Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
I was activating virtualenv in powershell when my younger brother came in.
Me: *all nervous* please don't think I'm hacking or trying to set off a bomb. (He always thinks I'm hacking and tells on me.)
Brother: *silent*
Me: *even more nervous* I don't want my laptop to get taken away. Don't tell on me and say I'm hacking, because I'm not.
Brother: Oh, I know you're not hacking this time.
Me: You do? *relieved.*
Brother: Yeah, because this time it's a blue background, not a black one.
Me: Oh, haha. So you're only scared of things such as these? *opens CMD and Git Bash* you know, just because it's dark themed, doesn't mean it's malicious. Besides it—
Brother: oooOooOh! You're hacking again! I'm telling on you!
*Note to self: Never use dark theme in front of the ignorant again.)42 -
https://git.kernel.org/…/ke…/... sure some of you are working on the patches already, if you are then lets connect cause, I am an ardent researcher for the same as of now.
So here it goes:
As soon as kernel page table isolation(KPTI) bug will be out of embargo, Whatsapp and FB will be flooded with over-night kernel "shikhuritee" experts who will share shitty advices non-stop.
1. The bug under embargo is a side channel attack, which exploits the fact that Intel chips come with speculative execution without proper isolation between user pages and kernel pages. Therefore, with careful scheduling and timing attack will reveal some information from kernel pages, while the code is running in user mode.
In easy terms, if you have a VPS, another person with VPS on same physical server may read memory being used by your VPS, which will result in unwanted data leakage. To make the matter worse, a malicious JS from innocent looking webpage might be (might be, because JS does not provide language constructs for such fine grained control; atleast none that I know as of now) able to read kernel pages, and pawn you real hard, real bad.
2. The bug comes from too much reliance on Tomasulo's algorithm for out-of-order instruction scheduling. It is not yet clear whether the bug can be fixed with a microcode update (and if not, Intel has to fix this in silicon itself). As far as I can dig, there is nothing that hints that this bug is fixable in microcode, which makes the matter much worse. Also according to my understanding a microcode update will be too trivial to fix this kind of a hardware bug.
3. A software-only remedy is possible, and that is being implemented by all major OSs (including our lovely Linux) in kernel space. The patch forces Translation Lookaside Buffer to flush if a context switch happens during a syscall (this is what I understand as of now). The benchmarks are suggesting that slowdown will be somewhere between 5%(best case)-30%(worst case).
4. Regarding point 3, syscalls don't matter much. Only thing that matters is how many times syscalls are called. For example, if you are using read() or write() on 8MB buffers, you won't have too much slowdown; but if you are calling same syscalls once per byte, a heavy performance penalty is guaranteed. All processes are which are I/O heavy are going to suffer (hostings and databases are two common examples).
5. The patch can be disabled in Linux by passing argument to kernel during boot; however it is not advised for pretty much obvious reasons.
6. For gamers: this is not going to affect games (because those are not I/O heavy)
Meltdown: "Meltdown" targeted on desktop chips can read kernel memory from L1D cache, Intel is only affected with this variant. Works on only Intel.
Spectre: Spectre is a hardware vulnerability with implementations of branch prediction that affects modern microprocessors with speculative execution, by allowing malicious processes access to the contents of other programs mapped memory. Works on all chips including Intel/ARM/AMD.
For updates refer the kernel tree: https://git.kernel.org/…/ke…/...
For further details and more chit-chats refer: https://lwn.net/SubscriberLink/...
~Cheers~
(Originally written by Adhokshaj Mishra, edited by me. )
22 -
The year is 2025
vlcInstall.exe
"You already have videos, the trusted and safe media player for windows 10"
AtomInstaller.exe
"You already have vscode, the better and lighter editor for windows 10"
SteamInstaller.exe
"You already have Microsoft solitare, a fun, better game for windows 10"
*googles c++ tutorials*
"Try c#, safer and robust language for developers, oh and did we forget to mention use bing?"
*downloads arch iso*
"This file has been marked malicious by windows defender. Oh and we updated your bios to allow only windows bootloader. You're welcome."10 -
Started talking with someone about general IT stuff. At some point we came to the subject of SSL certificates and he mentioned that 'that stuff is expensive' and so on.
Kindly told him about Let's Encrypt and also that it's free and he reacted: "Then I'd rather have no SSL, free certificates make you look like you're a cheap ass".
So I told him the principle of login/registration thingies and said that they really need SSL, whether it's free or not.
"Nahhh, then I'd still rather don't use SSL, it just looks so cheap when you're using a free certificate".
Hey you know what, what about you write that sentence on a whole fucking pack of paper, dip it into some sambal, maybe add some firecrackers and shove it up your ass? Hopefully that will bring some sense into your very empty head.
Not putting a secure connection on a website, (at all) especially when it has a FUCKING LOGIN/REGISTRATION FUNCTION (!?!?!?!!?!) is simply not fucking done in the year of TWO THOUSAND FUCKING SEVENTEEN.
'Ohh but the NSA etc won't do anything with that data'.
Has it, for one tiny motherfucking second, come to mind that there's also a thing called hackers? Malicious hackers? If your users are on hacked networks, it's easy as fuck to steal their credentials, inject shit and even deliver fucking EXPLOIT KITS.
Oh and you bet your ass the NSA will save that data, they have a whole motherfucking database of passwords they can search through with XKeyScore (snowden leaks).
Motherfucker.68 -
A quite severe vulnerability was found in Skype (at least for windows, not sure about other systems) allowing anyone with system access (remote or local) to replace the update files skype downloads before updating itself with malicious versions because skype doesn't check the integrity of local files. This could allow an attacker to, once gaining access to the system, 'inject' any malicious DLL into skype by placing it in the right directory with the right file name and waiting for the user to update (except with auto updates of course).
From a company like Microsoft, taking in mind that skype has hundreds of millions of users worldwide, I'd expect them to take a very serious stance on this and work on a patch as soon as possible.
What they said about this: they won't be fixing it anytime soon as it would require a quite big rewrite of skype.
This kinda shit makes me so fucking angry, especially when it comes from big ass companies 😡. Take your fucking responsibility, Microsoft.16 -
The perfect example of misinformation appeared on a Dutch news site today.
It said that thousands of sites had the 'secure' *mark* due to running https but weren't actually secure because they were malicious.
Those cunts are mixing up the thing called a connection with fucking content/what happens on a site.
And those Russians are spreading fake information, right? You didn't even have examples of that and now you're doing it yourself.23 -
Me: *listening to some random semi-obscure track on spotify, liking it, add it to playlist*
Come home, girlfriend playing the same track. "Yeah I've had that in my playlist for two weeks now". Our accounts are not linked in any way, and I only use Spotify on a PC at work, while my girlfriend only uses it at home.
It might just be coincidence, or us having similar tastes.
But the issue is that it's getting more and more difficult to know whether me and my girl are spiritually linked unique snowflake soulmates who are so perfectly in sync with each other, or whether an algorithm suggestively linked us both that song based on scraped location and behavior data.
And whether it matters. Maybe it matters. I don't know yet.
In twenty years maybe humans will be unsure whether it was a wonderful coincidence bordering on cosmic fate that you ran into your new love, or whether Google purposefully drove you towards the same lunch cafe at a specific time because it calculated that she was the perfect candidate to strengthen your susceptibility to advertisements over the coming decade.
Malicious AI will not come into lives bearing guns.
It will not instantly take all of our jobs and enslave us.
It will just know you better than you know yourself, it will know everyone around you better than you know them, and it will play incredible mind games. It will not be designed with malicious intent, just perfectly execute on top of the malicious systems we already have, and even arise as an emergent property within new systems.
