Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
So I've been screaming for months that push notifications are not reliable enough to build critical functionality on top of. Management won't listen and keep pushing ahead with making teams use it because its cheap and easy.
Been debugging an issue on/off for several weeks. Turns out someone in management asked the backend team to cut the expiration time of items down to 5 minutes to increase throughput (without telling mobile). Notifications are regularly taking +4 mins to get to the phones, leaving our users with barely any time to react. They are now complaining.
I swear if there is a single IQ point available between the whole team i've yet to see any evidence of it8 -
Find super interesting forum thread from 2015 with intelligent discussion about deep technical stuff.
Creating forum account, thinking about contributing to ongoing discussion with code samples, findings, hypotheses, and some open questions.
Browse to last post, is from late 2016, from moderator:
READ FORUM RULES DO NOT POST IN OLD THREADS LOCKING THIS
Me: 😡😤😠 WHO THE FUCK CAME UP WITH THE SHITRULE THAT A DISCUSSION HAS AN EXPIRATION DATE? IF I COULD REACH THROUGH THE SCREEN RIGHT INTO 2016, I'D PUNCH YOU THROUGH THE ROOF OF YOUR MOTHER'S BASEMENT. NO ONE LOVES YOU, YOU USELESS MOTHERFUCKING CUNT OF A MODERATOR.3 -
OH FOR HEAVENS SAKE!!!
*I* take care of my food in the department fridge, *NOT* you!
And start to fucking realize:
IT IS CALLED: "Best Before End"
and ABSOLUTELY FUCKING NOT: "Guaranteed To Be Deadly From"
Next time you throw away my perfectly fine food, I'll dig into the reflog, throw a dice and throw away 3 random commits of yours claiming that THEY EXPIRED!
YOU ARSE!5 -
So... remember my first rants about my network at my last ship?
https://devrant.com/rants/2076759/...
https://devrant.com/rants/2076890/...
https://devrant.com/rants/2077084/...
Well... I had to visit them for an unrelated matter and found out that they are to pass general inspection the next week. Among the inspectors is a member of the cyber defence team. I took a quick look at the network, finding the things I'd expect:
- No updates passed to the server or installed since I left
- No antivirus updates since I left
- All certificates were expired
- Most services were shut down or unused
- All security policies were shut down
- Passwords (without expiration now) were written on post-it and stuck on screens
- ... and more!
I told the XO (the same idiot that complained about them CONSTANTLY) and he just shrugged me off and told me to """fix""" it. In one fucking afternoon.
I. SHIT. YOU. NOT.
The new admin there is a low ranking person who hasn't the faintest idea of how this works, and isn't willing to learn, either. They just dumped the duty on him, and he seems not to care. The cyber security inspector is going to have a field day. Or get grey hairs.
I told the XO that I needed at least a week to get them into working order (I have to re-set up my virtual Windows 2012 R2 server, download 2 years' worth of updates, repair 2 years of neglect etc.). The answer was what I expected:
"You know computers, you can do your magic and get it done in an afternoon."
Thank god I got transferred and don't have to answer to that idiot any more. Now, popcorn time, as I watch the fireworks.
Yes, I am a vengeful guy. I have told them, twice now, of what would happen. They didn't listen. At least now, with an official report on their heads, they just might.3 -
I'm exhausted.
After one and a half year after my last rant, I'm here again. I left the previous job as web developer after almost 12y. At the time I found 3 new jobs as developer; I chose the one with the largest company, the premises were really good. My 3 interviews were excellent. But what I found next was almost a nightmare.
I was literally "confined" for the first 2 months, no internet connection, no email address, very little communication with colleagues. My near colleague was sharing the code were I would work via a usb key. All this for "safety" purposes, because "here you start this way".
For me it was not so bad, I could take my time to study my work and do it (without Stack Overflow and only by reference guides, when needed - I felt proud in an old way). But the next months were really tough: no help to understand what I missed about the work I was doing (consider that I was working on a large database, previously used by an old ERP, on which other developers - prior me - wrote a lot of code, to make the company continue use all the data after the expiration of the ERP licences - speaking about a year 2000's Java application).
