20
xzvf
20d

This series of events contains an incredible amount of shier incomprehensible
stupidity. It is the reason I have decided to return to dR, because I NEED TO WENT
ABOUT THIS IDIOT and I don't know of any other place!

Background: I have written a small set of tools (Excel sheets, and a small
service running on an RPI) for
my school to manage staff (cafeteria workers, janitors, security, etc).
Importantly the included a small secure notes storage for each user (GPG encrypted, each
user was THE ONLY ONE with the password for the key, i.e. the only one able to
decrypt the data), which was available over the internet.

So on monday I recieved an email from the vice principal (the one who now has
control over the tools, and is an incredibly annoying and incompetent compsci
teacher, he knows basically nothing); the following email exchange went something like this
(translated the German formal and polite bullshit politeness to the gist of it):
VP: Uhmm, @xzvf, did you make a backup of the RPI?
Me: Why?
VP: No reason, just asking...
Me: *pings server, realizes it's down (I don't personally use it and it's not my
responsibility, so I haven't noticed it earlier)* What did you do!? Why is the
server down!?
VP: Nothing.... Nice weather we're have today. Do you have the backup???
Me: *Facepalm* No, you told me I'm not allowed to do it, because it contains sensitive data!
I gave you a guide to do it! Let me guess, you didn't do it? What did you do with
it?
VP: No, I never told you that! You are responsible! [He didn't tell me what happened]
Me: *One the one hand laughing hard at the this incompetent motherfucker, on the
other hand on the verge of shouting from his incompetence* Here, I told you it
in 4 emails, starting last September. [Quote the emails and his replies that he'll
do it 'soon']. Again, what did you do? I can set it up again and all but the
private notes storage and server settings are stored in the Office 365 Excel sheets
[Don't kill me, VP insisted on Excel, because he thinks of himself as an Excel wizard],
so those are still there.
VP: NOOO! I NEED THE PRIVATE STORAGE! NOW!
Me: 1) Don't speak to me like that! 2) That's impossible if the SD card died,
What did you do, and why didn't you back it up?
VP: Come to my office today after supper!

I come into the office and he starts getting angry at me, saying I AM THE HORRIBLE PERSON for not helping him, but I push him back with
evidence that it's not my fault. I almost left the office. I then managed to find out that the following
is what happened:

This moron decided it was a brilliant idea to put the RPI in a different box to
what it was in currently. He wanted to put it into a grey project box from the hardware
store, but once he put it in, he relized it was stupid, as you couldn't see the
power LED. His brilliant solution; drill a hole into the top of the box,
BUT WITH THE RPI ALREADY MOUNTED IN IT AND THE BOX ALREADY SCREWED BACK TOGETHER
AND PLUGGED IN. His lazy ass didn't want to take it apart, so with the RPI still in
the box and running, he used an electric drill to drill into the box. Only problem:
He drilled too far into the box and slipped after the drill went through, so
he ended up drilling into the RPI's SDcard and the power supply. So he WRECKED
THE BOARD.

After I managed to remove my palm from my face and not laugh at him [he had the audacity
to be visibly annoyed]. I said to him that it wasn't a big deal, just get a new
RPI and sdcard and set it back up.

Then he confessed to me the reason he *needed* the private notes storage back:
He was too lazy and cheap to use a proper password manager, so he used this service,
knowing fullwell that it was not backed up. He had one of those encrypted hard
drives with some important data on it, but he didn't know it's password it was only
there in his "password manager".

At this point I was close to shouting and showing an HIV INFESTED BURNING CACTUS
UP THIS WASTE OF OXYGEN'S ASS, but then I remembered the thing that'd save this
imbeciles data:
The web app for this service had a copy of the encrypted gpg key and the encrypted
password store in local storage.

