as the version. Stupid simple.

>Add special signals you can change on your server, which the app will understand, such as a forced update that will install without asking the user.

I understand the reasoning, but that makes it feel a bit too close to a C&C server for my liking. If the update server ever gets compromised, I imagine this could increase the damage done drastically.

Reminds me of some Twitter lore from 2012. I was just an intern....

This is back in the Rails days, before they switch to Scala.

I heard that there was a fail-whale no one could solve related to Twitter's identity service. IIRC, it was called "Gizmoduck."

The engineer who built it had left.

They brought him in for half a day of work to solve the P0.

*Supposedly*, he got paid ~50K for that day of work.

Simultaneously outrageous but also reasonable if you've seen the inside of big tech. The ROI is worth it.

That is all.

Disclaimer: don't know if it's true, but the story is cool.

Why on earth are you checking for updates every 5 minutes to begin with?!

Seriously this alone makes me question everything about this app.

What's in that payload when they check for updates every 5 minutes?!

Novel dark pattern: You unchecked "Let us collect user data" but left "Automatically Update" checked... gotcha bitch!

I'm really surprised this could happen. As they note:

> Write your auto-updater code very carefully.

You have to be soooo careful with this stuff. Especially because your auto-updater code can brick your auto-updater.

It looks like they didn't do any testing of their auto update code at all, otherwise they would have caught it immediately.

(2023)

Previous discussion: https://news.ycombinator.com/item?id=35858778

‘Simple’ bugs get a bit more expensive than this…

https://en.m.wikipedia.org/wiki/Knight_Capital_Group#2012_st...

440m usd

Bug notwithstanding, checking for updates every 5 minutes is exactly the wrong way to do it.

You want to spread out update rollouts in case of a catastrophic problem. The absolute minimum should be once a day at a random time of day, preferably roll out updates over multiple days.

Not to mention the cost users paid to download 250 MB every 5 minutes.

From the article: "While refactoring it, I forgot to add the code to stop the 5-minute interval after the new version file was available and downloaded. It meant the app was downloading the same 250MB file, over and over again, every 5 minutes."

Plenty of (valid) criticism in the comments, but I appreciate the developer for publishing it.

Ignoring the obvious question of "why does a screen recorder that checks for updates every 5 minutes need to be installed if macOS already has a screen recorder built in"—writing your own (buggy) auto updater for a macOS app, in 2025, is nuts considering you also have two existing options for auto updates at your disposal, the Mac App Store and Sparkle (https://sparkle-project.org/), both of which are now nearly two decades old.

Lesson learned: use OBS Studio

I have Screen Studio and I don't leave it open but all I wish for now is that you disable the auto updater. Provide an option for it to be disabled and allow for manual update checking. Checking for an update every 5 minutes is total overkill and downloading the update automatically is just bad. What if I was on mobile internet and had limited bandwidth and usage. The last thing I want is an app downloading it's own update without my consent and knowledge.

While this unfortunate, I am sure I also have single lines in production with greater cost and equivalent value (close to none) -- and I've only worked at small companies. I am sure some of y'all can beat this by ~2 orders of magnitude.

Databricks is happy to have us as a customer.

Bugs are great chances to learn.

What might be fun is figuring out all the ways this bug could have been avoided.

Another way to avoid this problem would have been using a form of “content addressable storage”. For those who are new, this is just a fancy way of saying make sure to store/distribute the hash (ex. Sha256) of what you’re distributing and store it on disk in a way that content can be effectively deduplicated by name.

It’s probably not so easy as to make it a rule, but most of the time, an update download should probably do this

Contact a rep at Google, they can probably reverse a good portion of the $8000 as a one-time thing.

Does the developer release a tag for every ctrl+s.

They had no cost usage alerts. So they even did not know that the thing was happening, just realized with the first bill.

I think that is the essence of what is wrong with the cloud costs. Defaulting to possibility for everyone to scale rapidly while in reality 99% have quite predictable costs month over month.

It would also be nice if the update archive wasn't 250MB. Sparkle framework supports delta updates, which can cut down the traffic considerably.

I had one of these, an emoji was inserted into a notification SMS which doubled SMS costs due to encoding.

Why is nobody talking about what a shady business practice it is that cloud providers don't alert you to this kind of overage by default? Sure, you can set up alerts, but when you go 10x over your baseline in a short period of time, that should trigger an alert regardless of your configured alerts.

CI/CD at it's finest :p I guess the 5-minutely updates is correlated with the rate of bug fixes they need to push... Surely, that can't be for new features.

Looking at the summary section, I'm not convinced these guys learned the right lesson yet.

I read that as "A single line of code costs $8000" which, from the comments seems like a few others had the same thought. Reading the article it is not costs and the original title is "One line of code that did cost $8,000", so as some others have pointed out it is a bug that cost $8000.

$8000 is nothing for most companies, if you have 10 developers making 100k a year your burn rate is $4000 a day just for salaries.

For me this shows once again that proper testing is neglected by many developers and companies. Sadly, it is not even mentioned in the advice at the end of the article.

