I'm getting ridiculously pissed off at Intel's Management Engine (etc.), yet again. I'm learning new terrifying things it does, and about more exploits. Anything this nefarious and overreaching and untouchable is evil by its very nature.

(tl;dr at the bottom.)

I also learned that -- as I suspected -- AMD has their own version of the bloody thing. Apparently theirs is a bit less scary than Intel's since you can ostensibly disable it, but i don't believe that because spy agencies exist and people are power-hungry and corrupt as hell when they get it.

For those who don't know what the IME is, it's hardware godmode. It's a black box running obfuscated code on a coprocessor that's built into Intel cpus (all Intell cpus from 2008 on). It runs code continuously, even when the system is in S3 mode or powered off. As long as the psu is supplying current, it's running. It has its own mac and IP address, transmits out-of-band (so the OS can't see its traffic), some chips can even communicate via 3g, and it can accept remote commands, too. It has complete and unfettered access to everything, completely invisible to the OS. It can turn your computer on or off, use all hardware, access and change all data in ram and storage, etc. And all of this is completely transparent: when the IME interrupts, the cpu stores its state, pauses, runs the SMM (system management mode) code, restores the state, and resumes normal operation. Its memory always returns 0xff when read by the os, and all writes fail. So everything about it is completely hidden from the OS, though the OS can trigger the IME/SMM to run various functions through interrupts, too. But this system is also required for the CPU to even function, so killing it bricks your CPU. Which, ofc, you can do via exploits. Or install ring-2 keyloggers. or do fucking anything else you want to.

tl;dr IME is a hardware godmode, and if someone compromises this (and there have been many exploits), their code runs at ring-2 permissions (above kernel (0), above hypervisor (-1)). They can do anything and everything on/to your system, completely invisibly, and can even install persistent malware that lives inside your bloody cpu. And guess who has keys for this? Go on, guess. you're probably right. Are they completely trustworthy? No? You're probably right again.

There is absolutely no reason for this sort of thing to exist, and its existence can only makes things worse. It enables spying of literally all kinds, it enables cpu-resident malware, bricking your physical cpu, reading/modifying anything anywhere, taking control of your hardware, etc. Literal godmode. and some of it cannot be patched, meaning more than a few exploits require replacing your cpu to protect against.

And why does this exist?
Ostensibly to allow sysadmins to remote-manage fleets of computers, which it does. But it allows fucking everything else, too. and keys to it exist. and people are absolutely not trustworthy. especially those in power -- who are most likely to have access to said keys.

The only reason this exists is because fucking power-hungry doucherockets exist.

I've had my share of incompetent coworkers. In order of appearance:

1. A full stack dev. This one guy never, and I mean NEVER uses relationships in their tables. No indexing, no keys, nada. Couple of months later he was baffled why his page took ten seconds to load.

2. The same dev as (1). Requirement was to create some sort of "theme" feature for a web app. Hacked it by putting !important all over the place.

3. The same dev again. He creates several functions that if the data exists returns a view, and if it doesn't, "echo '0'". No, not return 0 or return false or anything, but fucking echo. This was PHP. If posted a rant about this a few months ago.

4. Same dev, has no idea what clean code is. No, not just reusable functions, he doesn't even get indenting right. Some functions have 4 spaces, some 2 tabs, some 6 tabs! And this is inside the same function. God wait until he tries Python...

5. Same dev now suggests that he become the PM. GM approves (very small company). Assigns me to travel to a client since they needed "technical assistance about the API". Was actually there to lead a UAT session.

Intermezzo, that guy went from fullstack dev to PM to sales (yes, one who calls clients to offer products) to business development, to product analyst in the span of two years.

After a year and a half there, I quit.

6. New company, a "QA engineer" who also assumes the role as the product owner. Does absolutely no tests other than "functional tests" in which he NEVER produces any form of documentation. Not even a set of test cases. He goes by "intuition".