So I managed to recover his data by writing a small script to recover the
key and encrypted text from his chrome's local storage and decrypt them.
Then I gave the plaintext to him, told him to change all of his passwords and
to use a password manager.
I gave him a new RPI and SD card (for 50€, he didn't argue, he had no choice.)
and set it back up this time including the backup solution [Encrypted tar.gz on
OneDrive {again, don't kill me, he insited on it}]. I made it clear to him that
his and the schools data was his responsibilty, not mine.

Part 1/2

Comments
  • 9
    Part 2/2

    Aftermath: I got an apology, some profit, and funnily enough, he probably didn't change any of his passwords, which I now, purely hypothetically, of course, could have forgotten to delete from my own encrypted hard drive. Most school staff[aside from teachers] could't do anything

    that day. The principal also had some not-so-nice things to say to VP.

    AND TO YOU, VP: YOU ARE A WASTE OF OXYGEN, A MORON, AN IMBECILE, GO DIE IN HELL YOU MOTHERFUCKER, WE DON'T NEED YOUR IDIOCY IN THIS WORLD. MAY THE DEVIL FUCK YOU IN HELL WITH AN HIV INFESTED CACTUS WHILE NICKELBACK IS PLAYING AT 129dB FOR ALL ETERNETY!

    Also, what did I miss in the 2 months I was away from dR?
  • 5
    You missed a lot! The April's fools joke for example. Every avatar was suddenly pixelated!
    jAsE made like ten accounts and caused a lot of confusion in some rant where his different personas were talking to each other.
    @condor fucked up and got his USB drive stolen (had some pretty important stuff on it from what I gather) and he ended up in hospital with a broken nose.
    Oh, and AlexDeLarge is back.
    .
    .
    .
    .
    .
    Just messing, that's what you get for leaving! A late April's fools joke.
    How have you been, mate?
  • 2
    @RantSomeWhere Thanks!
    Now time to find out which ones of those are true....
  • 2
    @xzvf oops, didn't make that clear. Alex is still gone, the rest is true. That was unintentional
  • 2
    @RantSomeWhere Figured that out myself...

    Let me guess everyone went batshit crazy about Articles 11&13. (For some good reasons)
  • 2
    @xzvf yeah, that as well. Devrant was a complete shitfest for a day, literally every second post was 'OMG did you read the news?!?!'. But other than that, nothing too big was going on.
  • 3
    Stop working with that guy from now on. Either he gets his act together or finds somebody else to cover up his mess
  • 2
    @asgs VP in my school. Can't really avoid him. Also is going to be my teacher next year....
  • 3
    Lol, that teacher's incompetence.. you could've charged so much more for that Pi as a "stupidity tax" 😄

    Yep, I lost a flash drive during a fight. So far it seems like everything's still alright though, so I'm getting slightly more confident that the LUKS encryption was sufficiently strong to keep trying eyes out (and probably a suggested format by Windows too 🤭). Still gonna change all those keys it held though.

    Back to the Pi though.. did you happen to get any pictures of it? There's this channel called Tech Gore on Telegram that might like those 😄

    Welcome back btw!
  • 2
    @RantSomeWhere :( that was mean. For a second there i was really happy🙄
  • 3
    I'm fucking riveted by your story. You're a hero for standing up to this worthless piece of ambulatory shite.
  • 2
    @Condor Sadly not. I forgot to take any. I just told the VP directly that it can go into e-waste.
  • 1
    uh, what does this have to do with a raspberry pi?
  • 1
    @toriyuno The service used a raspberry pi as the server.
  • 2
    @xzvf more details on the service? still not sure what it does or how you designed it with the pi
  • 0
    @toriyuno [So basically, what was needed was a way to manage the schedules of staff at my school (maintenance, etc.). The thing was basically a fancy wrapper around some excel sheets(which also did some automated, cronjobs, hence the server). ]

    The private notes came as an afterthought. A password-protected gpg-key and the aes256-cbc encrypted files(using gpg) were stored on the server, and simply sent to the client, where it was decrypted. A new encrypted file could replace the old one on the server via an authenticated request.
Your Job Suck?
Get a Better Job
Add Comment