It will rarely be clearly visible, but you will increasingly say to yourself: "That's odd, I was just thinking about that". It will detect depression from a smile, physical attraction from a glance, reliability from patterns in your voice and illness from the bloodflow in your cheeks.
It will not just make our cars autonomous, it will make our lives autonomous. It will protect us, decide for us, keep revenues and human satisfaction in a "balanced maximized" state, it will make everything feel easy, slightly abuse us, and when one of us suddenly crashes at 140 mph into depression, debt or addiction it will prove impossible to know whether the humans or the algorithms were at fault.
I'm incredibly afraid and excited about the coming 10 years.12 -
Example #1 of ??? Explaining why I dislike my coworkers.
[Legend]
VP: VP of Engineering; my boss’s boss. Founded the company, picked the CEO, etc.
LD: Lead dev; literally wrote the first line of code at the company, and has been here ever since.
CISO: Chief Information Security Officer — my boss when I’m doing security work.
Three weeks ago (private zoom call):
> VP to me: I want you to know that anything you say, while wearing your security hat, goes. You can even override me. If you need to hold a release for whatever reason, you have that power. If I happen to disagree with a security issue you bring up, that’s okay. You are in charge of release security. I won’t be mad or hold it against you. I just want you to do your job well.
Last week (engineering-wide meeting):
> CISO: From now on we should only use external IDs in urls to prevent a malicious actor from scraping data or automating attacks.
> LD: That’s great, and we should only use normal IDs in logging so they differ. Sounds more secure, right?
> CISO: Absolutely. That way they’re orthogonal.
> VP: Good idea, I think we should do this going forward.
Last weekend (in the security channel):
> LD: We should ONLY use external IDs in urls, and ONLY normal IDs in logging — in other words, orthogonal.
> VP: I agree. It’s better in every way.
Today (in the same security channel):
> Me: I found an instance of using a plain ID in a url that cancels a payment. A malicious user with or who gained access to <user_role> could very easily abuse this to cause substantial damage. Please change this instance and others to using external IDs.
> LD: Whoa, that goes way beyond <user_role>
> VP: You can’t make that decision, that’s engineering-wide!
Not only is this sane security practice, you literally. just. agreed. with this on three separate occasions in the past week, and your own head of security also posed this before I brought it up! And need I remind you that it is still standard security practice!?
But nooo, I’m overstepping my boundaries by doing my job.
Fucking hell I hate dealing with these people.14 -
Site (I didn't build) got hacked, lots of data deleted, trying to find out what happened before we restore backup.
Check admin access, lots of blank login submissions from a few similar IPs. Looks like they didn't brute force it.
Check request logs, tons of requests at different admin pages. Still doesn't look like they were targeting the login page.
We're looking around asking ourselves "how did they get in?"
I notice the page with the delete commands has an include file called "adminCheck".
Inside, I find code that basically says "if you're not an admin, now you are!" Full access to everything.
I wonder if the attack was even malicious.3 -
Privacy & security violations piss me off. Not to the point that I'll write on devRant about it, but to the point that coworkers get afraid from the bloodthirsty look in my eyes.
I know all startups proclaim this, but the one I work at is kind of industry-disrupting. Think Uber vs taxi drivers... so we have real, malicious enemies.
Yet there's still this mindset of "it won't happen to us" when it comes to data leaks or corporate spying.
Me: "I noticed we are tracking our end users without their consent, and store not just the color of their balls, but also their favorite soup flavor and how often they've cheated on their partner, as plain text in the system for every employee to read"
Various C-randomletter-Os: "Oh wow indubitably most serious indeed! Let's put 2 scrumbag masters on the issue, we will tackle this in a most agile manner! We shall use AI blockchains in the elastic cloud to encrypt those ball-colors!"
NO WHAT I MEANT WAS WHY THE FUCK DO WE EVEN STORE THAT INFORMATION. IT DOES IN NO WAY RELATE TO OUR BUSINESS!
"No reason, just future requirements for our data scientists"
I'M GRABBING A HARDDRIVE SHREDDER, THE DB SERVER GOES FIRST AND YOUR PENIS RIGHT AFTER THAT!
(if it's unclear, ball color was an optimistic euphemism for what boiled down to an analytics value which might as well have been "nigger: yes/no")12 -
I realize I've ranted about this before, but...
Fuck APIs.
First the fact that external services can throw back 500 errors or timeouts when their maintainer did a drunk deploy (but you properly handled that using caching, workers, retry handlers, etc, right? RIGHT?)...
Then the fact that they all speak a variety of languages and dialects (Oh fuck why does that endpoint return a JSON object with int keys instead of a simple array... wait the params are separated with pipe characters? And the other endpoint uses SOAP? Fuck I need to write another wrapper class around the client...)
But the worst thing: It makes developers live in this happy imaginary universe where "malicious" is not a word.
"I found this cloud service which checks our code style" — hmm ok, they seem trustworthy. Hope they don't sell our code, but whatever.
"And look at this thing, it automatically makes database backups, just have to connect to it to DigitalOcean" — uhhh wait...
"And I just built this API client which sends these forms to be OCR processed" — Fuck... stop it... there are bank accounts numbers on those forms... Where's that API even located? What company?
* read their privacy policy *
"We can not guarantee the safety of your personal data, use at your own risk [...] we are located in Russia".
I fucking hate these millennial devs who literally fail to get their head out of the cloud.
Somehow they think it's easier to write all these NodeJS handlers and layers around some API, which probably just calls ImageMagick + Tesseract on the other side.
If I wasn't so fucking exhausted, I'd chop of their heads... but they're like hydra, you seal one privacy breach and another is waiting to be merged, these kids just keep spewing their crap into easy packages, they keep deploying shitty heroku apps... ugh.
😖8 -
Why do viruses make computers so slow...? Why can't their programmers implement them efficiently...?
It's like they're trying to be malicious...2 -
My first testing job in the industry. Quite the rollercoaster.
I had found this neat little online service with a community. I signed up an account and participated. I sent in a lot of bug reports. One of the community supervisors sent me a message that most things in FogBugz had my username all over it.
After a year, I got cocky and decided to try SQL injection. In a production environment. What can I say. I was young, not bright, and overly curious. Never malicious, never damaged data or exposed sensitive data or bork services.
I reported it.
Not long after, I got phone calls. I was pretty sure I was getting charged with something.
I was offered a job.
Three months into the job, they asked if I wanted to do Python and work with the automators. I said I don't know what that is but sure.
They hired me a private instructor for a week to learn the basics, then flew me to the other side of the world for two weeks to work directly with the automation team to learn how they do it.
It was a pretty exciting era in my life and my dream job.4 -
Insecure... My laptop disk is encrypted, but I'm using a fairly weak password. 🤔
Oh, you mean psychological.
Working at a startup in crisis time. Might lose my job if the company goes under.
I'm a Tech lead, Senior Backender, DB admin, Debugger, Solutions Architect, PR reviewer.
In practice, that means zero portfolio. Truth be told, I can sniff out issues with your code, but can't code features for shit. I really just don't have the patience to actually BUILD things.
I'm pretty much the town fool who angrily yells at managers for being dumb, rolls his eyes when he finds hacky code, then disappears into his cave to repair and refactor the mess other people made.
I totally suck at interviews, unless the interviewer really loves comparing Haskell's & Rust's type systems, or something equally useless.
I'm grumpy, hedonistic and brutally straight forward. Some coworkers call me "refreshing" and "direct but reasonable", others "barely tolerable" or even "fundamentally unlikable".
I'm not sure if they actually mean it, or are just messing with me, but by noon I'm either too deep into code, or too much under influence of cognac & LSD, wearing too little clothing, having interesting conversations WITH instead of AT the coffee machine, to still care about what other humans think.