Now I find myself struggling, because the main project on which I was working has been set aside (apparently for some budget decisions); my work team constantly make me do some manteinance on the old code, but the main tasks are done by the old mate, "because deadlines are always pressing and there would not be enough time to explain you anything". I'm not growing.
I'm really becoming reluctant to write code, and whenever I do it, I constantly feel under pressure, and this makes me nervous and inclined to make errors.
Don't take me wrong, I was/am good at my work, but it's like I'm loosing that sparkle I had till a few years ago.
When I'm at home I try to study or write code, just to keep training my mind, but I'm really struggling and I'm worried about losing my brain for doing this job. I constantly forget things and lose focus.
Never felt this way. I am thinking about the chance to switch again and search for another company.6 -
Our system never had sessions that expired. A recent hack at the client caused us to revisit the security measures we had in place.
The person who was on the project since it's start 8 years ago was tasked with fixing this issue. It has a simple solution: add session expiration, and extend the session to an hour from now with each request.
This week I found out how he did it🤦🏻♂️. He added session expirations, but extended the session by an hour with each request. By making 10 requests in quick succession, your session is extended by 10 hours.3 -
'Get a smart device', they said.
'Unlimited media experience, internet powered!' they said.
What they didn't say, most of the apps are just webpages with an expiration date.
2 -
Might be more of a self-rant.. We’re developing an application with token-based authentication.
It’s a big an complex authentication model and flow, which we wrapped up a month ago. All of us very proud of it.
All of a sudden none of it worked.
We debugged for days, there were no errors or anything to trace what was happening.
Today we realized that we set the expiration of the token to 20 years.
Aaaand the expiration time is later on converted to epoch.
Guess what happens when you try to use a value > 2 147 483 647 in C#? Stuff blows up, cuz that’s the limit of an int32.
So yeah, feels good having prepared for the Y2K38 bug already, even though we’ll be replaced by AI writing better software than my dumb ass by then.
(To be fair, it was hidden in Microsoft Owin, which could use some error handling and/or proper messages..) -
I beg your pardon that I did not implemented the mind-reader API and my app doesn't know if a discount is expired when you DIDN'T FUCKING SET AN EXPIRATION DATE YOU ARSEBADGER!!
-
Follow up to: https://devrant.com/rants/5047721/....
1- The attacker just copy pasted its JWT session token and jammed requests on the buy gift cards route
2- The endpoint returns the gift card to continue the payment process, but the gift card is already valid
3- Clients wants only to force passwords to have strong combinations
4- Talk about a FIREWALL? Only next month
5- Reduce the token expiration from 3 HOURS to 10 minutes? Implement strong passwords first
6- And then start using refresh tokens
BONUS: Clearly someone from inside that worked for them, the API and database password are the same for years. And the route isn't used directly by the application, although it exists and has rules that the attacker kows. And multiple accounts from legit users are being used, so the person clearly has access to some internal shit6 -
I wonder if jetbrains will change my licence expiration date to a day earlier.
I get kinda depressed every time I open one of their products.
*Sigh*
1 -
Reminder to all the nice admins / devs out there who might have an ancient project / device / docker image / ....
https://openssl.org/blog/blog/...
https://letsencrypt.org/docs/...
Shouldn't matter for most things...
If it matters, it might be a very very very good idea to nuke it from the orbit and start fresh. :) ;)1 -
Spent the entire morning updating a SQL query.
Client wanted to have different expiration times for different products. So the full package would be 1 year of access and a module would only be 6 months. Then when you renew your account the renewal is 1 year if you have the full package else it's 6 months.
The query takes 0.7s to run and left joins 3 tables. Only to return about 100 results. Still it's faster than the guy who wrote the original query which just dumped the hole db into memory then looped through it appending valid entries to a new array. -
I hate the overuse of arrow function everywhere even for super long expression. that `function` should fit to them more comfortably .
writer of code should aware that it take three time more to read expiration with arrow function inside5 -
Sus!
yesterday I bought a cool domain in namecheap, I was very lucky to find short and good one for my case.
