A guy named Valter couldn't register on this website because the developer blacklisted *ALTER*, amongst other words, to prevent SQL injection.

A client called today because their email wasn't arriving at the receipants inbox but bouncing back with a 'poor MTA rating' error.

Checked about every blacklist I know and our server was definitely not blacklisted. Must be the receipants host which for some reason was blacklisting his specific email address.

Told the client that it wasn't a problem on our side and that he had to request a whitelist himself (we'd do it but it wasn't a specific server problem so we're not going to spend time on that).

Fair enough, he'd do that.

Calls back. "Well, the other party says that your server definitely has a poor rating, it's on your side!!"

Alright, this is getting annoying. Gave him a few blacklist checking sites links and told him to run his domain AND our server IP through it. Indeed came back completely clean.

"But the other party said it's poor rating on your side so I'd think tha........"

YEAH WHY DON'T YOU SHOVE THAT OTHER PARTY UP YOUR FUCKING ASS. I'VE SHOWN YOU PROOF THAT IT'S DEFINITELY NOT ON OUR FUCKING SIDE, EXPLAINED IT TO YOU AND SO ON. MAYBE, FOR ONE FUCKING SECOND, TAKE INTO CONSIDERATION THAT THE OTHER PARTY IS FUCKING LYING?!?!?

FUCK OFF.

*CTO in panic, as always, invites everyone to the war room*

CTO: We have a MAJOR problem where 0.0001% of our customers are not receiving SMS confirmations.

Me: Cool. But, 0.0001% is very less compared to the other problems we are solving.

CTO: You don't understand, this is critical issue that needs to be addressed immediately.

Me: But even those.0.0001% customers are receiving e-mail confirmations, so this is not even blocker as we have other channels working.

CTO: I am emotional at this point. You need to prioritise this now.

Me: Okay, do we know the root cause of this problem?

Engineering head: we have blacklisted those numbers in past as our system detected them abusing our platform.

Me: Cool. Let's whitelist them, nothing much to worry here.

CTO: Floyd, you need to understand that 0.0001% of the customers are not receiving the SMS and the solution you are proposing is incorrect.

Me: Okay, what do you suggest?

CTO: We stop sending the SMS to all the customers.

Everyone on the call: 😨

This tiny project is awesome. Thanks to @JoshBent (who partly got it from another repo as well) for providing a basic DNS server with hardcoded blacklisting functionality and thanks to @PerfectAsshole for correcting my mysql syntax I was stuck on for way too long.

I've now got this fucker to read blacklisted words from a redis list into an array which checks every requested domain to see if it matches. If yes, it proxies it through to another DNS server and if not, it'll log the requested domain to a mysql database and prints is as blocked onto the terminal.

If the domain matches any host from a service known to be integrated within a mass surveillance network, it also prints this out to thy terminal.

It's working yay! Gonna keep working on it today.

It's funny to see when certain stuff works without realizing it.

I've got multiple vpn servers and whenever I connect to one it sets my DNS to my pihole's one (hosted on one of my dedicated servers).

I keep forgetting to change my search engine to duckduckgo and no matter what I search for, no page is/was loading and manually have/had to go to duckduckgo.

Then I suddenly realized: the pihole has blacklisted Google so I literally can't connect to google.com/nl!

Awesome 😊

Started working on a pihole alternative a while ago.

I like pihole a lot but one of the features I am missing is to be able to define a list of mass surveillance related domains (Snowden leaks; PRISM program and such) and show statistics based on dns queries containing blacklisted domains, prases/words and surveillance-related domains/words (google/facebook/microsoft/apple etc).

Started working on one based on an existing (php based) dns server which is open source and slowly but surely developed something which worked.
Then, I found out that the php resolving function (dns resolving) uses the system default, which can, of course, be google's dns as well. Changing this would be ideal but while the documentation suggested that it could be done some way, it didn't work for me so I chose a library which can do it with specific dns servers (to use as external dns servers).
This library used a different way of showing the retrieved dns query results and really wasn't in for converting everything by hand so i kinda quit the project a while ago.

A few days ago I thought fuck it and started again.
Now have a working version based on the new dns resolving library and made some other good improvements.

For those who are wondering why I chose PHP for this: why the fuck not?

Happy happy happy.

Making an infinite loop of cat /dev/urandom for anyone trying to login to server via ssh as an April Fool...
But on prod server instead of dev server...

It's finally happened. I've used my mail servers for about a year to give out different email addresses on my domain to things I sign up for online, and only used my "actual" email address that received all this email for the whole domain but the single one that I used outbound for private communications.