7. Same guy as (6), hands me requirements for a feature. By "hands me" I mean he did that verbally. No spec documents, no slack chat, no Trello card. I ended up writing it as a card in Trello. Fast forward to the due date, he flips out because that wasn't what he wanted. Showed him the card. He walked away, without thinking of a solution how this mess should be handled.

Despite all this, I really don't want him (6&7) to leave the company. The devs get really stressed out at this job and he does make a really good person to laugh with/at.

I had to open the desktop app to write this because I could never write a rant this long on the app.

This will be a well-informed rebuttal to the "arrays start at 1 in Lua" complaint. If you have ever said or thought that, I guarantee you will learn a lot from this rant and probably enjoy it quite a bit as well.

Just a tiny bit of background information on me: I have a very intimate understanding of Lua and its c API. I have used this language for years and love it dearly.

[START RANT]

"arrays start at 1 in Lua" is factually incorrect because Lua does not have arrays. From their documentation, section 11.1 ("Arrays"), "We implement arrays in Lua simply by indexing tables with integers."

From chapter 2 of the Lua docs, we know there are only 8 types of data in Lua: nil, boolean, number, string, userdata, function, thread, and table

The only unfamiliar thing here might be userdata. "A userdatum offers a raw memory area with no predefined operations in Lua" (section 26.1). Essentially, it's for the API to interact with Lua scripts. The point is, this isn't a fancy term for array.

The misinformation comes from the table type. Let's first explore, at a low level, what an array is. An array, in programming, is a collection of data items all in a line in memory (The OS may not actually put them in a line, but they act as if they are). In most syntaxes, you access an array element similar to:

array[index]

Let's look at c, so we have some solid reference. "array" would be the name of the array, but what it really does is keep track of the starting location in memory of the array. Memory in computers acts like a number. In a very basic sense, the first sector of your RAM is memory location (referred to as an address) 0. "array" would be, for example, address 543745. This is where your data starts. Arrays can only be made up of one type, this is so that each element in that array is EXACTLY the same size. So, this is how indexing an array works. If you know where your array starts, and you know how large each element is, you can find the 6th element by starting at the start of they array and adding 6 times the size of the data in that array.

Tables are incredibly different. The elements of a table are NOT in a line in memory; they're all over the place depending on when you created them (and a lot of other things). Therefore, an array-style index is useless, because you cannot apply the above formula. In the case of a table, you need to perform a lookup: search through all of the elements in the table to find the right one. In Lua, you can do:

a = {1, 5, 9};
a["hello_world"] = "whatever";

a is a table with the length of 4 (the 4th element is "hello_world" with value "whatever"), but a[4] is nil because even though there are 4 items in the table, it looks for something "named" 4, not the 4th element of the table.

This is the difference between indexing and lookups. But you may say,

"Algo! If I do this:

a = {"first", "second", "third"};
print(a[1]);

...then "first" appears in my console!"

Yes, that's correct, in terms of computer science. Lua, because it is a nice language, makes keys in tables optional by automatically giving them an integer value key. This starts at 1. Why? Lets look at that formula for arrays again:

Given array "arr", size of data type "sz", and index "i", find the desired element ("el"):

el = arr + (sz * i)

This NEEDS to start at 0 and not 1 because otherwise, "sz" would always be added to the start address of the array and the first element would ALWAYS be skipped. But in tables, this is not the case, because tables do not have a defined data type size, and this formula is never used. This is why actual arrays are incredibly performant no matter the size, and the larger a table gets, the slower it is.

That felt good to get off my chest. Yes, Lua could start the auto-key at 0, but that might confuse people into thinking tables are arrays... well, I guess there's no avoiding that either way.

So we had a dev on our team who was on a performance improvement plan, wasn't going to pass it, but decided to quit before it was over saving us 2 weeks.

