Here's a follow-up to my New Year's resolutions rant six months ago:

( https://devrant.com/rants/1117379/... )

I've completed (or made significant strides in) 5 of my 7 resolutions:

1) Rid and keep my like free of toxic people.  This includes parents.

I have had a serious conversation with everyone who made my life worse and whom I wanted to keep around, outlining my issues with them and my expectations should they want to remain in my life.  I happily cut out everyone who refused to change their behavior, including my parents.  My life is quieter now, and much nicer.

3) Take care of myself for a change!

I've started this, but with work, a monster, etc. it's been almost prohibitively difficult.  Minimal lasting progress despite considerable effort.  I will make more time for it and make it happen. (I was down 12 pounds at one point! Though this isn't just about weight.)

4) Stop putting up with things I don't have to.

If I don't like something optional, snip snip!
I no longer wait patiently (fuming) for slow-moving people.  If something prevents me from being productive or going about my day, I no longer let it.  Carpe diem; calcitrare culus! I have been much more productive and energetic because of this.

5) Actually enjoy things I enjoy.

Okay, this one is very difficult.  Whenever I'm not working, I feel like I'm wasting my time.  However, I have made a conceited effort every day to take time off and do something that sounds fun.  Sometimes that's more work, but usually it's music, a game, a book, exercise, or bed.   I'm still working on actually enjoying my time away from work, however, but I'm making progress!

7) Finish de-googling my life.

I no longer use a gmail account (except a work-provided account), nor do I use any of their services unless absolutely necessary (and I do so through TOR).  My phone still has Google Play Services; however, I'm working on finding a replacement that I can @Root.  (Suggestions welcome!)

------
The two resolutions I haven't yet addressed:

2) Find a well-paying job that isn't also toxic.

My job has gotten less toxic of late, with the boss actually listening and everyone writing up feature requests (with co-sponsors) instead of just dumping them in my lap.  I perform an effort analysis on them, and everyone discusses them as a team to determine which actually deserve development time.  This is tens of times better than before.  I also no longer have to be at the office.  In fact, I haven't been there in months -- and don't even remember the alarm codes haha.  I may also be getting another developer, though I suspect this is actually a lie.

6) Finally buy a harp. I've wanted one since I was 3 ffs.

I haven't done any research yet on which harp(s) I should buy.  Also, I have no idea where I would keep it, so I may defer this until we move, or just get a tiny one (lap-sized and cute!) to practice on. Probably both!

------

It's been six moths, and I'm happy with my progress. 😄

So I have seen this quite a few times now and posted the text below already, but I'd like to shed some light on this:

If you hit up your dev tools and check the network tab, you might see some repeated API calls. Those calls include a GET parameter named "token". The request looks something like this: "https://domain.tld/api/somecall/..."

You can think of this token as a temporary password, or a key that holds information about your user and other information in the backend. If one would steal a token that belongs to another user, you would have control over his account. Now many complained that this key is visible in the URL and not "encrypted". I'll try to explain why this is, well "wrong" or doesn't impose a bigger security risk than normal:

There is no such thing as an "unencrypted query", well besides really transmitting encrypted data. This fields are being protected by the transport layer (HTTPS) or not (HTTP) and while it might not be common to transmit these fields in a GET query parameter, it's standard to send those tokens as cookies, which are as exposed as query parameters. Hit up some random site. The chance that you'll see a PHP session id being transmitted as a cookie is high. Cookies are as exposed as any HTTP GET or POST Form data and can be viewed as easily. Look for a "details" or "http header" section in your dev tools.
Stolen tokens can be used to "log in" into the website, although it might be made harder by only allowing one IP per token or similar. However the use of such a that token is absolut standard and nothing special devRant does. Every site that offers you a "keep me logged in" or "remember me" option uses something like this, one way or the other. Because a token could have been stolen you sometimes need to additionally enter your current password when doings something security risky, like changing your password. In that case your password is being used as a second factor. The idea is, that an attacker could have stolen your token, but still doesn't know your password. It's not enough to grab a token, you need that second (or maybe thrid) factor. As an example - that's how githubs "sudo" mode works. You have got your token, that grants you more permissions than a non-logged in user has, but to do the critical stuff you need an additional token that's only valid for that session, because asking for your password before every action would be inconvenient when setting up a repo

I hope this helps understanding a bit more of this topic :)
Keep safe and keep asking questions if you fell that your data is in danger
Reeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

Made a website that can make images like this
Basically you just keep splitting the rectangle and color them
https://txstc55.github.io/draw-rect...

It’s very mobile unfriendly though

Need feedback on what you need, also this is an offline version and I’m planning to make it so that you can do it with your friend, just need to watch more YouTube videos on p2p now

Just finished a large write up on a security flaw I found and disclosed in an exam spyware vendor's "zero knowledge encryption" - derived keys that were generated from incrementing integers, discussion on obfuscation and more.

It was a hell of a time writing this up; not sure if linking my personal blog here would be bad practice, but here it is: https://proctor.ninja/wave-rake-pro...

It's been something else, but hopefully I can keep fighting against tech like this on school campuses.