This worked well for a long time as I could see when spam comes in, where it came from by looking at the email address I designated it. Each company's email would be sent not only from an email address that they choose, but also to an email address that I choose. It allowed me to easily determine where there were problems. For example, on Freenode IRC my vhost happened to make my username@host there a valid email address. It eventually got blacklisted due to too much incoming spam as crawlers started detecting it. Another one was "nickname"@my.domain as I posted it a few times here. Got crawled as well. But it allowed me to easily blacklist each.

I'd never thought my actual outbound email address, my real one, to get crawled though. That would require the mail server of a company I explicitly communicated with to get hacked. But today that happened. I wonder whose it is, but I can't tell.

Time to make my outgoing email bound to a designated email address as well. I want to know which companies this happens to, even if they don't disclose it.

Hello devRant, this is going to be my first time posting on the site.

I work for a gaming community on the side, and today one of the managers asked me to implement a blacklist system into the chat and reactivate the previously existing one temporarily. This shouldn't have had any issues and should've been implemented within minutes. Once it was done and tested, I pushed it to the main server. This is the moment I found out the previous developer apparently decided it would be the best idea to use the internal function that verifies that the sender isn't blacklisted or using any blacklisted words as a logger for the server/panel, even though there is another internal function that does all the logging plus it's more detailed than the verification one he used. But the panel he designed to access and log all of this, always expects the response to be true, so if it returns false it would break the addon used to send details to the panel which would break the server. The only way to get around it is by removing the entire panel, but then they lose access to the details not logged to the server.

May not have explained this the best, but the way it is designed is just completely screwed up and just really needs a full redo, but the managers don't want to redo do it since apparently, this is the best way it can be done.

One of my clients got hacked.
FML. It was fucking bad passwords by a team member.

Google has now blacklisted the domain.

Removed the shady code, requested for review. Hope it recovers soon.

Any idea how long it takes for Google to remove the red warning page before you even enter the page ?

A bit different than wk93, but still connected and a fun story.

Back in high school when it began to digitalize everything, so began our teachers journey with technology. We, as IT class were into these things, but as far as I can say, others in the school including both teachers and students were like cave mans when it came to IT.

Most of them kept the different wifi networks password on the windows desktop, in a file 'wifipassword.txt'. When we were on robotics seminar, we had to use a teacher's laptop. The wifi network was incredibly fast and powerful,, yet so poorly configured that even the configuration page user/pass was the default admin/admin, because the IT admin wasn't the most skilled one.

We got the idea to sell the password of the wifi network to other students. Not much, for about 1 dollar a week. The customer came to us, we took the phone, took note of the MAC address, entered the password, and if the guy were to stop paying every week, we just blacklisted that MAC on the next robotics course.

Went well for months, until a new sysadmin came and immediately found it out, we were almost fired from the school, but my principal realized how awesome this idea was. You may say that we were assholes, and partially that is true, I'd rather say we made use of our knowledge.

Me: The IP Address on your public mail server cluster has been blacklisted.

Supporter: What is the IP? You can get it from whatismyip.com

Me: *has left the chat*

This type of post might be good for a weekly rant (if it has not been done yet) "Most Bizarre bug"

So I am working with laravel and vuejs and I use phpstorm as my IDE and today I had the MOST bizarre bug. I'm working on a cryptocurrency website and I'm making a vue component that is going to be a stratum generator for miners and I wanted to make it a component in vue so it can be used anywhere in the site. So I wanted to call the component "StratumGenerator.vue" and i didnt think that this would be an issue. Oh boy was I wrong. So immediately my syntax highlighting did not work nor did emmet autocomplete which is something I can't work without. So i go on for about an hour to fucking figure out how to fix jetbrains vuejs syntax plugins and a very long story short it was because THE FUCKING NAME WAS "StratumGenerator.vue" LITERALLY ANY OTHER NAME WORKS

I've checked its not a blacklisted keyword Stratum and Generator work fine on there own its also not a length thing so right now I have not a fucking clue on why it does not work but i'm glad I figured out.

Isn't US literally using AI/Technology as a war weapon by making Google blacklist Huawei? I mean, I'm afraid. What will we do tomorrow if my county gets blacklisted (not so far by the looks of it)? Can we even trust Google anymore?

P. S. India..

It all started with an undelivereable e-mail.

New manager (soon-to-be boss) walks into admin guy's office and complains about an e-mail he sent to a customer being rejected by the recipient's mail server. I can hear parts of the conversation from my office across the floor.

Recipient uses the spamcop.net blacklist and our mail was rejected since it came from an IP address known to be sending mails to their spamtrap.