I was ecstatic when he left (caused us hell). I knew updating his code wouldn't be great, but he was only here 6 months

"how bad could it be" - practiseSafeHex - moron, idiot, suicidal.

A little run down would be:

- Despite the fact that we use Angular 2+, one of his apps is Angular 1 ... Nobody on the team has ever used Angular 1.

- According to his package.json he seems to require both mongoDb and Cloudant (couchDb).

- Opened up a config file (in plaintext) to find all the API keys and tokens.

- Had to rename all the projects (micro services) because they are all following a different style of camelcase and it was upsetting my soul.

- All the projects have a "src" folder for ... you know ... the source code, except sometimes we've decided to not use it for you know, reasons.

- Indentation is a mess.

- He has ... its like ... ok I don't even know wtf that is suppose to be.

- Curly braces follow a different pattern depending on the file you open. Sometimes even what function you look at.

- The only comments, are ones that are not needed. For example 30+ lines of business logic and model manipulation ... no comment. But thank god we have a comment over `Fs.readFile(...)` saying /* Read the config file */. Praise Jesus for that one, would have taken me all week to figure that out.

Managers have been asking me how long the "clean up" will take. They've been pushing me towards doing as little as possible and just starting the new features on top of this ... this "code".

The answer will be ... no ... its getting deleted, any machine its ever been on is getting burned, and any mention of it will be grounds for death.

Was coding and tired as hell, my light in the room blew this week and I haven't got around to replacing it - the darkness is not exactly that exciting.

Pressed a wrong button by accident, lo and behold my laptop has a backlit keyboard. I had no idea that it had this. Blew my fucking mind (I have never had the time to just sit and look at the function keys - I suppose that is one downside to never having to look at the keyboard when one types).

A new flow of inspiration came upon me, I opened up VSCode and put on some Pantera.

Code beware, I'm fucking hostile.

I have this one chick on Twitter that she used to be a fellow classmate of mine while I was going for my Bachelors degree.
She would always bitch and complain about how the teachers we had were horrible at teaching. I had to interact with her because of one assignment and EVERYONE in the team was good and well with the items, we finished it rather quick (build a terminal emulator) and we were just thinking about ways to make it look cooler. It was challenging to be honest, but everyone was so interested in it and had all the materials requires plus a very nice instructor to go with that would be overly happy to answer questions and provide additional content, the instructor in question made no book requirement for the class and provided instead free resources, be it video content or his own code on the matter to make sure that everyone got it.

Dude was amazing (most of my university instructors were truly fascinating or people that had worked for very interesting projects) and so when she complain that the guy "had no idea how to teach" I decided to investigate a little.

You see, she had NEVER taken any consideration that maybe you should advance your studies in the field, particularly in programming, by doing your own fucking research. No, the professor is not supposed to hold your fucking hand while you are trying to understand how a fucking function IN FUCKING PYTHON works, dude gave a full length lecture and the only retard that did not understood the topic: was you. He went to you to help you and instead you gave the man an attitude because for some fucking reason he was accounted for your own fucking stupidity. Motherfucker was there for more than 30 minutes trying to explain to this dumb chick the nuances of def hello(): return "hey there" and for some fucking reason you were too daft to understand that.......

The chick complained to us in the team how because of work she had NO time whatsoever to dedicate to reading programming or general software engineering materials......yet her twitter was FULL of book reviews concerning novels and self help books and bullshit like that.

If you are like that, and blame it on your teachers: fuck-you.

To this day she still bitches about the teachers from time to time, I legit told her once that she had no business attending a C.S degree.

Do you think you can get into Julliard without ever touching a fucking instrument? no. Do you think you can tell some Terence Fletcher-throwing-a-chair-at-your motherfucker to show you how to position your hands on a drumstick or what keys to press on a piano? FUCK NO.

If you were being DAFT on a ProGraMmiNg101 for which they picked Python to be the language to use and blamed your fucking stupidity to a teacher then yet again: FUCK-YOU

PHP arrays.

