Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
Its Friday, you all know what that means! ... Its results day for practiseSafeHex's most incompetent co-worker!!!
*audience: wwwwwwooooooooo!!!!*
We've had a bewildering array of candidates, lets remind ourselves:
- a psychopath that genuinely scared me a little
- a CEO I would take pleasure seeing in pain
- a pothead who mistook me for his drug dealer
- an unbelievable idiot
- an arrogant idiot obsessed with strings
Tough competition, but there can be only one ... *drum roll* ... the winner is ... none of them!
*audience: GASP!*
*audience member: what?*
*audience member: no way!*
*audience member: your fucking kidding me!*
Sir calm down! this is a day time show, no need for that ... let me explain, there is a winner ... but we've kept him till last and for a good reason
*audience: ooooohhhhh*
You see our final contestant and ultimate winner of this series is our good old friend "C", taking the letters of each of our previous contestants, that spells TRAGIC which is the only word to explain C.
*audience: laughs*
Oh I assure you its no laughing matter. C was with us for 6 whole months ... 6 excruciatingly painful months.
Backstory:
We needed someone with frontend, backend and experience with IoT devices, or raspberry PI's. We didn't think we'd get it all, but in walked an interviewee with web development experience, a tiny bit of Angular and his masters project was building a robot device that would change LED's depending on your facial expressions. PERFECT!!!
... oh to have a time machine
Working with C:
- He never actually did the tutorials I first set him on for Node.js and Angular 2+ because they were "too boring". I didn't find this out until some time later.
- The first project I had him work on was a small dashboard and backend, but he decided to use Angular 1 and a different database than what we were using because "for me, these are easier".
- He called that project done without testing / deploying it in the cloud, despite that being part of the ticket, because he didn't know how. Rather than tell or ask anyone ... he just didn't do it and moved on.
- As part of his first tech review I had to explain to him why he should be using if / else, rather than just if's.
- Despite his past experience building server applications and dashboards (4 years!), he never heard of a websocket, and it took a considerable amount of time to explain.
- When he used a node module to open a server socket, he sat staring at me like a deer caught in headlights completely unaware of how to use / test it was working. I again had to explain it and ultimately test it for him with a command line client.
- He didn't understand the need to leave logging inside an application to report errors. Because he used to ... I shit you not ... drive to his customers, plug into their server and debug their application using a debugger.
... props for using a debugger, but fuck me.
- Once, after an entire 2 days of tapping me on the shoulder every 15 mins for questions / issues, I had to stop and ask:
Me: "Have you googled it?"
C: "... eh, no"
Me: "can I ask why?"
C: "well, for me, I only google for something I don't know"
Me: "... well do you know what this error message means?"
C: "ah good point, i'll try this time"
... maybe he was A's stoner buddy?
- He burned through our free cloud usage allowance for a month, after 1 day, meaning he couldn't test anything else under his account. He left an application running, broadcasting a lot of data. Turns out the on / off button on the dashboard only worked for "on". He had been killing his terminal locally and didn't know how to "ctrl + c a cloud app" ... so left it running. His intention was to restart the app every time you are done using it ... but forgot.
- His issue with the previous one ... not any of his countless mistakes, not the lack of even trying to make the button work, no, no, not for C. C's issue is the cloud is "shit" for giving us such little allowances. (for the record in a month I had never used more than 5%).
- I had to explain environment variables and why they are necessary for passwords and tokens etc. He didn't know it wasn't ok to commit these into GitHub.
- At his project meetups with partners I had to repeatedly ask him to stop googling gifs and pay attention to the talks.
- He complained that we don't have 3 hour lunch breaks like his last place.
- He once copied and pasted the same function 450 times into a file as a load test ... are loops too mainstream nowadays?
You see C is our winner, because after 6 painful months (companies internal process / requirements) he actually achieved nothing. I really mean that, nothing. Every thing was so broken, so insecure / wide open, built without any kind of common sense or standards I had to delete it all and start again ... it took me 2 weeks.
I hope you've all enjoyed this series and will join me in praying for the return of my sanity ... I do miss it a lot.
Yours truly,
practiseSafeHex20 -
In my yesterday's interview:
Interviewer: Tell me about some cool things you did on last year.?
Me: Connecting multiple IoT devices and create dashboard to show status using web sockets.
Interviewer: Oh great. You did without page refresh.?
Me: Yeahh 🙄
Interviewer: Then its cool.
Me: 😬🤔😐22 -
The IT head of my Client's company : You need to explain me what exactly you are doing in the backend and how the IOT devices are connected to the server. And the security protocol too.
Me : But it's already there in the design documents.
IT Head : I know, but I need more details as I need to give a presentation.
Me : (That's the point! You want me to be your teacher!) Okay. I will try.
IT Head : You have to.
