You've heard of ROT13, now get ready for ROT26. This new and improved algorithm is TWICE as secure as ROT13 due to letters being shifted /twice/ as much.

There's even an API for this encryption service, for all ease of programming integration needs!

http://api.rot26.org/encrypt/... to encrypt}

Dear Australian Government and National Authorities, you can go fuck the right away with this shit!

It’s bad enough we are a country of national data collection with flimsy laws of obtaining access to said data, but to then go that one step further and shove back doors into everything is going too far.

https://news.com.au/technology/...

Under the proposed new laws, Australian government agencies could compel companies to provide technical information such as design specifications to help in an investigation, remove electronic protections, assist in accessing material on a device subject to a warrant and even build or install software or equipment that could help authorities gather information.

What could possibly go wrong 🤷‍♂️

I’m back for a fucking rant.

My previous post I was happy, I’ve had an interview today and I felt the interviewer acted with integrity and made the role seem worthwhile. Fuck it, here’s the link:
https://www.devrant.io/rants/889363

So, since then; the recruiter got in touch: “smashed it son, sending the tech demo your way, if you can get it done this evening that would be amazing”

Obviously I said based on the exact brief I think that’s possible, I’ll take a look and let them know if it isn’t.

Having done loads of these, I know I can usually knock them out and impress in an evening with no trouble.

Here’s where shit gets fucked up; i opened the brief.

I was met with a brief for an MVP using best practice patterns and flexing every muscle with the tech available...

Then I see the requirements, these fucking dicks are after 10 functional requirements averaging an hour a piece.

+TDD so * 1.25,
+DI and dependency inversion principle * 1.1
+CI setup (1h on this platform)
+One ill requirement to use a stored proc in SQL server to return a view (1h)
+UX/UI design consideration using an old tech (1-2h)
+unobtrusive jquery form post validation (2h)
+AES-256 encryption in the db... add 2h for proper testing.

These cunts want me to knock 15-20h of Work into their interview tech demo.

I’ve done a lot of these recently, all of them topped out at 3h max.

The job is middling: average package, old tech, not the most exciting or decent work.

The interviewer alluded to his lead being a bit of a dick; one of those “the code comes first” devs.

Here’s where shit gets realer:
They’ve included mock ups in the tech demo brief’s zip... I looked at them to confirm I wasn’t over estimating the job... I wasn’t.

Then I looked at the other files in the fucking zip.

I found 3 of the images they wanted to use were copyright withheld... there’s no way these guys have the right to distribute these.

Then I look in the font folder, it’s a single ttf, downloaded from fucking DA Font... it was published less than 2mo ago, the license file had been removed: free for Personal, anything else; contact me.

There’s no way these guys have any rights to this font, and I’ve never seen a font redistributed legally without it’s accompanying licence files.

This fucking company is constantly talking about its ethical behaviours.

Given that I know what I’m doing; I know it would have taken less time to find free-for-commercial images and use a google font... this sloppy bullshit is beyond me.

Anyway, I said I’d get back to the recruiter, he wasn’t to know and he’s a good guy. I let him know I’d complete the tech demo over the weekend, he’s looked after me and I don’t want him having trouble with his client...

I’ll substitute the copyright fuckery with images I have a license for because there’s no way I’m pushing copyright stolen material to a public github repo.

I’ll also be substituting the topic and leaving a few js bombs in there to ensure they don’t just steal my shit.

Here’s my hypotheses, anyone with any more would be greatly welcomed...
1: the lead dev is just a stuck up arsehole, with no real care for his work and a relaxed view on stealing other people’s.
2: they are looking for 15-20h free work on an MVP they can modify and take to market
3: they are looking for people to turn down this job so they can support someone’s fucking visa.

In any case, it’s a shit show and I’ll just be seeing this as box checking and interview practice...

Arguments for 1: the head told me about his lead’s problems within 20mn of the interview.
2: he said his biggest problem was getting products out quickly enough.
3: the recruiter told me they’d been “picky”, and they’re making themselves people who can’t be worked for.

I’m going to knock out the demo, keep it private and protect my work well. It’s going to smash their tits off because I’m a fucking great developer... I’ll make sure I get the offer to keep the recruiter looked after.

Then fuck those guys, I’m fucking livid.

After a wonderful interview experience and a nice introduction to the company I’ve been completely put off...

So here’s the update: if you’re interviewing for a shitty middle level dev position, amongst difficult people, on an out of date stack... you need people to want you, don’t fuck them off.

If they want my time to rush out MVPs, they can pay my day rate.

Fuuuuuuuuck... I typed this out whilst listening to the podcast, I’m glad I’m not the only one dealing with shit.

Oh also; I had a lovely discriminatory as fuck application, personality test and disability request email sent to me from a company that seems like it’s still in the 90s. Fuck those guys too, I reported them to the relevant authorities and hope they’re made to look at how morally reprehensible their recruitment process is. The law is you don’t ask if the job can be done by anyone.

- popunder background bitcoin miners did become a thing
- keybase android beta uploaded your privatekey to google servers "accidentally"
- you can spoof email headers via encoded chars, because most apps literally just render them apparently
- imgur leaked 1.7 million user accounts, protected by sha-256 "The company made sure to note that the compromised account information included only email addresses and passwords" - yeah "only", ofcourse imgur, ofcourse.