The built-in array is also an hashmap. Actually, it's always a hashmap, but you can append to it without specifying indexes and PHP will use consecutive integers. Its performance characteristics? Who knows. Oh, and only strings, ints and null are valid keys.

What's the iteration order for arrays if you use them as hashmaps (string keys)? Well, they have their internal order. So it's actually an ordered hashmap that's being called an array. And you can produce an array which has only integer keys starting with 0, but with non-sequential internal (iteration) order.

This array weirdness has some non-trivial implications. `json_encode` (serializes argument to JSON) assumes an array corresponds to a JSON array if its keys are consecutive integers in increasing order starting with 0, otherwise the array becomes a JSON object. `array_filter` (filters arrays/hashmaps using callback predicate) preserves keys, so it will punch holes in the int key sequence if non-last items are removed, thus turning arrays into hashmaps and changing your JSON structure if you forget to discard keys before serialization.

You may wonder how JSON deserialization works, then? There's a special class for deserialized JSON objects, `stdClass`. It's basically a hashmap too, but it's an object, not an array, and all functions that would normally accept arrays won't work with it. So basically its only use is JSON (de)serialization. You can even cast arrays to objects, producing `stdClass`.

Bonus PHP trivia:

Many functions return nonsensical values. `preg_match`, the regex matching function, returns 1 for success, 0 for no matches and false for malformed regular expression. PHP supports exceptions, so it could just throw one on errors. It would even make more sense to return true, false and null for these three cases. But no, 1, 0 and false. And actual matches are returned by output arg.

`array_walk_recursive`, a function supposed to recursively apply callback to each element of an array. That's what docs say. It actually applies it to leafs only. It will also silently accept object instead of array and "walk" it, but without recursing into deeper objects.

Runtime type enforcing is supported for function arguments and returned values. You can use scalar types, classes, array, null and a few special keywords. There's also a `mixed` keyword, which is used in docs and means "anything". It's syntactically valid, the parser will accept it, but it matches no values in runtime. Calling such function will always cause a runtime error.

Strings can be indexed with negative integers. Arrays can't.

ReflectionClass::newInstanceWithoutConstructor: "Creates a new class instance without invoking the constructor". This one needs no commentary.

`array_map` is pretty self-explanatory if you call it with a callback and an array. Or if you provide more arrays of equal length via varargs, callback will be called with more arguments, one from each array. Makes sense so far. Now, you can also call `array_map` with null instead of callback. In that case it treats provided arrays as rows of a matrix and returns that matrix, transposed.

At an auto parts store and was taking a look at the UI.

I FOUND A DINOSAUR!

More realistically I saw F20 as a shortcut key. How I know it wasn’t a typo? There was also F16. Wow. Even their keyboard stop at F12.

Talk about legacy program.

Me, the only iOS dev at work one day, and colleague (who we'll call AndroidBoy), the only Android dev at work that same day (he's been working with us for less than two months). There was a change in one of the jsons we received from the server: instead of receiving a list, we now received a dictionary with strings as keys and lists as values. My iOS colleague had already made this modification on our parse function the day before.

AndroidBoy: "Hey what happened with the json?"
Me: "Oh, well instead of parsing a list, we'll parse a dictionary and get the list from each key. You basically have to do the same thing, only this time the lists are organized into categories."
AndroidBoy: "Oh, ok. But I don't know how to parse a dictionary while using Retrofit." (Context: Retrofit is a framework for request handling - correct me if I am mistaken, that's just what I've been told)
Me: "Sucks, dude, can't help ya. I've never worked with that and don't have that much exp. with Android."

I go out for a cigarette break. When I return, AndroidBoy is nowhere to be seen and suddenly I can't seem to get that data in my app. AndroidBoy comes in from the room where the backend colleagues work.

AndroidBoy: "Solved it!"
Me: "Solved what?"
AndroidBoy: "I told them to change back to a list and just put the key inside the objects of the list."