Me : (Fuck you) Well, there are four separate servers - cache, db, socket and web. Each of the servers can be configured in a distributed way. You can put some load balancers and connect multiple servers of the same type to a particular load balancer. The database and cache servers need to replicated. The socket and http servers will subscribe to the cache server's updates. The IOT devices will be connected to the socket server via SSL and will publish the updates to a particular topic. The socket server will update the cache server and the http servers which are subscribed to that channel will receive the update notification. Then http server will forward the data to the web portals via web socket. The websockets will also work on SSL to provide security. The cache server also updates the database after a fixed interval.
This is how it works.
IT Head : Can you please give the presentation?
Me : (Fuck you asshole! Now die thinking about this architecture) Nope. I am really busy.11 -
---WiFi Vision: X-Ray Vision using ambient WiFi signals now possible---
“X-Ray Vision” using WiFi signals isn’t new, though previous methods required knowledge of specific WiFi transmitter placements and connection to the network in question. These limitations made WiFi vision an unlikely security breach, until now.
Cybersecurity researchers at the University of California and University of Chicago have succeeded in detecting the presence and movement of human targets using only ambient WiFi signals and a smartphone.
The researchers designed and implemented a 2-step attack: the 1st step uses statistical data mining from standard off-the-shelf smartphone WiFi detection to “sniff” out WiFi transmitter placements. The 2nd step involves placement of a WiFi sniffer to continuously monitor WiFi transmissions.
Three proposed defenses to the WiFi vision attack are Geofencing, WiFi rate limiting, and signal obfuscation.
Geofencing, or reducing the spatial range of WiFi devices, is a great defense against the attack. For its advantages, however, geofencing is impractical and unlikely to be adopted by most, as the simplest geofencing tactic would also heavily degrade WiFi connectivity.
WiFi rate limiting is effective against the 2nd step attack, but not against the 1st step attack. This is a simple defense to implement, but because of the ubiquity of IoT devices, it is unlikely to be widely adopted as it would reduce the usability of such devices.
Signal obfuscation adds noise to WiFi signals, effectively neutralizing the attack. This is the most user-friendly of all proposed defenses, with minimal impact to user WiFi devices. The biggest drawback to this tactic is the increased bandwidth of WiFi consumption, though compared to the downsides of the other mentioned defenses, signal obfuscation remains the most likely to be widely adopted and optimized for this kind of attack.
For more info, please see journal article linked below.
https://arxiv.org/pdf/...9 -
!dev
My neighbours have so many fucking IoT devices that they basically fuck over the entire 2.4GHz spectrum over here just by themselves...
Thanks for that you cuntbags.32 -
Thanks to a small order mix up, I'm now sitting on 10 extra SIM cards for some IoT devices. I think my wife's going to kill me if she sees 10 Raspberry Pis show up at the door, but what else do you do with them?6
-
News: New virus installs cryptocurrency miner on IoT devices.
Me: I hope it was worth the whole 37 cents they made.10 -
I recently started naming my devices in a certain scheme:
Laptop - Sagittarius (central black hole in the milky way)
Server - Sirius (brightest star visible from Earth)
Pi - Centauri (closed star system to us)
Any iot devices would be named like unnamed planets (i.e. Centauri A, Centauri B, ...)
Do some of you have cool/interesting naming schemes for your devices?17 -
I was working in a manufacturing facility where I had hundreds of industrial computers and printers that were between 0 and 20 years old. They were running on their own clean network so that someone has to be in the manufacturing network to access them. The boss announced that the executives will be pushing a “zero trust” security model because they need IoT devices. I told him “A computer running Windows 98 can’t be on the same VLAN as office computers. We can’t harden most of the systems or patch the vulnerabilities. We also can’t reprogram all of the devices to communicate using TLS or encrypt communications.“ Executives got offended that I would even question the decision and be so vocal about it. They hired a team to remove the network hardware and told me that I was overreacting. All of our system support was contracted to India so I was going to be the on-site support person.
They moved all the manufacturing devices to the office network. Then the attacks started. Printers dumped thousands of pages of memes. Ransomware shut down manufacturing computers. Our central database had someone change a serial number for a product to “hello world” and that device got shipped to a customer. SharePoint was attacked in many many ways. VNC servers were running on most computers and occasionally I would see someone remotely poking around and I knew it wasn’t from our team because we were all there.
I bought a case of cheap consumer routers and used them in manufacturing cells to block port traffic. I used Kali on an old computer to scan and patch network vulnerabilities daily.
The worst part was executives didn’t “believe” that there were security incidents. You don’t believe in what you don’t understand right?
After 8 months of responding to security incident after security incident I quit to avoid burning out. This is a company that manufactures and sells devices to big companies like apple and google to install in their network. This isn’t an insignificant company. Security negligence on a level I get angry thinking about.8 -
A free, open source, modular (plugin based) home automation control center.
