Remember Apple's initiative to scan photos on user's devices to find child pornography?
Today I finally decided to research this.
The evidence is conflicting.
For context, the database of prohibited material is called CSAM (child sexual abuse material).

“If it finds any CSAM, it will report the user to law enforcement.”
— Futurism

“Apple said neither feature would compromise the security of private communications or notify police.”
— NPR

CSAM initiative is dead. It won't scan photos in iCloud. It won't scan photos on your device. It will be a feature that only works in some countries, only on children's devices, and it will be opt-in. It will only work for iMessage attachments.

This is what Apple actually said at https://www.apple.com/child-safety:
- “Features available in Australia, Belgium, Brazil, Canada, France, Germany, Italy, Japan, Netherlands, New Zealand, South Korea, Spain, Sweden, UK, and U.S.”
- “The Messages app includes tools to warn children when receiving or sending photos that contain nudity. These features are not enabled by default. If parents opt in, these warnings will be turned on for the child accounts in their Family Sharing plan.”

News outlets telling people they will be automatically reported to authorities, and then telling there can be false-positives is a classic example of fearmongering. I hate this. Remember, anger and fear are the most marketable emotions. They make you click. News are and will always be worded to cause these emotions — it brings in money.

When presented with good news, people think they're not being told the truth. When presented with bad news, even when they're made up, people think it's the truth that's being hidden from them. This is how news works.

Now, a HUGE but:
Apple is a multi-billion dollar corporation. There is no such thing as good billionaires. Corporations will always wait for chances to invade privacy. It's like boiling the frog — one tiny measure here, one there, and just like this, step by step, they will eliminate the privacy completely. It's in their interest to have all the data about you. It brings control.
This is not the first time Apple tries to do shit like this, and it definitely won't be the last. You have to keep an eye on your privacy. If you want your privacy in the digital age, it's necessary to fight back. If you live in Europe, take the action and vote for initiatives that oppose corporate tyranny and privacy invasions.

Privacy on the internet is one thing, but scanning people's devices is a whole another thing. This is unacceptable no matter the rationale behind it. Expect more measures like that in the near future.

Research Linux. Find a distro that suits you. The notion that you can't switch because of apps/UI/etc. may be dictated by our brain's tendency to conserve energy and avoid the change.
Take a look at mobile distros like Graphene OS and LineageOS. The former only supports Pixel devices, the latter supports a wide range of devices including OnePlus and Xiaomi. They'll have FAR better privacy than iPhones.

Consider switching. It's easier than you think. Yes, it's me who's saying this. I do and will always protect people/companies from unjust criticism, and I consider myself an Apple fangirl for personal reasons related to my childhood, yet I won't fight blindly. CSAM initiative is a valid criticism, and there's nothing preventing me from saying this is unacceptable, and Apple deserves the backlash they got.

So I have seen this quite a few times now and posted the text below already, but I'd like to shed some light on this:

If you hit up your dev tools and check the network tab, you might see some repeated API calls. Those calls include a GET parameter named "token". The request looks something like this: "https://domain.tld/api/somecall/..."

You can think of this token as a temporary password, or a key that holds information about your user and other information in the backend. If one would steal a token that belongs to another user, you would have control over his account. Now many complained that this key is visible in the URL and not "encrypted". I'll try to explain why this is, well "wrong" or doesn't impose a bigger security risk than normal:

There is no such thing as an "unencrypted query", well besides really transmitting encrypted data. This fields are being protected by the transport layer (HTTPS) or not (HTTP) and while it might not be common to transmit these fields in a GET query parameter, it's standard to send those tokens as cookies, which are as exposed as query parameters. Hit up some random site. The chance that you'll see a PHP session id being transmitted as a cookie is high. Cookies are as exposed as any HTTP GET or POST Form data and can be viewed as easily. Look for a "details" or "http header" section in your dev tools.
Stolen tokens can be used to "log in" into the website, although it might be made harder by only allowing one IP per token or similar. However the use of such a that token is absolut standard and nothing special devRant does. Every site that offers you a "keep me logged in" or "remember me" option uses something like this, one way or the other. Because a token could have been stolen you sometimes need to additionally enter your current password when doings something security risky, like changing your password. In that case your password is being used as a second factor. The idea is, that an attacker could have stolen your token, but still doesn't know your password. It's not enough to grab a token, you need that second (or maybe thrid) factor. As an example - that's how githubs "sudo" mode works. You have got your token, that grants you more permissions than a non-logged in user has, but to do the critical stuff you need an additional token that's only valid for that session, because asking for your password before every action would be inconvenient when setting up a repo

I hope this helps understanding a bit more of this topic :)
Keep safe and keep asking questions if you fell that your data is in danger
Reeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

I miss the good times when the web was lightweight and efficient.

I miss the times when essential website content was immediately delivered as HTML through the first HTTP request.

I miss the times when I could open a twitter URL and have the tweet text appear on screen in two seconds rather than a useless splash screen followed by some loading spinners.