... he used the precious time of the backend colleagues to change the thing back hust because he was too lazy to search how to parse a dictionary. I was so amazed by his answer, that I didn't know whether to laugh, scream at him or punch him in the face. Not to mention the fact that now I had to revert just so he could avoid that extra work.

Late night ramble warning.

I like to fix issues. I like to roll up my sleeves and fetch my keyboard or soldering iron on a mission to build a custom solution for whatever real world annoyance that has just triggered my problem solving caveman brain.

I have prided myself in that. I am the kind of guy who doesn't shy away from getting my hands dirty, I tell myself, and it's good because it makes my life easier, I tell myself. But increasingly, I've been wondering if this is really so. Am I really making my life easier? Am I fixing the world or just scratching an itch?

Example 1:
Instead of using conventional backup methods for my personal files like a commercial cloud based service or buying a Synology NAS or something similar, I decided it would be better to build my own linux server and set up a rather obscure configuration in order to address things like parity, ECC, bit-rot and the likes while staying cheap.

Learning a lot? Sure. Fun? Sure. Never have to worry about backups again? The opposite, of course.

While I set out to build the perfect bespoke solution to all my personal backup needs - it's as if I, by putting my time and effort into the nitty gritty of technical implementation, placed a vote for my future to contain more of that stuff. In reality this project has burdened my little brain with many new things to consider in regards to storing my files.

Example 2:
Qwerty and the conventional staggered keyboard layout are relics of past technical limitations and both of them inefficient and bad from an ergonomic perspective.

Possible solution: ignore and carry on or possibly transition to Colemak on a somewhat more ergonomic full size keyboard.
My solution: well, let's also hand build a tiny-ass super obscure ergo keyboard and spend two days to come up with my own layout for all special characters, numbers and function keys.

Fun? Somewhat. Learning a lot? I guess. Never have to think about keyboard layouts again? Lol.

I'm living in a world of pain with various key commands in various apps and edge cases. Could I fix it? Probably make it better but not without quite a bit of effort.

Anyways, it'd be interesting to hear if anyone can relate to this feeling of wanting to fix something once and for all only to find yourself deeper in it then ever before. Idk might be a just me thing. Anyways, goodnight lovely people.

So, apple has removed function keys from its laptops...

Yep.

!rant
the most popular ecommerce solution in php is a massive (cosmological scale) pile of corporate crap (magento) and the next most popular is an abomination (opencart)
after fucking around with both for a month (the client asked for the project to be using only one of the two) I'm still barely reaching any results, and most of my time is wasted with the stupid bloated spaghetti that is opencart FUCK THIS,
like seriously. who the fuck writes a single line three left joins sql querry with four or five aliases a couple concacts and a bunch sorting fuckeries just to query the categories list, then just query the details of the specific category from a different function,
also why the fuck map each language string manually. or the fucking hardcoded seo urls, or the use of myisam for all tables, and no fucking foreign keys, let that settle for a minute, no foreign keys, the delete method in the model has at least a twenty lines, and then he came with the genius idea of duplicating models, in the front and the backend, accessing the same data, as the same user, but different naming conventions

I'm going to convince him to use something sane like codeigniter/laravel/fuelphp or I'll deny the project

<warning>bad words</warning>

WHAT THE ACTUAL FUCK!!! LibreOffice Impress is a complete shit!! I am all about open source and such but this shit just sucks, moving elements around a frame snaps them to some grid, however when you paste an element from other frame it will have a different grid!!! This motherfucker has got an ALT function that will allow you to move the element more precisely but it only works seldom and it hates it when I try to use the fucking arrow keys - it even crashed once when I tried it. AND WHEN YOU FUCKING COPY A TABLE FROM ONE FUCKING FRAME TO ANOTHER MOTHERFUCKING FRAME, DELETE A FEW ROWS AND THEN COPY THE FREAKING TABLE BACK IT WILL HAVE MAGICALLY DIFFERENT DIMENSIONS BUT JUST EVER SO SLIGHTLY, BECAUSE FUCK THE USER, RIGHT??!!! (Doing this because there is no way to split tables into two different objects) I constantly have to save my presentation, kill the process and open it again because something just stops working or gets stuck, like seriously, WHAT THE ACTUAL FUCKING FUCK???!!! Are there no tests?!!! Do the people who work on this piece of motherfucking shit even use it???!!