I guess the rant I did on Krahk etc. just roughly a month ago, can always be topped by something else.

sources:
https://www.mailsploit.com/index

https://bleepingcomputer.com/news/...

https://blog.malwarebytes.com/cyber...

https://helpnetsecurity.com/2017/...

Continuation of https://devrant.com/rants/642962/...

You are the decryption key to my encryption,
No one can access my heart except you.

You are the loop in my life,
I always keep coming back to you.

You are my nodemon,
You are always watching over me.

You are the / to everything I do,
Am nothing without you and I will always preserve you.

You are my increment operator,
You add value to my life.

To be continued 😉

Hello fellas! 👋

I recently told you that I’m planning to pull out Chaaat – a fully open source messenger that doesn’t track you and doesn’t share your data: https://devrant.com/rants/1549251/....

The project is also mentioned here: https://devrant.com/rants/1570178/...

So, I’m here to tell you good news – a great developer, @not-a-muggle, decided to join me, and now we made a team!

I also made some conversations and acquired “chaaat” name from another team on Heroku, so now we have consistent domain name on both Heroku and GitHub Pages.

We have Trello board with very well described tasks almost anyone can do. We also have Slack to have both business and free conversations.

If you’re seeking a place to contribute and gain some NodeJS / React / PWA / WebRTC experience with detailed code review from experienced developer, just mention me here or shoot me an email on hello@miloslav.website. Provide your email so I’ll be able to contact you.

Our main goals are:
1. Have fun and some experience
2. Make it to Chrome Experiments mention

Marketing/advertising help is much appreciated.

Feel free to email me anytime!

API Documentation: All API request should be made over https connections.

Me: Ok, (sees url bar), SECURE, good!

(sees curl code)

curl -X GET 'http://shittyapi.com/api/v2/users'

Me: (gasps) huh?

(heads to http://shittyapi.com/api/v2)

Me: Ok, (sees address bar) NOT SECURE

.
.
.
.
.

(long silence)

This is my #wk110 about a project from when I was a real n00b. It can also be read as a rant about myself.

So I decided to code my own terminal based password manager. Because, you know, whom can you trust the most; yourself or some random password manager from the internet?

Obviously, encryption plays a major role when storing such sensitive information. So n00b me decided to go with Base64.

Base64.

I developed a password manager that stores your passwords in Base64 format.
What must I have thought?!
Perhaps the gibberish looks of Base64 encoded data made me think that this actually is encryption.
After having realized my stupidity, I quickly replaced Base64 with AES and more recently I completely rewrote the whole project which is now also available on gitlab: https://gitlab.com/bitteruhe/sesame

This act of stupidity still embarrasses me every time whenever I think about it, though.

https://extremetech.com/internet/...

Australia is requiring every tech company that does business there to have backdoors for law enforcement. We are _all_ fucked. This is a big deal for everyone everywhere, because now not only are your services (more) vulnerable to attacks and spying, but your governments are more likely to pass this shit, too.

Furthermore, "In case you’re wondering, according to a survey of the 343 comments made on the bill while it was under discussion, only one of them — and not an Australian citizen at that — was in support. The Australian Parliament simply didn’t care." What the fuck does this say about the government? You draw your own conclusions.

Just read the fucking article, we are all fucked. This is pissing me off more than Net Neutrality. FUCK!

Have you read about this yet ?
https://itnews.com.au/news/...

I don't live in a FVEY country , but it still terrifies me.

What makes free ssl "Unsuitable for e-commerce websites", Please read to end to see my view point.

From Namecheap:
Free Certificates are domain validation only which means they don't certify the identity of the website owner, they simply ensure a secure connection. Customers can't be sure of the integrity and trustworthiness of the website owner. If you need to secure credit card and personal information on e-commerce websites, free certificates aren't the answer. It's important your customers trust your business is safe enough to hand over these details. To gain this trust, you need a certification of your authenticity, which you can only get with a (paid) Business Validation or Extended Validation SSL Certificates.

https://namecheap.com/security/...

* "To gain this trust, you need a certification of your authenticity"
~ But isn't that just Domain Verification and other Extras, What justifies somebody or business's authenticity? Tax Id, Valid Address, Nobody is going to study the ssl cert to make sure that amazon.com is a valid business and has a tax Id.

* "domain validation only which means they don't certify the identity of the website owner,"
~ Wouldn't this just be the domain validation test that is required when using services like LetsEncrypt using Certbot etc, or are we referencing back to this idea that they look for a Valid Tax Id sort of thing?

* "If you need to secure credit card and personal information on e-commerce websites, free certificates aren't the answer"
~ Why is the paid version going to do double encryption, is the CA going to run a monitoring tool to scan for intrusions like a IDS or IPS? (disregard the use of DNS Validation being in the picture)

Am I missing something, this just seems like well crafted text to get people to buy a cert, I could understand if the encryption was handled differently, Maybe if they checked the site for HSTS or HTTPs Redirect or even, They blocked wildcard SSL before and now with the paid its included, but overall it doesn't sound like anything special. Now I'm not just picking on namecheap because domain.com does the same.