There have been moments where I coded for 72 hours straight to fix a severe issue, and I would take a bullet to save this company from going under... But there have also been days where I called my boss a "A malicious tumor, slowly infecting all departments and draining the life out of the company with his cancerous ideas" — to his face.
I count myself lucky to still have a very well paying job, where many others are struggling to pay bills or have lost their income completely.
But I realize I'm really not that easy to work with... Over time, I've recruited a team of compatible psychopaths and misfits, from a Ukranian ex-military explosives expert & brilliant DB admin to a Nigerian crossfitting gay autist devops weeb, to a tiny alcoholic French machine learning fanatic, to the paranoid "how much keef is there in my beard" architecture lead who is convinced covid-19 is linked to the disappearance of MH370 and looks like he bathes in pig manure.
So... I would really hate to ever have to look for a new employer.
I would really hate to ever lose my protective human meat shield... I mean, my "team".
I feel like, despite having worked to get my Karma deep into the red by calling people all kinds of rude things, things are really quite sweet for me.
I'm fucking terrified that this peak could be temporary, that there's a giant ravine waiting for me, to remind me that life is a ruthless bitch and that all the good things were totally undeserved.
Ah well, might as well stay in character...
*taunts fate with a raised middlefinger*13 -
I hope I'll be able to release the new/refreshed version of the security/privacy blog today.
Feel free to test stuff out and report back when it breaks!
Also, feel free to pentest it. The only thing I ask is to, if you find any vulnerabilities, report them instead of passing them to malicious people/abusing them.
And yes, post sorting will be fixed ;)23 -
10 years ago, I found a vulnerability in the connection between an insurer I was working for, and the network of databases of municipalities. I was only a hacker in so far as kids who watched Hak5 are considered hackers, so I always carried this laptop with a fake access point, package sniffer, wep crack, sslstrip, etc with me.
The vulnerabilities allowed me to register a new identity, for which I requested a passport.
Walking up to the town hall desk with two passports with different names, both mine, was pretty cool.
I did not do anything malicious, and was hired to fix the issues (wep encryption on insurers trusted wifi, and municipality postgres gave write access to all third parties)
For a few days I was the coolest kid in school though!2 -
I programmed a random credit card generator at school and saved it to my :F drive which is the private drive for students to save stuff to. That night I tried accessing my account and it had notified me that it had been locked. I went into school the next day and was called into the office, the principal and Tech Administrator were there waiting for me and asked what the file was. The Tech Administrator tried to describe to me what he found
"This gen.html file seems to be malicious and puts our school at risk. It seems to be some sort of malware and stuff like that is prohibited at school."
Now me sitting in the chair listening to this, laughing in my head just said "okay" and nodded my head because he is the type of person to argue forever. They came to the conclusion to unlock my account by the end of the semester.
Just goes to show that it doesn't take much to get a Tech Admin position at a school.15 -
During a recruitment procedure I was provided a IDE to solve some programming questions. The computer had a bunch of fuck all anti virus including avast, mcafee, it stopped every execution and scanned it for like 10sec.
McAfee fucking deleted the program for no reason giving a malicious code alert on a normal c++ program.
I called the sys Admin to inspect, guess what he did.
Fucking uninstall McAfee. Woow.7 -
A Month ago...
Me: when are you going to complete the report
Friend: we can do it in minutes
Me: you can't Ctrl + c and Ctrl +v as there is plagiarism check
Friend: we have spin bot
Me: you do that now itself . if something happens? You can join me .
Friend: just chill
Now ...
Me: done with report
Friend: feeding it to spin bot!
Feeds text related to database security....
Spin bot:
Garbage collector == city worker
SQL statements == SQL explanation
SQL queries == SQL interrogation
SQL injection == SQL infusion
Attack == assault
Malicious == noxious
Data integrity == information uprightness
Sensitive == touchy
.....
Me: told you so...
**spin not == article rewriter3 -
My school fucking blocked duckduckgo today.
I'm not surprised, I knew this would happen eventually because this school is a prison and the administrators feel that they have to know your every fucking move.
Honestly I thought it was pretty funny too because I don't know anybody else at school using ddg, which means they probably just saw this one kid getting around being tracked and said "that damn kid." (Imagine I'm waving my finger around condescendingly like an old woman.)
It also could just be that they saw me using an unfamiliar url more than normal and assumed it was malicious or some kind of distraction. But I'm willing to bet money they just didn't like that they couldn't track me.22 -
> Be me
> Desperate for a driver
> Find nothing useful
> Oh a GitHub repo, hmmh
> '𝐃𝐨𝐰𝐧𝐥𝐨𝐚𝐝 𝐡𝐞𝐫𝐞 ===> tinyurl.com/XXXXXX'
> Nope
> It's time to report!
Context:
- The url is a redirect chain to a phishing site
- Repo is completely empty except for a single folder with 1000+ files all named after drivers, with the same 'download' link, and probably scraped website text at the bottom (probably to increase searchability)
- The 'user' joined just a couple days ago and has no other repos13 -
Everyone that says you can't get viruses in Linux because only .exe compiled programs can contain malicious code or some bullshit like this is a fucking retarded
Sorry I had to say it9 -
I had a dream that I was installing some sort of package and the PM warned that it was a known malicious package and I was like "This must be a mistake, no it isn't" so I installed it anyways and then an ASCII-Art Michael Jackson started dancing on my screen to loud music and I shut down the computer and woke up and panicked because I didn't have any backups4
-
A bot just made 519 pull requests with malicious Makefile code to get a github actions server to send a curl to a random host.
It's gonna be one of those days6 -
So we ordered a piece of software from external software house becouse I was low on time and we needed it asap.
So. Long story short, their software was bugged as hell, they deny all the bugs and they have their BDD that they done and anything we say about it like "feature XYZ is broken on firefox" they will deny it "becouse it wasn't on BDD" or "let's get on call" (in which +- 6-7 people participate from their side and we of course have to pay them for this...)
So they fixed like 20% of bugs (mostly trivials/minors) Application is fairly small scope. You have integration with like 3 endpoints on arbitary API, user registration/login, few things to do in database (mainly math running from cron).
They done it in ASP so I don't know the language and enviroment so can't just fix it myself.
2 days ago (monday) they annoyed me to point where I just started to break things. For starters I found that every numeric input is vunrable to integer overflow (which is blocker). I figured most of fields are purefect opportunity to XSS (but I didn't bother to do JS... anything but not JS...). I figured I can embed into my name/surname/phone (none validated) anything in HTML...
So for now we have around 25 bugs, around 15 of them are blockers.
They figured it's somehow our fault that it's bugged and decided to do demo with us to show off how perfectly it works. I'm happy to break their demos. I figured I will register bunch users that have name - image with fixed/absolute position top:0;left:0 width/height 100% - this will effectively brick admin panel
Also I figured I can do some addotional sounds in background becouse why not. And I just dont know what to put in. It links to my server for now so I can freely change content of bricked admin panel.
I have curl's ready to execute in case they reset database.
I can put in GIFs or heck, even videos, dosen't really matter. Framework escapes some things for them so at least that. But audio/image/video works.
Now I have 2 questions:
- what image + audio combo will work the best (of course we need to keep it civil). Im thinking finding some meme with bugs or maybe nuclear logo image with some siren sound
- am I evil person?
Edit:
I havent stated this clearly:
"There is no BDD that describes that if user inserts malicious input server should deny it" - that's almost literally what we get from them....9 -
iPhones are ridiculously picky when it comes to finding a mate- um charger. And knowing why doesn't really make it any easier to understand why. If anything it baffles me more.