Screen studio does make the best-looking demo videos I've seen. Any favorite alternatives? Points for free or open source.

Meanwhile over at Knight Capital...

> Add special signals you can change on your server, which the app will understand, such as a forced update that will install without asking the user.

Ummm no. Even after this they haven't learned. Auto update check on app load and prompt user for download/update.

Oh boy, I know of at least one case where a single line of code cost ~$500k…

Curious where the high-water mark is across all HNers (:

I assume most of that 2PB network traffic was not egress, right? Otherwise how did it "only" cost you $8k on Google Cloud? Even at a cost of 0.02$ per GB, which is usually a few times lower than the actual prices I could find there, that would still result in an invoice of about $40k...

I'm actually surprised by how cheaply they got away with.

I’ve done worse. At my very first job I wrote some slow login rewards calculation code for a mobile game that caused a black screen on startup for long enough that users thought the app was broken and closed it out. (I was simulating passing time one minute at a time in lua or some BS. Oops!) It cost the company some large fraction of my salary at the time. My boss very kindly said that it was okay, everyone ends up mucking up like that at some point in the career, and no I wasn’t fired because the company just spend a large sum teaching me a lesson. We sat down at a whiteboard and I quickly came up with a solution that could just calculate the rewards one should get between two dates - there was some complexity that made this harder than it sounds on paper, but simulating time manually was not the answer.

Truth to be told, Google Cloud console is horrible mess for new people, who just wants quickly setup API, pay and don't have time to care about it anymore.

Well, you should hire contractor to set console for you.

"Designed for MacOS", aah don't worry, you will have the money from apes back in the no time. :)

So it is 2PB less of bytes written lifetimes on users disks? Interesting to count that.

Or you could use the built in screen recorder...

This is SUCH an Electron moment!

I wonder if that line of code was vibed.

Knowing where to put the line: $7999 (is sadly not the story)

This cost -you- $8000. It probably cost users a lot more.

Ever consider not using cloud for everything? Hosting this on traditional hosting would have limited the problem and the cost.

This 'single line of code' headline trend is dumb. Of course a single line of code can fuck everything up, code is complicated and thats how it works. Its not knitting.

> As a designer, I value the experience product I create provides to the users. And this was not even a bad experience; it was actually harmful.

$229 per year on a closed source product and this is the level of quality you can expect.

You can have all the respect for users in the world, but if you write downright hazardous code then you're only doing them a disservice. What happened to all the metered internet plans you blasted for 3 months? Are you going to make those users whole?

Learning from and owning your mistake is great and all, but you shouldn't be proud or gloating about this in any way, shape, or form. It is a very awkward and disrespectful flex on your customers.

Would have cost $0 on Cloudflare's R2.

You need https://www.vantage.sh

Set up daily emails.

Set up cost anomaly alerts.

We've had single characters cost, you know, millions of $. (If you're familiar with C++ and the auto keyword, it's relatively obvious why that character is "&".)

I'll let my employer know to update my salary or reduce my workload.

So did you pay or Google showed you mercy by chewing their potential earnings?

meanwhile the CTOs plan to apply AI into their production codebases :)

Needs (2023) in the title.

> While refactoring it, I forgot to add the code to stop the 5-minute interval after the new version file was available and downloaded.

I’m sorry but it’s exactly cases like these that should be covered by some kind of test, especially When diving into a refactor. Admittedly it’s nice to hear people share their mistakes and horror stories, I would get some stick for this at work.

rookie numbers

(2023)

In other news a screen recorder app is a 250MB (presumably compressed) download...

These articles are great, but I have to one-up the blog: I recently helped a small dev team clean up a one-line mistake that cost them $95,000... which they didn't notice for three months.

The relevance is that instead of checking for a change every 5 minutes, the delay wasn't working at all, so the check ran as fast as possible in a tight loop. This was between a server and a blob storage account, so there was no network bottleneck to slow things down either.

It turns out that if you read a few megabytes 1,000 times per second all day, every day, those fractions of a cent per request are going to add up!

With public sector procurement, $8000 is a pretty standard price for a line of code.

Honestly, that's a rough one. I've written dumb bugs like that before, cost nowhere near $8k tho lmao. Kinda makes me extra paranoid about what my code's actually doing in the background.

Just $8000?

A giant ship’s engine failed. The ship’s owners tried one ‘professional’ after another but none of them could figure out how to fix the broken engine.

Then they brought in a man who had been fixing ships since he was young. He carried a large bag of tools with him and when he arrived immediately went to work. He inspected the engine very carefully, top to bottom.

Two of the ship’s owners were there watching this man, hoping he would know what to do. After looking things over, the old man reached into his bag and pulled out a small hammer. He gently tapped something. Instantly, the engine lurched into life. He carefully put his hammer away and the engine was fixed!!!

A week later, the owners received an invoice from the old man for $10,000.

What?! the owners exclaimed. “He hardly did anything..!!!”.

So they wrote to the man; “Please send us an itemised invoice.”

The man sent an invoice that read:

Tapping with a hammer………………….. $2.00

Knowing where to tap…………………….. $9,998.00

[flagged]

[flagged]