Pentesting for undisclosed company. Let's call them X as to not get us into trouble.
We are students and are doing our first pentest at an actual company instead of assignments at school. So we're very anxious. But today was a good day.
We found some servers with open ports so we checked a few of them out. I had a set of them with a bunch of open ports like ftp and... 8080. Time to check this out.
"please install flash player"... Security risk 1 found!

System seemed to be some monitoring system. Trying to log in using admin admin... Fucking works. Group loses it cause the company was being all high and mighty about being secure af. Other shit is pretty tight though.

Able to see logs, change password, add new superuser, do some searches for USERS_LOGGEDIN_TODAY! I shit you not, the system even had SUGGESTIONS for usernames to search for. One of which had something to do with sftp and auth keys. Unfortunatly every search gave a SQL syntax error. Used sniffing tools to maybe intercept message so we could do some queries of our own but nothing. Query is probably not issued from the local machine.

Tried to decompile the flash file but no luck. Only for some weird lines and a few function names I presume. But decompressing it and opening it in a text editor allowed me to see and search text. No GET or POST found. No SQL queries or name checks or anything we could think of.

That's all I could do for today. So we'll have to think of stuff for next week. We've already planned xss so maybe we can do that on this server as well.

We also found some older network printers with open telnet. Servers with a specific SQL variant with a potential exploit to execute terminal commands and some ftp and smb servers we need to check out next week.

Hella excited about this!

If you guys have any suggestions let us know. We are utter noobs when it comes to this.

Thought function keys were man's best friend. Now no more

"we removed function keys the obsolete tech, to add... Function keys"

I see people posting pictures of computers (ATMs, ad screens, digital signs, instruments, etc) failing and instead showing some Windows function, update, or the desktop. Makes me wonder: WHY would you use Windows this way? Think of how many product keys you'll have to buy and how many systems you'll need maintain to show a stupid sign? There's GOT to be a cheaper way of doing things like this.

JS' array function forEach. Why. Why does it exist? How is a function with a callback better than a freaking simple language feature like for of? If I recall correctly, forEach is older than for of, but people still use it nowadays, and too frequently...
Hate it, definitely.
Also, talking about enumeration in JS, Object's "static" method entries. I can't see how it can't be an instance method. Same for keys and values, but I usually don't care about them.

Lua users, have you used moonscript?

It's a little language that has it's own interpreter or can be compiled down to Lua and it's absolutely lovely (currently using it with Love2d).

Of course, as with most things, what I love about it also royally pisses me off sometimes.

For starters local has to be declared for variables, unlike lua.
Otherwise the variable goes to _
Also note, that some tutorials literally tell you the opposite.

all variables are local by default
unless you don't declare them
then they go to _ (throwaway)
Some tutorials get this wrong too.

all variables have to be declared local
except tables. failure to declare a table WITHOUT a local will cause things like
table.insert to fail with "nil" values for no god damn reason.
No tutorial I could find mentioned this.

Did you know we call methods with '\'?
By the way, we call methods with '\'.
Why? Who the fuck knows.
Does make writing web routes more natural though.

Variables in the parameters of new are declared and bound for you. Would have loved to know this before hand instead of trying
to bind to them like a fucking idiot.