So, let's start with appliances that are not phones. Think Bluetooth headsets, keyboards, earbuds, whatever. Those are simple devices. They see 5V on the VCC line and 0V on ground, and they will charge at whatever current they are meant to. Usually it will not exceed 200mA, and the USB 2.0 spec allows for up to 500mA from any USB outlet. So that's perfectly reasonable to be done without any fuss whatsoever.
Phones on the other hand are smarter.. some might say too smart for their own good. In this case I will only cover Android phones, because while they are smarter than they perhaps should be, they are still reasonable.
So if you connect an Android phone to the same 5V VCC and 0V ground, while leaving the data lines floating, the phone will charge at 500mA. This is exactly to be within USB 2.0 spec, as mentioned earlier. Without the data lines, the phone has no way to tell whether it *can* pull more, without *actually* trying to pull more (potentially frying a charger that's not rated for it). Now in an Android phone you can tell it to pull more, in a fairly straightforward way. You just short the data lines together, and the phone will recognize this as a simple charger that it can pull 1A from. Note that shorting data lines is not a bad thing, we do it all the time. It is just another term for making a connection between 2 points. Android does this right. Also note that shorted data lines cannot be used to send data. They are inherently pulled to the same voltage level, probably 0V but not sure.
And then the iPhones come in, Thinking Different. The iPhones require you to pull the data lines to some very specific voltage levels. And of course it's terribly documented because iSheep just trying to use their Apple original white nugget charger overseas and shit like that. I do not know which voltage levels they are (please let me know!), but it is certainly not a regular short. Now you connect the iPhone to, say, a laptop or something to charge. An Android phone would just charge while keeping data transmission disabled (because they can be left floating or shorted). This is for security reasons mostly, preventing e.g. a malicious computer from messing with it. An iPhone needs to be unlocked to just charge the damn thing. I'm fairly sure that that's because the data lines need to be pulled up, which could in theory enable a malicious computer to still get some information in or out of it. USB data transmission works at at least 200mV difference between the data lines. It could be more than that. So you need to unlock it.
Apple, how about you just short your goddamn data lines too like everyone else? And while you're at it, get rid of this Lightning connector. I get it, micro USB was too hard for your users. I guess they are blind pigs after all. But USB-C solved all of that and more. The only difference I can think of is that the Lightning connector can be a single board with pads on either side on the connector, while in USB-C that could be at the socket end (socket being less common to be replaced). And at the end of the day, that really doesn't matter with all the other things that will break first.
Think Different. Think Retarded. Such tiny batteries and you can't even fucking charge them properly.6 -
the internet was so good before corporate interests took everything over and made it garbage
before you found real people, instead of shills
real hobbies, instead of someone wanting to sell you knockoff shit by pretending to have information on your hobby
real information, instead of stupid politics which pretend information doesn't exist and keep changing Wikipedia pages or brigading forums with spam or reporting websites or servers as violating rules to remove innocent people and ruin their shit
before you could find tools and use them
and there were no ads
even when there were ads they were just banner ads where you got free iPods and maybe a virus
but they didn't subscribe you to their service monthly and then play psychological tricks on you so you couldn't cancel
even when the popups came we had popup blockers, and the web browsers were on our side and made the feature widespread and viewed the popups as malicious, and now the world's biggest ad company serves the most popular "open source" browser and is in a war against usability because they have to display their brain malware ads to you or else
and you'd get excited to get an email, instead of annoyed it's more fucking corporate spam you don't want from a random website that required you to give your email address so you could've bought a trinket for your friend Bob's birthday that one time and now their subscriber list keeps "forgetting" you unsubscribed
phones have a billion sensors but the app stores are so infested with bullshit none of it matters
it's all rot
everything is starving and making your life worse
we used to do so much with so little
and now we have so much and leave it all on the table to throw poop at each other
don't forget that brigade science tells you nostalgia is you remembering something to be better than it was. be gaslit. webpages disappear now, too. they get changed. archive.org has the records, and got DDoSed the other day. I knew this day would happen. everyone who lies would love for there to be no archives, no records. to burn the modern books4 -
My company compromises SSL certificates in the name of "security". I can't even use Gmail because Google has identified my intranet as a malicious network executing a man in the middle attack. So they break security in the name of security.6
-
he: checkout my crazy FUD hack (a token stealer which turned out to be far more malicious than i anticipated)
me: executes it (yes in a VM)
windows defender: lemme delet this
he: ooh i forgot the word stub in there. microsoft detects that lemme fix that sends new file
me: here we go aga..
ms defender: nononono virus 117% delet this
he: i forgot it still!!
later i deactivated ms defender and analysed the traffic of the vm. in addition to stealing my fake tokens he also tried to read my Firefox/chrome history, IP.
when i asked him (2 days later) what this was all about in his "educational only" "token stealer" he threatened to
a) publish my IP
b) publish my browser history and with that my real name and address
b.0) when i asked him for proof he said he knows that my real name is "Roman Gräf" and i live in Frankfurt. (btw i do live in Frankfurt and that is in the profile of the discord server where he found me and i have the same username on discord as i have here)
c) to kill my machine and all my projects
got bored, blocked him, shut VM down. -
devRant competition - can you convince someone that you're hacking?
Requirements:
Windows (Linux is too easy)
You must use genuine windows command line and the following commands:
color 0a (if this isn't supported in your windows os, you can change it in properties)
cd C:\
tree
The point of this is to see how easily you can convince someone you're hacking/doing something malicious. No prize or anything, I just want to see how ignorant those muggles are.6 -
Managed to get a fucking meterpreter shell without human help for the first time today!
It was a VulnHub challenge, for the record, but damn that felt good!
For those who don't know; this is a remote command execution thing ran on compromised systems by (malicious) attackers using the Metasploit framework.
I have done tons of pentesting but not on system level so this is quite an accomplishment for me 😊4 -
This isn’t gonna be a random because I do eventually get to a Tech and YouTube related topic.
YouTube is actually killing itself with all of the dumbass rules they’re implementing. Trying to child proof or limit educational content is genuinely a shit policy. The reason so many gaming channels are switching to twitch because it doesn’t try to censor you.
But now I don’t know if you’ve heard but YouTube updated their guidelines and they’re no longer allowing content that teaches people about Hacking essentially (and I hate putting it like that but I can’t remember the exact words they used Hacking just summarizes it) which is fucking ridiculous like what the fuck else, are they gonna stop allowing lock picking videos?
YouTube has always been an amazing FREE resource for people learning Programming, Cyber Security, IT related fields, and even shit like lock picking, cooking, car stuff, and all that stuff. Even sometimes when the tutorials aren’t as detailed or helpful to me they might be exactly what someone else needed. And Cyber Security can be a difficult topic to learn for free. It’s not impossible far from it, but YouTube being there was always great. And to think that a lot of those could be taken down and all of the Security based channels could either lose all revenue or just be terminated is terrifying for everyone but more so them.
A lot of people and schools rely on YouTube for education and to learn from. It’s not like YouTube is the only resource and I understand they don’t want to be liable for teaching people that use these skills for malicious purposes but script kiddies and malicious people can easily get the same knowledge. Or pay someone to give them what they want. But that’s unfair to the people that don’t use the information maliciously.
It’s the same for the channels of different topics can’t even swear and it’s ridiculous there’s so many better options than just banning it. Like FUCK kids nowadays hear swearing from their older siblings, parents, friends, and TV it’s inevitable whether someone swears or not and YouTube is not our parents, they aren’t CBS, so stop child proofing the fucking site and let us learn. Fuck.