Today (at weekends!!!!) I receive a letter:
>Hello **redacted name**,
>
>We are contacting you from the Namecheap Risk Management Team regarding your '**redacted name account**' account.
>
>Unfortunately, your Namecheap account was flagged by our fraud screening system as requiring verification and was locked.
>
>Please follow the instructions below to get your account verified:
>
>- take a color photo of the credit card used for the payment at **redacted link**
>
>Please make sure all of the edges of the credit card are visible, and that we can clearly see the card holder's name, expiration, and last four digits of the card number. The screenshots or images of the card cannot be accepted for verification. >If the submission does not meet these requirements, we can either request to submit the details again or permanently suspend your account.
>
>- provide a valid phone number and the best time to call you (within normal business hours, US Pacific time).
>
>If we do not hear back from you within 24 hours, we will be forced to cancel your orders.
>
>We apologize for any inconvenience that may result from this process. This extra verification is done for your security and to ensure that orders are legitimate. This industry, unfortunately, has a high rate of fraudulent orders, and this sort of >verification helps us drastically reduce fraud and ensure our customers remain secure. Such documents are used for verification only and are not provided to third parties in any way. Account verification is a one-time procedure, after your account >is verified, you will never face this issue again.
>
>Looking forward to your reply.
>
>---------------
>Dmitriy K.
>Risk Management
> Namecheap, Inc.
what if I did not notice it in 24 hours? It is the weekend for god's sake! People usually rest until monday.
They would what, cancel order and scalpel it to super high price?!
I have some doubts if the request is trully having anti fraudulent origins.
What if I used digital visa card? How was I supposed to photo it?
And the service they provided for photoing accepts only photos from web camera. I was lucky that I bought recently web camera with high enough amount of pixel power and manual focus. What if I did not?
That's all really SUS!
The person can not notice the letter within 24 hours time frame until the morning, when it would be already too late.10 -
Client: "According to the Postgresql Version Support Policy, 9.3 will be expired by September 2018. That's only a few months away."
Me in thought: "Expired? Like a rotten egg? With an expiration date? OK, chill. His English isn't that good. Maybe he meant that support expires since its EOL."
Client: "We need to upgrade so that we can continue using the database."
Me in thought: "Yeah, he really meant "expired" in database too."4 -
Legal Question regarding E-Commerce / Credit Card Payments.
The User sends his Credit Card Information (number/expiration Date/Safety Number) over email to vendor. Vendor types this info from the email into a Credit Card Terminal.
Is this even legal? I thought when listing Credit Card Payment you have to use a PSP (Payment Service Provider) that conforms to the security regulations etc.7 -
I've just used https://gtmetrix.com to see how devRant fares. Pretty well actually, with one major gotcha that should be easy to fix. There are a lot of static resources without browser cache expiration date.
A little image optimisation could also be done, see the PageSpeed tab. And scaling down images in CSS could also be replaced by proper scaling of the image itself.
The YSlow tab shows that a little JS minification is missing, and maybe 4 external scripts could be combined into one.1 -
When every related field has a god damn different way of working with the data on hand..
For example:
`tht_date` ("Y-m-d", Date) - expiration date on the product, hence, there can be multiple of the same products with a different THT
`tht_alert` ("-2 months", varchar, DateTime modify mutation string) - sending an alert when this interval is hit, and being the activator of the tht_date field (unless value is "none")
`tht_minimum` ("28", integer, quantity of days before tht_date) - to lock them from being sent out/collected.
...
How would you expect this ×not× to become a friggin' spaghetti when trying to resolve the best row ID?
These values are in the wrong spot in the first place, then they also act entirely different in relation to eachother..
I hate the person that set this up, for doing this. When is the madness going to stop...
FFS!! -
So I wrote these E2E tests to test my credit card expiration notification emails. So I wrote my code, and tested it. Tests failed. I spent the next 6 hours (spanning 2 days) debugging my tests. Come to find out that the tests were fine all along. The issue was my code.