Admin guy wants to verify the claim by trying to find out our static public IPv4 address, to compare it to the blacklisted one from the notification.
For half an hour boss and him are trying to find the correct login credentials for the telco's customer-self-care web interface.
Eventually they call telco's support to get new credentials, it turned out during the VoIP migration about six months ago we got new credentials that were apparently not noted anywhere.

Eventually admin guy can log in, and wonders why he can't see any static IP address listed there, calls support again. Turns out we were not even using a static IP address anymore since the VoIP change. Now it's not like we would be hosting any services that need to be publicly accessible, nor would all users send their e-mail via a local server (at least my machine is already configured to talk directly to the telco's smtp, but this was supposedly different in the good ol' days, so I'm not sure whether it still applies to some users).

In any case, the e-mail issue seems completely forgotten by now: Admin guy wants his static ip address back, negotiates with telco support.
The change will require new PPPoE credentials for the VDSL line, he apparently received them over the phone(?) and should update them in the CPE after they had disabled the login for the dynamic address. Obviously something went wrong, admin guy meanwhile having to use his private phone to call support, claims the credentials would be reverted immediately when he changed them in the CPE Web UI.

Now I'm not exactly sure why, there's two scenarios I could imagine:
- Maybe telco would use TR-069/CWMP to remotely provision the credentials which are not updated in their system, thus overwriting CPE to the old ones and don't allow for manual changes, or
- Maybe just a browser issue. The CPE's login page is not even rendered correctly in my browser, but then again I'm the only one at the company using Firefox Private Mode with Ghostery, so it can't be reproduced on another machine. At least viewing the login/status page works with IE11 though, no idea how badly-written the config stuff itself might be.

Many hours pass, I enjoy not being annoyed by incoming phone calls for the rest of the day. Boss is slightly less happy, no internet and no incoming calls.

Next morning, windows would ask me to classify this new network as public/work/private - apparently someone tried factory-resetting the CPE. Or did they even get a replacement!? Still no internet though.
Hours later, everything finally back to normal, no idea what exactly happened - but we have our old static IPv4 address back, still wondering what we need it for.

Oh, and the blacklisted IP address was just the telco's mail server, of course. They end up on the spamcop list every once in a while.

tl;dr: if you're running a business in Germany that needs e-mail, just don't send it via the big magenta monopoly - you would end up sharing the same mail servers with tons of small businesses that might not employ the most qualified people for securing their stuff, so they will naturally be pwned and abused for spam every once in a while, having your mailservers blacklisted.

I'm waiting for the day when the next e-mail will be blocked and manager / boss eventually wonder how the 24-hours-outage did not even fix aynything in the end...

Fuck you Twillio.
You bought a perfectly good email service (SendGrid) and now this service is just.. failing.
All of theirs Ips are getting blacklisted. Our clients are calling us (Of course they are).
People cannot reset passwords, cannot get ANY email notification.
Right now, SendGrid is blacklisted by majority of anti spam systems.
Twilio, fuck you again. This service we were using for more than 5 years without ANY problem. Twilio fucked up.
Fuck you Twlio again. And when we create a “critical” ticket, all you have to say is “Meehhh we’ll contact you in a week” ? REALLY ? Even Microsoft contacts us in 2 hours for critical problems.
Sorry it needed to come out.

Why does Google FRP even exist?!

For everyone who doesn't know what FRP is: FRP (Factory Reset Protection) is a partition on an Android device that stores data about the last used Google account on the device. It "protects" the device to be used by a second person (or a thief) even AFTER a factory reset when executed via bootloader.

Last week I bought a HTC One A9 second-hand w/o any documents. I ensured it has been reset, so I took it home... I then wanted to set it up, as following message appeared on the screen: "This device has been reset. Please login using a Google account that has been synced with this device before."
I checked the IMEI for being blacklisted, but it wasn't. Unlocking the bootloader and erasing the frp partition is not an option, because on HTC devices you have to enable OEM unlocking in the settings first. Someone stated on a forum, that you can bypass the bootloader lock with a "RUU Image" (I'm not familiar with this so pls don't blame me for that statement). But since the phone has a branding from Vodafone Germany, I can't find a RUU Image that would flash the device without a CID mismatch...

Why the f*** does Google have to implement a feature that prevents to use the phone when bought from another person that you don't know?

Argh fuck you Microsoft for blocking my precious mail server. I can't believe that you were the only one. Even google accepts my mails with every fucking test passed...

Oh and not to mention that in the no delivery report you are referring an error code which is not present on the linked troubleshoot page. Thank you once more, you piece of shit.