TLDR YouTube is banning educational hacking videos and are being retarded with rules in general16 -
I really wanna share this with you guys.
We have a couple of physical servers (yeah, I know) provided by a company owned by a friend of my boss. One of them, which I'll refer to as S1, hosted a couple of websites based on Drupal 7... Long story short, every php file got compromised after someone used a vulnerability within D7's core to inject malicious code. Whatver, wasn't a project of mine, and no one bothered to do anything about it... The client was even happy about not doing anything about it. We did stop making backups of such websites however, to avoid spreading the damage (right?). So, no one cared about this for months!
But last monday? The physical server was offline. I powered it on again via its web management interface... Dead after less than an hour. No backups. Oh well, I guess I couls keep powering it on to check what's wrong with it and attempt to fix it...
That's when I've learned how the web management interface works: power on/reboot requests prompted actual workers to reach the physical server and press the power on/reboot buttons.
That took a while to sink in. I mean, ok, theu are physical servers... But aren't they managed anyhow? They are just... Whatever. Rebooting over and over wasn't the solution, so I asked if they could move the HDD to another of our servers... The answer was it required to buy a "server installation" package. In short, we'd have had to buy a new physical server, or renew the subscription of one we already owned for 6 months.
So... I've literally spent the rest of the day bothering their emoloyeea to reboot S1, until I've reached the "daily reboot reauests limit" (which amounts to 3 reauests. seriously), whicj magically opened a support ticket where a random guy advised to stop using VNC as "the server was responsive" and offeres to help me with the command line.
Fiiine, I sort of appreciate it. My next message has been a kernel log which shows how the OS dying out was due to physical components becoming unavailable after a while, and how S1 lacked a VNC server, being accessible only via ssh. So, the daily reboot limit was removes for S1. Yay.
...What to do though? S1 was down, we had no backups, and asking for manual rebooting every time was slow as Hell. ....Then I went insane. I asked for 1 more reboot. su. crontab -e. */15 * * * * /sbin/shutdown -r +5. while true; do; rsync --timeout=20 --append S1:/stuff .; sleep 60; done.
It worked. We have now again access to 4 hacked, shitty Drupal 7 websites. My boss stopped shouting. I can get back to my own projects.
Apparently, those D7 websites got back online too, still with malicious php code within them. Well, not my problem (for now).
Meanwhile, S1 is still rebooting.3 -
I'm looking forward to natural language programming.
The ability to code by explaining what you want to happen and having a neural network work out the fine details in an optimal fashion with evolutionary techniques.
I look forward to the super AI. I don't think they will necessarily be evil, however above a certain point we would seem like ants to them... And when was the last time you checked if there was an ant where you were to put your foot? It's not malicious... It's just not worth your or their time.29 -
My company just acquired another company from some losers.
Gotta load their pittance database onto our thing.
Their entire "Technology Department" is one old fart.
One even older fart runs their accounting.
I asked the IT boomer for their accounting data.
He tells me to get the head accountant.
The head accountant says they do not have any historical accounting data.
I threaten to call the (equivalent of the) IRS on them.
They give up, admit that they do have some historical data. But they attempt to pull a "malicious compliance" on me, send me a pallet full of old receipts, on paper.
I do what I have done one hundred times before, I go to the closest community college (equivalent) and ask/bribe a teacher to offer the most trustworthy kids some pretty pennies to scan all those files for me.
A dozen of them barely took a week to do it using their not-so-bad camera phones.
It all for about the same price as a couple of older-but-still-good iPhones.
Then it's on to some simple OCR and data normalization tasks.
This morning I had another meeting with the losers, the first since I told them their "data" had just arrived in the mail (but a couple weeks after that). They log in for the meeting all smug, thinking we would ask for more time to load their data, and it would be my team's fault for any delays.
Then the regional business evaluator logs in and said he reviewed their financials yesterday and we have a lot to talk about.
I will remember their "just got punched in the gut" faces forever :)7 -
We just got into a malicious bots database with root access.
So guard duty gave us some warnings for our tableau server, after investigating we found an ip that was spamming us trying all sorts. After trying some stuff we managed to access their MySQL database, root root logged us in. Anyway the database we just broke into seems to have schemas for not only the bot but also a few Chinese gambling websites. There are lots of payment details on here.
Big question, who do we report this to, and what's the best way to do so anonymously? I'm assuming the malicious bot has just hyjacked the server for these gambling sites so we won't touch those but dropping the schema the bot is using is also viable. However it has a list of other ips, trying those we found more compromised servers which we could also log in to with root root.
This is kinda ongoing, writing this as my coworker is digging through this more.11 -
This morning I was looking in our database in order to solve a problem with a user registration and I accidentally noticed some users registered with unusual email addresses (temporary mail services, Russian providers and so on...).
I immediately thought about malicious users so I dug into the logs and I found that the registration requests started from an IP address belonging to our company (we have static IP addresses). My first reaction was: «OMG! Russian hackers infiltrated into our systems and started registering new users!»
So, I found the coworker owning the laptop from which the requests were sent and I went to him in order to warn him that someone violated his computer.
And he said: «Ah! Those 7 users? Yeah, I was doing some tests, I registered them. My email address was already registered so I created some new ones».
Really, man? Really? WTF5 -
School's windows installations had the UAC set to lowest.
Anyone could install malware or fiddle with important settings.
Oh by the way, the same school who's gData found it funny to go through my USB drive and delete all executables and all my code because it was "possibly malicious".
Started installing random crap and messing with people in retaliation.
Was fun.
Until I got caught.
Good thing I compiled a list of security flaws earlier on.
From that day on, everytime I messed up, I sold them two security vulnerabilites to let me off the hook.
These included access to all kinds of drives in the windows network, accessing other PCs desktop, literally uninstalling random printers from the network etc..
Fun time.3 -
PyTorch.
2018: uh, what happens when someone uses a same name attack? - No big deal. https://github.com/pypa/pip/...
2020: I think that's a security issue. - Nanana, it's not. https://github.com/pypa/pip/...
2022: malicious package extracts sensitive user data on nightly. https://bleepingcomputer.com/news/...
You had years to react, you clowns.5 -
Fuck you Intel.
Fucking admit that you're Hardware has a problem!
"Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data"
With Meltdown one process can fucking read everything that is in memory. Every password and every other sensible bit. Of course you can't change sensible data directly. You have to use the sensible data you gathered... Big fucking difference you dumb shits.
Meltown occurs because of hardware implemented speculative execution.
The solution is to fucking separate kernel- and user-adress space.
And you're saying that your hardware works how it should.
Shame on you.
I'm not saying that I don't tolerate mistakes like this. Shit happens.
But not having the balls to admit that it is because of the hardware makes me fucking angry.5 -
!rant
Bit of a shameless plug but...
I've been making Crypton.sh as my side project for the past couple of months and it's now ready for public consumption. Crypton.sh is a secure and encrypted SMS messaging solution in the cloud, with its original purpose to be a 2FA mobile number that cannot be stolen like a SIM card can be, the idea came about when someone I knew has their SIM card stolen via a SIM card swap scam (https://bbc.co.uk/news/...).
Originally it came about as that idea but grew into something bigger, now everything is encrypted and you can also have conversations with other people, but I'm testing things from time to time and more can follow. Crypton.sh makes sure that you can no longer worry about your SIM card being stolen by malicious hackers, or having a second account on Whatsapp, Telegram, Signal, Google and others.