Ultimate goal is to support the core / apis and other devs code the drivers for the 'IoT' devices.
Also integratable with all the speech assistants like Amazon Echo, Google Assistant, Cortana etc.
Not that money dependent but very time consuming project.
Im starting in a week tho!4 -
Yeah, So the principals of hackathons is shit and am about to braek down to fucking cry.All you do is waste 48hours of your life discussing your ideas with irrelevant startup managers who will just shatter your dreams with a single sentence "this is already in market, what have you creat new?" For fuck's sake, it's my first hackathon , you guys have given me just 10 hours ,i have a team of worlds most idiot devs and i am their equally idiot if not more leader... However my idea was 1000% real and authentic and worth finding... if not, then at least give me prize for creating 9000 lines of code with 2 IOT devices and a working , documented model which no other fuckin team could do.... AND even not this, then FUCKING GIVE THE PRIZE TO SOMEONE WHO DESERVE IT, AND NOT THE TEAM FROM THE COLLEGE THAT SPONSORED IT.. fucking politics -_-2
-
DONT do production stuff on friday afternoon. This friday evening we had an issue on production and just wanted to do a quick fix. The fix resulted in a ddos attack that we accidentally started on our servers in an IoT project. We contacted all customers' devices and asked them for response at the same time. Funny thing is that the devices are programmed to retry if a request fails until it is successful. We ended up with 4 hours downtime on production, servers were running again at 11pm.4
-
So I was playing with deauthing because I was curious about to and I got this little deauthing tool and I no joke fucked up my whole network for hours.
In my house we recently had tplink smart light switches installed and that created 40 more iot devices on the network. Soooo I disconnected them all at once and also cloned my AP so they went into this limbo state where they could not connect to anything and also for some reason Ethernet stopped working I think my isp thought I was getting a DOS attack or something idk but no joke took me hours to fix it.3 -
My new ISP asked what devices I would be connecting to the internet... "Well let's see here, computers, web servers, tablets, phones, IoT devices, game consoles, MP3 players, smart TVs, robots..."
-
I was getting bored with programing cause a majority of it is boilerplate code then i heard of the Mirai virus. It infected alot of iot devices so I decided to look at it and it was written in golang. It is a beautifully written botnet even though they're parts where it could have been better. So i looked more into golang and saw that it could cross compile pretty easily and could build self contained binaries really easily. On top of all this i saw the smallest docker containers with golang programs so i looked into it more and kept finding more and more that i liked. Easy library packaging, concurancy without boilerplate, quick servers, and the libraries from other devs that did all kind of great things3
-
You may soon have a new operating system from Google to run on your Raspberry Pi. Details are still extremely sparse, the only description on the GitHub page is “Pink + Purple == Fuchsia (a new Operating System)”. But, here’s what we do know:
The new OS, called Fuchsia, will be based on Magenta, which is in turn built on LittleKernel. That means that, surprisingly, Google will not be using a Linux kernel for the new OS but something more like an embedded RTOS. Although Google is targeting embedded systems, the possibility of being able to run it on a desktop has been mentioned, so it may not be too minimalistic.
Google’s Travis Geiselbrecht has named the Raspberry Pi 3 specifically as one system it will run on, and said that it’ll be available soon. But, it seems Google is aiming to make it run on a variety of ARM devices (both 32 bit and 64 bit), as well as 64 bit PCs. This is a direct effort to compete against other commercial embedded operating systems that are currently available, and especially on IoT devices.1 -
Today I have created a server application on Python Tornado which can forward TCP Packets directly to HTTP request queue without any intermediate caching.
Our remote IOT devices (microcontrollers with sensors attached) send sensor reading over TCP Socket to our server and all the connected web applications can show the data instantly using long polling and the above mentioned technique.1 -
Mfw on azure/iot conference, one presenter shows his certificate validation, to connect to all devices in his house:
return true;
He said:
"lets not be paranoid about security" -
How should you approach someone and tell them they have been an victim of social engineering without being mean?
I was at an security conference today and watched a lot of speaks, and I must say that the atmosphere and the people around made it even better.
Here is one takeaway:
Does the security of IT has to be this depressing most of the time, like there is so many IoT devices, services, websites and critical infrastructure that has security flaws and all we can do is watch for now and say we are all fucked. Then try to lead the industry to better practices, like owasp (duck it) . Stop accepting and using shitty answers from SO that has security flaws (why learn something a way that is wrong in the first place?).
We need more awareness about IT security overall, how can one developer know that certain technologies can have certain vulnerabilities such as XSS, XSRF and even SQL injection if there is no information about it in among all shitton tutorials, guides and SO answers in the first place?
