It's Halloween, which means the internet is full of horror stories. Developers have their own kind. Ask anyone about the scariest thing they've found in a codebase and nobody mentions a clever exploit or a race condition that took a week to catch. They mention something small, quiet, and old. Something that's still there.

Here are five of those. None of them is a bug. All of them are scarier than most bugs.

1. "Temporary"

The single scariest word you can grep for.

Every long-lived codebase has a fix that was supposed to last a week. It has a comment saying so — // TEMPORARY, remove after the migration — dated four years ago. The migration finished. The fix stayed. By now three other features depend on its exact behavior, including the part where it's wrong, and removing it is a project nobody will approve because "it works, don't touch it."

The people who wrote the software that failed at Y2K weren't careless.…