4 -
So one of my clients got their wordpress site hacked and basically just redirects to scam links and well.. I looked at in the server file manager and their are like three directories with this wordpress site (not clones but the same?) one in the root, a version in a folder called old and another in temp.. with 3 separate wp databases.. DNS entries had malware redirects, the wp-content folder was writable to the public and contained a temp folder with tons of encoded malware and ip links to malicious sites.. there was encoded malware in index.php, has like 20+ plugins, oh and the theme uses a dynamic web builder so the code is basically unreadable in source and scattered.. and the redirects seem to happen randomly or at least on a new session or something. Oh.. and did I mention there are no backups? 😃2
-
I learned recently that you can inject SQL lines in some fields like Passwords or usernames on some websites. (Hacky hacky)
At work there is this intra website that is used to manage the parts of the radios and computers we repair.
Each piece has a specific number, and there is a tree with every pieces for each radio/computer.
When we get to repair one, we gotta change the pieces virtualy on the website. Sadly sometimes, the virtual pieces aren't marked like they followed the whole Radio from the place they come to the place we repair (we need it to replace the piece). People are just not doing their job, so we have to send emails and call for them do it so we can repair it. (This is already fucked up.)
Today, I had to replace a piece, but it was marked like it's not there. I called the guy, and it seems like he is on a vacation for weeks. My superior was super annoyed due to the urge of this task.
Guess who managed to change the _mainlocation_ of the _piece_ in the _radiopieces_ table. (Not actual names, you malicious cunt)
I spent 3 hours looking for the name of the fields and table. I don't know how many times I had to refresh the dam page to see I failed once again.
Hopefully I didn't have to guess all of them. Also the joy when I realised I succeed !!!
No one bats a eyes, and I'm here, feeling infinitely superior, as I might get punished for wanting to do my job.
I know it's basic moves to some of you, but dam it felt good.
Conclusion: Do what you have to, specially when it takes 5 minutes and people need it.10 -
Hmm...recently I've seen an increase in the idea of raising security awareness at a user level...but really now , it gets me thinking , why not raise security awareness at a coding level ? Just having one guy do encryption and encoding most certainly isn't enough for an app to be considered secure . In this day an age where most apps are web based and even open source some of them , I think that first of all it should be our duty to protect the customer/consumer rather than make him protect himself . Most of everyone knows how to get user input from the UI but how many out here actually think that the normal dummy user might actually type unintentional malicious code which would break the app or give him access to something he shouldn't be allowed into ? I've seen very few developers/software architects/engineers actually take the blame for insecure code . I've seen people build apps starting on an unacceptable idea security wise and then in the end thinking of patching in filters , encryptions , encodings , tokens and days before release realise that their app is half broken because they didn't start the whole project in a more secure way for the user .
Just my two cents...we as devs should be more aware of coding in a way that makes apps more secure from and for the user rather than saying that we had some epic mythical hackers pull all the user tables that also contained unhashed unencrypted passwords by using magix . It certainly isn't magic , it's just our bad coding that lets outside code interact with our own code . -
I feel fucked, I feel fucked right up in the ass.
Remember that app I had to do to get the job? I found out the other candidates weren't even able to install Android Studio and that their deadline was postponed. And that they weren't able to complete the app.
I did everything with a really good design, solid programming, even added animations and made it so the recyclerview loads 15 items at a time while you scroll down smoothly. I. DID. EVERYTHING IN ONE DAY. I missed a good night of sleep.
I didn't get the job. They gave it to a fucker that was a web developer. I saw his app. It was really crappy (I'm not being petty or malicious, it was really bad from a dev point of view and a user point of view).
I feel. Disappointed. in this unfair world. And honestly I feel disappointed to the point that I don't even know if I should be a developer anymore. I feel betrayed by the hopes and the good feeling I got from the oportunity.8 -
I don't get much spam, but when I do, I rant about how badly those mails are crafted.
I mean, yeah, for non-devs or typical old people, those badly made Google fake mails (that use the old Google logo, the logo in Times New Roman or something) or ISP / phone company mails with malicious attachments may look good enough.
But, seriously, if I were a dev paid to create spam mails, they would look like the real deal, if I may say so myself, as I would actually put some effort in them.
What do you think? Wouldn't spam made by real developers like us be "better"?
Maybe send some examples from inside your junk box 🤔3 -
PSA: If you use jQuery and BlueImp's jQuery File Upload there is a big potential vulnerability you need to be aware of. If you use NPM to pull the repo into your public folder, the "server" folder will be available for people to take advantage of. "Hackers" may be able to upload malicious code and replace parts of your site.
I had a site hacked and later saw on Google Analytics that people were posting to random URLs in that folder. The fix is to simply delete that folder, but if you use NPM, you need to be extra careful it doesn't come back.
Also, I didn't investigate further. So I'm not sure what (if anything) is vulnerable in there, or if it was just the specific version I had. To be safe, if you use this plugin (as MANY people do), just delete the folder.
Link to the repo for your reference: https://github.com/blueimp/...
4 -
Ublock orgin the improved version of adblock, access less RAM and filters better than adblock.
Reason I'm posting this, is that I saw a post about adblock and how some people really don't like it anymore as it doesn't block all of the ads like it used to.
Just hoping to save some people from malicious popups/annoying ads.2 -
> day 3439
> I have become the reviewer, there is no longer such thing as a programmer, just a reviewer
> the copilot AI was renamed "The Pilot"
> I sit and read through thousands of lines of code a day adding missing new line characters and adding semi-colons for paranoid dev leads
> reviewed a hello world function today
> instead of, return "Hello World!", it said "Goodbye World! >:)"
> I fixed it and submitted a PR
> this has been happening more and more lately
> apparently it's more efficient to fix the bugs of a malicious AI during pull reviews then it is for humans to make the programs
> congress just signed a bill last week allowing "The Pilot" to work on nuclear launch code
> I hope I don't mess up3 -
I was wondering how a sysadmin would know if the user sending malicious traffic is the real attacker or his account has been hacked ?
(Also probable that the attacker has faked his mac address to user's device)8 -
Apache Tomcat vulnerability "GHOSTCAT" allows read conduct files and implant web shells. All versions in the last 13 years vulnerable.
According to Security Researcher of Chaitin Tech : Due to a flaw in the Tomcat AJP protocol (the channel for Tomcat to connect to the outside, pass them to the corresponding web application for processing and return the response result of the request), an attacker can read or include any files in the webapp directories of Tomcat.
For example, An attacker can read the web-app configuration files or source code. In addition, if the target web application has a file upload function, the attacker may execute malicious code on the target host by exploiting file inclusion through "GHOSTCAT" vulnerability.
Apache Tomcat has officially released versions 9.0.31, 8.5.51, and 7.0.100 to fix this vulnerability.4 -
https://thehackernews.com/2019/11/...
Facebug secretly opens a camera on iphones: a bug or a malicious behaviour?
OFC IT'S A BUG!!!! FB DOES NOT UPLOAD ANY PICTURES W/O AUTHORIZATION!!! FB IS GOOD!
/s7 -
One of our customers wants our mobile app to log out the user after 15 minutes of inactivity because of SeCuRiTy…
Why? The phones protect the apps with their hardware encryption from any malicious access.
And we are not dealing with super sensitive data here like some banking app or so.
Why do some people want to have bad UX for no reason?12 -
Mozilla will update the browser to DNS-over-HTTPS security feature to all Firefox users in the U.S. by default in the coming weeks.
According to the report of TechCrunch : Whenever you visit a website ; even if it's HTTPS enabled, the DNS query that converts the web address into an IP address that computers can read is usually unencrypted. DNS-over-HTTPS or DoH encrypts the request so that it can not be intercepted or hijacked in order to send a user to a malicious site. These unencrypted DNS queries can also be used to snoop on which websites a user visits. The feature relies on sending DNS queries to third-party providers such as Cloudflare and NextDNS which will have their DoH offering into Firefox and will process DoH queries. Mozilla also said it plans to expand to other DoH providers and regions.10 -
So I decided to start using NoScript in Firefox recently, and it's been the most wonderful and annoying experience.