Lighten up! Being sad and depressing about these issues is not the best way to approach this! We need to embrace all steps taken towards better security, even the smallest ones.
Check out OWASP if you are not familiar :
https://owasp.org/index.php/...
Thanks for reading. -
We are building a cloud iot environment currently for one of our customers. I'm kind of the head of the cloud backend. Well first the customer needed the product a month earlier. Then today on my last day before vacation, they wanted to test theire devices in our dev environment. Have they ever heard of read only friday? And why do people still fuck up json payload in 2020
-
I'm starting to look at how to get devices to send data to an endpoint for storage and analysis. I'm looking at AWS iot stuff like core and green grass but then I'm thinking that a REST API could also do the job. I don't need to connect devices to each other (in first iteration). Dont think I need any edge stuff either. Anybody have any experience with this?3
-
I have tons of old phones, I'd like to use them as IOT devices. Anyone know a really small Android rom with no extras? Not only no Playstore, but also no fancy theme engine etc, so I can use them as servers etc1
-
Tried installing IoT prototypes. Yesterday it worked fine. Today, it didn't. Re-Installed the app. Reset the gateway. Reset all IoT devices. Replaced all batteries. Checked all connections. Started all over again. 4h passed.
Finally, saw that I forgot to connect the EnOcean stick to the gateway.
Plugged it in, system up and running in 10min... -
What's with the updates in our technology ? has it always been this situation that Computer manufacturers stop providing upgrades after a few time?
Like android tries hard, but no device older than 3 years is going to get the latest android . i phone guys say they get the latest ios on iphone 6 plus, but isn't that also like 6 generations later device?what about iphone 4s or iphone 3g or iphone1 ?
So far i guess microsoft and laptop manufacturers are winning at this area... i believe i could find some peeps with their 10 yo fatass pc running win 10 . Or maybe iot, i am not sure but i wonder if those microwaves won't be compatible with the latest version of whatever OS they are using (if there is a mechanism to update one)
I was actually reading about the operating systems. My point regarding this post was that the OS's have been architectured to be modular and h/w independent for years . Nearly every OS has this HAL layer which literally has the function to abstract hardware and give apis to system such that whatever the hardware there is down below, the system would not have to worry.
So why does new updates to the os not pushed to older devices? why do manufacturers give the reasons that we don't push updates because the hardware is incompatible with the os?13 -
So my boss moved me to build some software to IoT devices we have because he didn't have the time to do it. But I haven't used C since college (I mostly use Java), but I'm trying to handle it. But right now we are developing a feature that is taking longer than expected and he comes over and tells me how easy it is to do it. Really? You were trying to do it that way for a shit ton of time and it didn't work, do you really expect it to work because it's me? Fucking hell!
-
How to start learning iot?i mean, here is what i understood after searching for a while: iot consists usually the hardware devices/sensors/robos which generate data/do something ; transmit this data to some server where calculations are performed and then show it to user.. And there are some kits worth a big amount which you gotta buy... is that all right?
Guidance please .:)2 -
I can't wait for the release of Snips Air sometime in 2019 so that I can stop using my Google home. It's not even the privacy concern that bugs me, it's the stupid shit like alarm management. To preface, I've had a Google home since late last year and since I got it the alarms have been nothing but trouble. More than half the time when I ask it when my next alarm is, it will respond with "You have an alarm for Friday at 7pm that is going off right now" (At the time of this response it was Tuesday). Then snoozing sometimes just doesn't work, I told it to snooze for 10 minutes, it worked just fine. Then today I made the mistake of asking it to snooze a second time which responded with "Sure, snoozing for 5 minutes", I wake up 45 minutes later, and ask "Hey Google, when's my next alarm?", it responds "You have an alarm today for 7:00 snoozed until 7:15". I have an exam today so luckily I didn't sleep in too late but againg this isn't the first occurence. To prevent this I normally just have a backup alarm on my phone and the one on my phone will wake me up in case something happens. On top of that though I've had rarer cases where it will delete all my alarms and I'll have to go command by command reminding of each alarm. That's just alarms though, I also have it control several IoT devices, and me having to use IFTTT requires the utmost precision in my phrasing otherwise it won't understand ( although this issue is mainly due to how the assistant service trigger on IFTTT is configured ). It still does much better than Siri ( at least my home can set alarms unlike my mac ), I have yet to try Alexa though. Of course my last problem is the hotword, saying "Hey Google" is much better than "Ok Google" but it's still excessive when I have to repeat it for each individual command. This is why I'm so excited for snips air, a set of devices that look pretty great, hackable, and as a bonus much more private that the current options. I realize that I could get a dev kit or set up snips on a pi but the dev kit isn't exactly visually appealing and I doubt I could get something that looks or functions half decent on the pi.1
Top Tags
Weekly Rant
View