Apparently everything has dates starting at 1 (day starts at 1, year starts at 1). But MONTHS. Months start at 0 -
Pycharm why you no allow me to continue to use the professional edition...
Damnn and they way pycharm has served me well7 -
Not dev per sé but annoys see he'll out of me on a monthly basis... 30 day password expiration, how does that make things more secure?! The thing that makes it worse is that I can't use any previous 28 passwords or anything too similar... Now I'm stuck with a 36 character password which I have to put in everytime my work machine decides to lock out... Which is less than a minute of not touching it.
What's that? No I can't turn around and answer a question because if I do I'll be taking 20mins off of my future career prospects as I'm working on leveling up my inevitable arthritis6 -
The only thing worse than client QA is client vendor QA.
I do QA for a company that does custom implementations of a major e-commerce platform. On one of my current projects, the customer has elected to outsource their UAT, and isn't willing to wait for the site (or even individual features) to be complete before starting testing, so I've been triaging a lot of silly tickets. But today took the cake.
This system allows users to save their credit card info. The vendor QA guy filed a ticket "reporting" that if he saved a cc with a given number, then created a new cc record with the same number but a different expiration date, the original record was overwritten, rather than a new record being created.
I just stared at the thing for like five minutes, gathering the mental strength to reply with something other than "you're an idiot."3 -
One year anniversary at my company and I find I personally have 4 separate exchange accounts to varying levels of synchronization. Perforce, email, lync Skype and a few others have varying spellings of "Welcome1" as the password.
Every password expiration and reset gradually adds to the slow motion landslide.
IT can't figure out how my accounts are even working in the first place and wont touch it.
Halp.1 -
We ended up finding ourselves with a bunch of tables that have mostly the same columns, but differ by a few. Every time we consume a REST API, we store the `access_token`s and expiration dates and the other OAuth data. However, each provider has slightly different requirements. For example, we store email addresses for email api's, other providers require us to store some additional information, etc. etc.. I'm tempted by the flexibility and lack of schema brought by document databases, but not enough to use one since they're generally slower and we already have everything in SQL. So I got the idea of using JSON columns to alleviate this issue: have a single table for all REST integrations (be it outlook or facebook), and then store the unique integration data inside of this JSON column for "additional data". This data is mostly just read, not filtered by (but ocasionally so). Has anyone had experience with this? How's the performance of JSON fields? Is this a good practice or will it get harder with more integrations?
-
As I sit here trying not to do the same shit as these idiots keep going crazy and driving me the same place I thought I’d browse the news and I saw a repeat in this precise life stealing scenario where people who are long past their expiration date pretend to be doing me a favor by destroying the evidence that they wronged me and everyone else that was an honest person and now can’t explain them fucking selves
60 year old 50 year olds and such
And a closed network of assholes that repeat the same shit and keep me trapped
I’m trying to live
To work
To progress
They made the country a prison withholding media news releases and keeping morons wandering around in a “stabilizing” way
Now they’re talking about a. Very real farce that is occurring in dc yet again
Open to half capacity after the farsical COVID scare again
How are so many people such brainwashed trash ?
Thinking they’re either winning or nothing better could happen while the next generation of dupes is inserted into the mix
It makes me angry
Meanwhile my fucked up chomo father and his surveillance duplicates... well it’s possible my actual father is dead at this point
Maybe
Still go about business as usual and I find myself wondering when younger people will wake up and when I’ll see some new fucking tv or movies at the very least since seemingly holding onto photos and videos and writing and personal effects seems a tad difficult
I swear to god I’ll be dead before I’m officially 50 !1 -
CertCobra - Get Alerted When SSL Certificates Are About To Expire
Prevent downtime on any of your websites by getting automated alerts when your SSL certificates are about to expire. With CertCobra's proactive SSL certificate management, you can sit back and relax without having to manually track your SSL certificate expiration dates. Get reminders on time when your SSL is about to expire thanks to smart email notifications, and avoid any issues with your website(s).
1
Top Tags
Weekly Rant
View