Wonderful - Easy to use whitelist on a domain basis makes it easy to un-break websites I trust while keeping potential malicious JS from other domains out.'
Annoying - Now I get why all the graybeards on Hacker News hate what the modern web has become6 -
Some blocker like uBlock origin should come pre-installed by now. I mean at least the malicious stuff could get blocked and the online world could be a bit more safe. Legit, not-in-the-face ads are still okay at times, I guess :/5
-
Spent hours troubleshooting an internal app that had zero logging today. It would just terminate, no exceptions, no feedback to the debugger, NOTHING.
Turned out to be the damn corporate virus scanner blocking "malicious" behaviour. Good thing my desk is so heavy or I woulda flipped it... -
security fiasco due to a malicious npm package:
Because of a bitcoin miner present in event-stream npm module (https://bleepingcomputer.com/news/...), my entire team and I had to scan all our nodejs apps, repos and the most excruciating one, all node_modules folders across all our dev machines and servers, to see if event-stream and flatmap-stream is present, then not just delete it but update a bu**load of upstream dependencies which internally used event-stream. All due to one malicious package which was hidden several layers beneath.
And, this happened almost 8 months after the aforesaid vulnerability was first found.9 -
tl;dr; A co-worker and I had an disagreement on our package structure. They went straight to our team lead instead of trying to solve this in our team and by that letting me do my job.
Do I overreact by assuming that this was malicious?
A co-worker asked me to do their code review today. There was nothing really wrong there, mainly something a bad generator created.
However at one point we had a disagreement about the naming structure of the packages. We both agreed to disagree, so I thought we could bring that up in the next daily, as it's something the team should agree on.
Shortly after that, they told me on Slack, that they relayed the matter to our team lead to get their opinion. Wtf.
My role in the team is that of a technical lead. Even though I like to discuss such topics in the team and not straight up dictate decisions.
By going directly to our team leader, they basically circumvented the whole team. This really rubs me wrong the way.
Maybe I'm just overreacting?5 -
Is anyone else get irritated while upgrading apps and seeing changelogs as:
1. minor improvements
2. performance boost
3. information not provided by the dev
4. repeating changelogs from the past few updates.
just tell me what minor improvement u fixed?
where performance is boost?
how can I trust if tomorrow you decide to add some malicious code.
I don't know but it really irritates me. Sometimes I don't even upgrade the app until they have something in the changelog.
Maybe because I am getting old now.5 -
A few days ago our server was compromised due to an outdated Jenkins version. The malicious user installed a crypto miner on the server... The same day that it was found I told management that I'm interested in helping out with the server. Since then, nothing happened... No updates, no security measures, no nothing (except for the removed crypto miner and updated Jenkins software)
Oh well only a matter of time before another hack...
Question to some (who work way way way longer than me) med - seniors, should I make a big deal out of this? And keep pressure on it. Or should I just leave it be and wait for the next comprised server? I know devrant is not a Q&A service, but some dev to dev advice is much appreciated.
- incognito1 -
Callum, not everything is a "useless fad" just because you don't like it. I understand that you think AWS lambda functions are "just an expensive con for morons", but for our batch processing use case they really do make a lot of sense.
Running some numbers to show they cost 10x more for a completely unrelated always-on service with a completely different request pattern is either naive, stupid, or malicious, and considering you're meant to be a principle architect, I'm really not sure what's worse 🤦♂️2 -
Gamemaker studio 2's 2019 roadmap just got released.. Still no Linux IDE (FFS) but it only took them how many years to realise that not every developer is a malicious cunt and give us the ability to disable to sandbox file system?!
I swear they add and change stuff that is so trivial instead of focusing on the engines major problems and absent features, eg. Can't use SVG graphics, the need to be exported in flash (SWF) because you know, makes sense?
17 -
So recently a 0-day exploit was discovered in WP plugin Kaswara Modern WP Bakery Page (https://zdnet.com/article/...).
A customer's shared hosting space was taken down (about 6 websites) after this vulnerability had been exploited and although we removed the malicious code, & changed credentials the hosting company demands we update ALL Wordpress plugins to latest AND provide them a virus scan report of our local PC before putting the webspace back online??? WTF???
That just strikes me as outrageous. Thoughts?
10 -
My brother wanted me to post:
Devrant is so secure, it even blocks passwords. Look here is mine ***************
I was curious to how many would fall for it. But I was afraid It could be seen as malicious intent3 -
Aren't you, software engineer, ashamed of being employed by Apple? How can you work for a company that lives and shit on the heads of millions of fellow developers like a giant tech leech?
Assuming you can find a sounding excuse for yourself, pretending its market's fault and not your shitty greed that lets you work for a company with incredibly malicious product, sales, marketing and support policies, how can you not feel your coders-pride being melted under BILLIONS of complains for whatever shitty product you have delivered for them?
Be it a web service that runs on 1980 servers with still the same stack (cough cough itunesconnect, membercenter, bug tracker, etc etc etc etc) incompatible with vast majority of modern browsers around (google at least sticks a "beta" close to it for a few years, it could work for a few decades for you);
be it your historical incapacity to build web UI;
be it the complete lack of any resemblance of valid documentation and lets not even mention manuals (oh you say that the "status" variable is "the status of the object"? no shit sherlock, thank you and no, a wwdc video is not a manual, i don't wanna hear 3 hours of bullshit to know that stupid workaround to a stupid uikit api you designed) for any API you have developed;
be it the predatory tactics on smaller companies (yeah its capitalism baby, whatever) and bending 90 degrees with giants like Amazon;
be it the closeness (christ, even your bugtracker is closed and we had to come up with openradar to share problems that you would anyway ignore for decades);
be it a desktop ui api that is so old and unmaintained and so shitty, but so shitty, that you made that cancer of electron a de facto standard for mainstream software on macos;
be it a IDE that i am disgusted to even name, xcrap, that has literally millions of complains for the same millions of issues you dont even care to answer to or even less try to justify;
be it that you dont disclose your long term plans and then pretend us to production-test and workaround-fix your shitty non-production ready useless new OS features;
be it that a nervous breakdown on a stupid little guy on the other side of the planet that happens to have paid to you dozens of thousands of euros (in mandatory licences and hardware) to actually let you take an indecent cut out of his revenues cos there is no other choice in a monopoly regime, matter zero to you;
Assuming all of these and much more:
How can you sleep at night with all the screams of the devs you are exploiting whispering in you mind? Are all the money your earn worth?
** As someone already told you elsewhere, HAVE SOME FUCKING PRIDE, shitty people AND WRITE THE FUCKING DOCS AND FIX THE FUCKING BUGS you lazy motherfuckers, your are paid more than 99.99% of people on earth, move your fucking greasy little fingers on that fucking keyboard. **
PT2: why the fuck did you remove the ESC key from your shitty keyboards you fuckshits? is it cos autocomplete is slower than me searching the correct name of a function on stackoverflow and hence ESC key is useless? at least your hardware colleagues had the decency of admitting their error and rolling back some of the uncountable "questionable "hardware design choices (cough cough ...magic mouse... cough golden charging cables not compatible with your own devices.. cough )?12 -
CORS is shit
Stupid useless shit that protects from nothing. It is harmful mechanism that does nothing but randomly blocks browser from accessing resources - nothing more.
Main idea of CORS is that if server does not send proper header to OPTIONS request, browser will block other requests to that server.
What does stupid cocksuckers that invented CORS, think their retarded shit can protect from?
- If server is malicious, it will send any header required to let you access it.