Fat arrows are used to pass in self for methods.
Unless you're calling a method. Then you use backwards slash. This fact is unhelpful when you're a beginner and dealing with the differences between the *other* arrow, the backslash, the fat arrow, and the fact that functions can be called with or WITHOUT parenthesis.
And on that note..

While learning all this other shit, don't forget parenthesis are optional!
Except when they're not!
..Like when you have a function call among your arguments and have to disambiguate which args belong to the outer call and to the inner call! Why not just be fucking consistent?

But on the plus size, ":" is now used for what it should have been used for in the fucking beginning: binding values to keys.
And on the downside, it's in a language thats built on top of another language that uses it for fucking *method calls*, a completely
different fucking usage.

And better still, to add to that brainfuckery thats lost in the mental translational noise like static on a fucking dialup modem, you define methods with the fat arrow. Wait, was that the single arrow or fat one? Yeah the fat one. Fuck. But not before you do THIS shit..

someShit: =>

yeah, you STILL include the god damn colon just so when you're coming from lua you can do a mental double take. "Why am I passing self twice? Oh right, because fuck me, I decided to use moonscript." It's consistent on that front but it also pisses me off.

A lot of these are actually quality of life improvements disguised as gotchas, but when you're two beers in to a 30 minute headscratcher it sure doesn't fucking feel like it.

Nevertheless, once I moved beyond the gotchas, it was like night and day. Sure moonscripts takes a giant steaming dump all over the lua output, like a schizophrenic alcoholic athena from the head of zeus, but god damn, when it works it just WORKS.

Locals that act like locals? Check.
Sane OOP? Check.
Classes, constructors, easy access to class methods, iterators? Check, check, check, check, check.

I fucking hate ceremony. Configuration over convention is for cunts. And moonscript goes a long ways toward making lua less cunty.
If you've ever felt this way while using lua, please, give moonscript a try.

You'll regret it, but in a good way!

who else is kinda disturbed and somewhat annoyed by the new apple touchbar?

i just want my function keys back😩

wtf have you done apple😞

My phone was stolen so that's why I wasn't getting here to rant about this, but today I had to make a back up and remembered.
adminer's export function doesn't export the tables in the correct order for import. Doesn't take foreign keys into account.
Dude, that's the whole point of a relational database, relations between tables; if you don't take that into account then what's the point?
Is this the same for the rest of database managers or is it just adminer? Please tell me this isn't normal.

What keyboard macros do you guys use when you have programmable function keys?

Also a funny little story that I just remembered. My brother used to have a key that would type his password cause he was THAT fucking lazy. He was writing an NPC for a private Ragnarok Online server that I was testing with a couple people. Apparently he had hit that function key in the middle of an announcement command.

So basically, everything went as planned, but then while announcing an event, it would announce his password to THE ENTIRE SERVER. Lucky for him, there were only three of us online at the time, and we told him as soon as it happened.

I have 14 days left before uni starts, but my keyboard broke and keys: 'u' 'd' and 'o' send the key twice, which means I'll go fucking insane before I finish writing a simple function and no blowing into the switch with compressed air, no washing it with water and letting it dry for a day helps.

FML

Coffee + Apple keyboard = I need a new keyboard. ISO 105 layout for Mac (CMD and function keys at the usual spots) are the main requirements. Any suggestions?

I have the following scenario with a proposed solution, can anyone please confirm it is a secure choice:
- We have critical API keys that we do not want to ship with the app because de-compiling will give access to those keys, and the request is done before the user logs in, we are dealing with guests

Solution:
- Add a Lambda function which accepts requests from the app and returns the API keys
- Lambda will accept the following:
1. Android app signing key sha1
2. iOS signing certificate sha1
- If lambda was able to validate them API keys are sent back.

My concerns:
- Can an attacker read the request from the original (non-tampered) apk and see what the actual sha1 value is on his local network?
- If the answer to the question above is yes, what is the recommended way to validate that the request received is actually from the app that we shipped and not from curl/postman/script/modified version of the app