I miss the times when I could open a YouTube watch page and see the title and description on screen in two seconds rather than in ten.

I miss the times when YouTube comments were readily loaded rather than only starting to load when I scroll down.

JavaScript was lightweight and used for its intended purpose, to enhance the experience by loading content at the page bottom and by allowing interaction such as posting comments without having to reload the entire page, for example.

Now pretty much all popular websites are bloated with heavy JavaScript. Your browser needs to walk through millions of bytes of JavaScript code just to show a tweet worth 200 bytes of text.

The watch page of YouTube (known as "polymer", used since 2017) loads more than eight megabytes of JavaScript last time I checked. In 2012, it was one to two hundred kilobytes of HTML and at most a few hundred kilobytes of JavaScript, mostly for the HTML5 player.

And if one little error dares to occur on a JavaScript-based page, you get a blank page of nothingness.

Sure, computers are more powerful than they used to be. But that does not mean we should deliberately make our new software and website slower and more bloated.

"Wirth's law is an adage on computer performance which states that software is getting slower more rapidly than hardware is becoming faster."

Source: https://en.wikipedia.org/wiki/...

A presentation by Jake Archibald from 2015, but more valid than ever: https://youtube.com/watch/...

Episode 2 of this rant: https://devrant.io/rants/851636/...

PM went to meet with the provider and came back, so I had a talk with the PM and it went like this:
Me: so how did the meeting go? Hope they corporate with you
PM: *in a sarcastic voice* Bro, you need be a good dev, they told me only a good dev can implement Master Card API calls, and its all in the docs. That's all they told me, so you should know how the meeting went
Me: *there is no wifi in jail, there is no wifi in jail, there is no wifi in jail, there is no wifi in jail* Fine bro, I'll go back to school and come back after 12 years.

Seriously when I send the provider the request and the body and all they tell me is: You have an error, Id must be unique but they fail to point out the exact error or at least send me a valid ID to test, how does this make me the bad dev and him the genius that can run Apple, Google, MS all together at once!

What is even worse, when I called the provider he told me: Man transaction ID must always be unique, how could you not know this, how is Mastercard supposed to differentiate between transactions!!

But hey, no one told me transaction id must be unique, primary keys are never unique, like DUH!

"SO culture is so mean, they downvote good questions for no reason!"

Meanwhile, most of the downvoted questions in my list:

https://stackoverflow.com/questions...

https://stackoverflow.com/questions...

https://stackoverflow.com/questions...

https://stackoverflow.com/questions...

https://stackoverflow.com/questions...

https://stackoverflow.com/questions...

https://stackoverflow.com/questions...

https://stackoverflow.com/questions...

Translation:

- OP1: "Do my homework for me"

- OP2: "I am too lazy to google this"

- OP3: "Gimme code, here is a shitload of requirements"

- SO: "No."

- OP1/2/3/DevRant: "Oh mah gawd mah question was so gud, SO such toxic, very mean, much wow qq."

Kk.

Follow up to: https://devrant.com/rants/5047721/....

1- The attacker just copy pasted its JWT session token and jammed requests on the buy gift cards route
2- The endpoint returns the gift card to continue the payment process, but the gift card is already valid
3- Clients wants only to force passwords to have strong combinations
4- Talk about a FIREWALL? Only next month
5- Reduce the token expiration from 3 HOURS to 10 minutes? Implement strong passwords first
6- And then start using refresh tokens

BONUS: Clearly someone from inside that worked for them, the API and database password are the same for years. And the route isn't used directly by the application, although it exists and has rules that the attacker kows. And multiple accounts from legit users are being used, so the person clearly has access to some internal shit

INSERT INTO not_rants ("

Today I took the time to learn the basic SQL(ite) and just finished learning in depth about the art of querying.

I just had to do this, because I am very unsatisfied with the way we learned it in school. Almost literally only translating the words CREATE, TABLE, SELECT, FROM, WHERE, UPDATE, DELETE in MySQL.

Funny, irrelevant fact: Before I could download the meme below I encountered this beauty of an errorlog:

Value of '∞' is not valid for 'emSize'. 'emSize' should be greater than 0 and less than or equal to System.Single.MaxValue.
Parameter name: emSize

https://cdn.meme.am/cache/...

");

I am glad that I usually include comments, which make me smile years later...
What are your best findings when you look at your old code?

something like:
// having any and all at the same hierarchy is not valid (and stupid)
someMistakeDeep: 1 // deep fail
// TODO: find out, why the cache is behaving like this. And fix it ¯\_(ツ)_/¯

or my all time favorite comments
// this should not happen.
// wat?

or testing emails like
- tldsAreNotCheckedBTW@something.idontthinkthisdoesexist
- nonValidEmail.com
or urls...
- ProtocolMissing.com
- www.stillNoProtocol.com

And when I'm out of ideas, something like this
messageContent: 'Bla Bla Bla. Exception in FS on Host https://w.com/hpsa',
{ SmsVerb: 'randomVerb' }, // unknown Attribute

There has been a post today about the existence of too many js frameworks. Which reminds me of this awesome post https://hackernoon.com/how-it-feels...