Should have listened to the articles about why I don't want an own mail server...

You wouldn't believe how hard it is to create an anonymous e-mail address these days. Spent 30 minutes looking for a non-blacklisted provider after failing at Gmail, Yahoo etc..

The perks of working for a .NET shop:
1. 130€ of credit to burn on Azure every month, so I can run some long builds there, to have VPN/proxies for free that are not easily blacklisted and whatever else I can think of. Today I set up a VM for my wife to RDP into, so she doesn't have to do her job search on her company laptop (which is the only computer she has right now).

Malwares are nasty applications, that can spy on you, use your computer as an attacker or encrypt your files and hold them on ransom.

The reason that malware exists, is because how the file system works. On Windows, everything can access everything. Of course, there are security measures, like needing administrator permissions to edit/delete a file, but they are exploitable.

If the malware is not using an exploit, nothing is there to stop a user from unknowingly clicking the yes button, when an application requests admin rights.

If we want to stop viruses, in the first place, we need to create a new file-sharing system.

Imagine, that every app has a partition, and only that app can access it.

Currently, when you download a Word document, you would go ahead, start up Word, go into the Downloads folder and open the file.

In the new file-sharing system, you would need to click "Send file to Word" in your browser, and the browser would create a copy of the file in a transfer-partition. Then, it would signal to Word, saying "Hey! Here's a file that I sent to you, copy it to your partition please!". After that, Word just copies the file to its own partition, signals "Ok! I'm done!", and then the browser deletes the file from the shared partition.

A little change in the interface, but a huge change in security.

The permission system would be a better UAC. The best way I can describe it is when you install an app on Android. It shows what permission the app wants, and you could choose to install it, or not to.

Replace "install" with "grant" and that's what I imagined.

Of course, there would be blacklisted permissions, that only kernel-level processes have access to, like accessing all of the partitions, modifying applications, etc.

What do you think?

I live in a country that is blacklisted on freelancer.com, therefore I don't even have a chance to try freelancing. Fuck, there aren't many things I hate more than this so called country.

Out company standard tools, which we are all supposed to use... (JIRA, confluence) .... IT had blacklisted docs.atlassian.....

a Senior co-worker start cron job using cpanel to fetch tweets every minute .
the problem he didn't use/know
'/dev/null'
which send email to the admin for every successful fetch
after a week we discovered this problem , admin inbox full of emails ,also our server get blacklisted (ie. cannot send emails)

fucking web hosts blocking all SMTP ports outgoing, forcing me to use PHP mail from their shitty blacklisted IP's.

Since I can't use a web api to send the mail Iended up setting up my home server to forward port 53 back out to the mail server, alot of hassle to get mail working :(

A team blacklisted a series of words in order to prevent XSS. Obviously they failed terribly. Like they filtered 'alert(' and crap like that. Like a hacker is going to alert stuff using xss. I opened a bug to their team.

Successfully wasted more than 12 hours in debugging SMTP issue. ColdFusion email script was throwing SSL error. What was real issue? The Web Server IP Address was blacklisted in the Email Server.

Is dilbert.com down/get hacked or did my IP get blacklisted?

1st time, I went today, all the comic strips were replaced with ads.

2nd, the site just hung in Chrome

But ....

After I turned on my VPN, the site was accessible...

Now I have enough of this shit I fucking go grab a chainsaw and cut you into the tiniest pieces possible then pour gasoline on your fucking servers and lit them on fire. How the fuck should I remain calm if there is at least two fucking email I can't send because your fucking piece of shit server gets blacklisted EVERY FUCKING WEEK.

Oh how cool you made ipv6 available to shared plans so outlook servers won't blacklist mails. But guess what, it STILL DOESN'T WORK!!! Not to mention that you automatically modify my existing SPF record and set the shared storage ipv6 address to the main domain which should be pointing to the vps (still working though but have no idea why). I am so fucking fed up with people for today, and it's only just morning.

It's lovely when your corporate application starts having problems sending mail through google, so you fallback to your onsite mail server, only to learn it is nothing more than a pass through to your gmail account.
Not only that, but it isn't secured at all, so spam bots have been sending millions of spam emails through it, leading to your google account being blacklisted which caused the email problems in the first place. Yay!

“Your email address has been blacklisted and you can no longer send emails to this domain. If you feel that this has been done by mistake, I can assure you that I was not.”

That moment you test your api and the enter key is stuck, so postman sends a lot of requests to the server and your ip gets blacklisted...

I blacklisted gaypal across my entire home network wifi from router settings. I do not ever want to see or hear this disgusting pile of bullshit fraud corporation in my face again. EVER