At first I thought someone was corpseposting, as it is my understanding that the js ecosystem is calming down a bit. But then I noticed that post got almost 20 upvotes. So here's my thoughts:

(I'm not sure what I'm ranting about here, as it feels kinda broad after writing it. I think it's kinda valid anyhow.)

I'm ok with someone expressing frustration with js. But complaining about progress is definitely off to me.

How is too many frameworks a bad thing?

How does the variety and creation of more modern frameworks affect negatively developers?

Does it make it hard to understand each of these new frameworks?
Well, there's no need to. Just because it has a logo and some nice badges and says it will make you happy doesn't mean you should use it.
You just stick to the big boys in the ecosystem and you'll be fine for a while.

Does it make you feel compelled to migrate the stack of every project you did?

Well, don't. If you don't like being on the bleeding edge of js, then just stick to whatever you're using, as long as it's good code.

But if a lot of companies decided to migrate to react (among others frameworks), it's because they like the upsides: the code is faster to write, easier to test and more performant.

In general, I'm more understanding/empathic with beginner js programmers.

But I have for real heard experienced devs in real life complain about having to learn new frameworks, like they hate it.
"I just want to learn a single framework and just master it throughout my life" and I think they're lowering the bar.

There's people that for real expect occupying positions for life, make money, but never learn a new framework.

We hold other practitioners to high standards (like pilots or doctors), but for some reason, some programmers feel like they're ok with what they know for life.

As if they couldn't translate all they learned with one framework to another.

Meanwhile our lives are becoming more and more intertwined with technology and demand some pretty high standards. Standards that historically have not been met, according to thousands of people screaming to their devices screens.

Even though I think the "js can be frustrating" sentiment is valid, the statement 'too many js frameworks is bad' is not.

I think a statement like 'js frameworks can go obsolete very quickly' is more appropriate.

By saying too many js frameworks is a bad thing you're
1) Making a conspiracy theory as if js devs were working in tandem to make the ecosystem hard,

But people do whatever they want. Some create packages, others star/clone/use them.

2) Making a taboo out of a normal itch, creating.
"hey you're a libdev? just stop, ok? stop"
"Are you a creative person? Do you know a way to solve a problem in an easier way than some famous package? it doesn't matter, don't you dare creating a new package."

I'm not gonna say the js world is perfect. The js world is frantic, savage, evolves aggressively.
You could say that it (accidentally) gives the middle finger to end users, but you could also say that it just sets the bar higher.

I liked writing jquery code in the past, but at the same time I didn't like adding features/fixing bugs on it. It was painful.

So I'm fine with a better framework coming along after a few years and stealing their userbase, as it happens almost universally in the programming world, the difference with js is that the cycle is faster.

Even jquery's creator embraced React.

This post explains also
https://medium.com/@chrisdaviesgeek...

What makes free ssl "Unsuitable for e-commerce websites", Please read to end to see my view point.

From Namecheap:
Free Certificates are domain validation only which means they don't certify the identity of the website owner, they simply ensure a secure connection. Customers can't be sure of the integrity and trustworthiness of the website owner. If you need to secure credit card and personal information on e-commerce websites, free certificates aren't the answer. It's important your customers trust your business is safe enough to hand over these details. To gain this trust, you need a certification of your authenticity, which you can only get with a (paid) Business Validation or Extended Validation SSL Certificates.

https://namecheap.com/security/...

* "To gain this trust, you need a certification of your authenticity"
~ But isn't that just Domain Verification and other Extras, What justifies somebody or business's authenticity? Tax Id, Valid Address, Nobody is going to study the ssl cert to make sure that amazon.com is a valid business and has a tax Id.

* "domain validation only which means they don't certify the identity of the website owner,"
~ Wouldn't this just be the domain validation test that is required when using services like LetsEncrypt using Certbot etc, or are we referencing back to this idea that they look for a Valid Tax Id sort of thing?

* "If you need to secure credit card and personal information on e-commerce websites, free certificates aren't the answer"
~ Why is the paid version going to do double encryption, is the CA going to run a monitoring tool to scan for intrusions like a IDS or IPS? (disregard the use of DNS Validation being in the picture)

Am I missing something, this just seems like well crafted text to get people to buy a cert, I could understand if the encryption was handled differently, Maybe if they checked the site for HSTS or HTTPs Redirect or even, They blocked wildcard SSL before and now with the paid its included, but overall it doesn't sound like anything special. Now I'm not just picking on namecheap because domain.com does the same.

I just released my first NPM package that is actually functional and used in a private project (https://npmjs.com/package/@lbfalvy/...) and I have to say, the quality of debug tooling for Node is abysmal. I spent 4 hours just on Webpack's "Field browser doesn't contain a valid alias configuration" error which simply means "package not found", and then getting Rollup to output a working compiled javascript _and_ a d.ts was its own day-long ordeal.