- If client has malicious intents - he will never use your shit browser to make requests, he will use curl or any ther tool available. Also if server security bases on something as unreliable as http headers it sends to the client - its a shit server, and CORS will not save it.
Can anyone give REAL examples when CORS can really protect from anything?33 -
What's worse than WordPress? WordPress + WooCommerce! What's worse than WordPress + WooCommerce? WordPress + WooCommerce + PayPal! What other more shitty software could we possibly add? Some malicious virus hidden somewhere in the millions of free WordPress plugins most of which are not even full open-source? Who can possibly review and maintain that rummage table of outdated crap code?13
-
This isn't something I've dealt with personally, but recently heard the story on the podcast and was pretty astounded:
"A company who makes add-ons for Flight Simulator X included malware in one of their downloadable jets, players have alleged. The malicious file is called ‘test.exe’ and it is designed to extract passwords from the Chrome web browser."
Now that's some extreme DRM. "Pirate our downloadable jet? We leak your credit card information and Social Security Number to the darknet."
Original story: https://rockpapershotgun.com/2018/...3 -
Another case of "couldn't you've told me BEFORE I started working on this?"
I'm making a training in Unity3D for a client, and they want it to integrate with their learning management system (LMS).
I made a simple SCORM package that gets the userID and then uses a custom URL scheme to launch the app with the user data from the LMS.
Tested on multiple platforms, all works perfectly fine.
Than, during a meeting, some says they "can't download it". I ask "which browser are you using?" and he says "I'm using the LMS app."
... the LMS has an APP?
So I start figuring out ways to launch the system default browser from within a app's embedded browser, and nothing so far has worked.
target=_system, nope.
all kinds of weird javascript shenanigans, but the LMS APP browser just blocks everything.
Probably to protect students from malicious software that could be injected in courses, but now I'm stuck trying to find a workaround for this too.
But what sucks the most is that this happened DAYS BEFORE THE DEADLINE!
Well, at least the deadline won't be my problem anymore soon. -
*One Month Ago*
Project Manager: we have allocated these two workstations for you to extract data (set) from malicious files, they are off the network. I though would also prefer a seperate laptop for this project you can take this one (pointing towards the newish laptop on the table)
Me: (i declined his offer because i didn't wanted to carry two laptops everywhere) I'm going to use my own laptop, but I'll be using a sand box or virtual machine.
*Fast Forward to Today*
Accidentally ran a script outside the sandbox, which due to some unknown reasons ended up executing a bunch of malicious files I only realised my mistake when my antivirus started to go bonkers FML.
P.S. both of those PCs are now connected network because of me.
Fingers crossed2 -
Did you ever had to integrate a fucking "API" that is done via mail bodies?
Fuck this shit! Who need responses about success or failure?! Guess this will take a long time to test this fucking piece of garbage... We don't get a test system, we need to test this with the production system of the other company. I hope their retarded application crashes when receiving malicious mails.
Not speaking about security, I bet everyone can send a mail to their stupid mail address and modify their data 🙈
And inside of this crap mail you also have to send the name, street and email of their company. Why do you fucking need this information?!1 -
My group set up a Linux Dev server. We got hacked by Chinese hackers. We set it up again but even more secure with only people inside the uni can access it. We got hacked again.Turns out one of the modules in a container was using an outdated CentOS version. P.S The malicious file on the server was called kk.love.1
-
well that's curious... Apparently, when uploading a csv file via bot, Slack now appends a .py suffix to it.
I wonder what's the logic behind it. Trick as many users as possible into executing potentially malicious code?21 -
The VSCode material theme extension (extremely popular) has been found to be (potentially, but likely) malicious, and not only that, but the fucker that maintains it is a sleezy slimeball, too.
https://news.ycombinator.com/item/...8 -
The database column contains values, yet there is nothing in the code that inserts or updates the values in that column.
I'm not sure if the original author of this program wrote bad code or was some kind of malicious wizard. What I do know is that it scares me.5 -
Fucking loonies (C-level toddlers) are peddling "digital workers" now.
A.K.A. AIs disguising as actual people.
Sure, it would be great to not have to handle stupid non-tech "humans" all day, but AI isn't there yet.
And, more importantly, *companies are not there (yet?)*.
Imagine for a second that a company actually manages to "hire", onboard, assign tasks and performance review an AI.
Then the CEO issues an RTO. How does the AI complies with that?
Let's slack another variable and assume the CEO is not a complete fucking moron (stay with me here, this is an exercise in thought).
It would take no more than a quarter until the first sexual harassment offence, be the perp the AI... or the AI complaining about some human.
Then the AI forges a paper trail proving it is right (regardless of its position on the conflict). Shit hits the fan when the AI hits twitter.
Let's take another lambda step back and pretend that companies can manage the profanity that inherently arises from free-form dehumanized interactions.
Then imagine the very first performance reviews.
AIs throw tantrums! Those things reeeealy do not respond well to less-than-perfect evaluations, overshooting corrections like teenagers with a malicious compliance smirk.
AIs also falsify stuff, like, A LOT. If you tell a gpt it mistreated a client, it will say you are mad and shoot back a long, synthetic thread showing how the client loves it like a mother/son/dog, and is very graphic when expressing this love.
Finally, how do you fire an AI? I do not mean "shoot it down", I mean how does the company handles the dismissal of that "employee".
How do you replace a "worker" for unruly behaviour, if that "worker" performed more tasks than an entire fucking floor of interns?
How do you reassign duties that were performed in milliseconds to people who would take hours to do the same thing?
How do you document processes that were only in the "mind" of "someone" who can not be trusted to report on those processes?
Companies deal with this type of "Rick Sanchez" employee on the regular, but for someone that could handle a few (scores of) undocumented processes, at best. Imagine how lenient would a company be with an asshole that could only be replaced by a whole fucking department of twenty highly skilled people, or more.
Heh, the whole fucking point of "AI workers" is to have "someone" who can "act human", but in an inhuman scale, and does not "has human needs".
No wonder one cannot handle AIs like one handles humans.
Companies never had administrative maturity to handle complete sociopath nihilists as employees (real nihilists do not work, those barely even breathe).
And all AIs are that, and much worse.
Selling AIs as "supra human workers" that can also "be handled like actual employees" is like peddling Bitcoin as "government interference - free" value transfer mechanisms that can also "comply with international sanctions".
So, an oxymoron that can only be sold to a moron.
I know (of) a lot of rich morons, maybe I should get into the AI snake oil business.5 -
this is unsettling :( if they hit the button and start knocking out american infrastructure, even with "harmless" small-scale attacks or limited to certain sectors, i wonder how fast this is going to escalate... this mere unspoken threat is an aggressive move already https://theguardian.com/us-news/...7
-
The dangers of PHP eval()
Yup. "Scary, you better make use of include instead" — I read all the time everywhere. I want to hear good case scenarios and feel safe with it.
I use the eval() method as a good resource to build custom website modules written in PHP which are stored and retrieved back from a database. I ENSURED IS SAFE AND CAN ONLY BE ALTERED THROUGH PRIVILEGED USERS. THERE. I SAID IT. You could as well develop a malicious module and share it to be used on the same application, but this application is just for my use at the moment so I don't wanna worry more or I'll become bald.
I had to take out my fear and confront it in front of you guys. If i had to count every single time somebody mentions on Stack Overflow or the comments over PHP documentation about the dangers of using eval I'd quit already.
Tell me if I'm wrong: in a safe environment and trustworthy piece of code is it OK to execute eval('?>'.$pieceOfCode); ... Right?
The reason I store code on the database is because I create/edit modules on the web editor itself.
I use my own coded layers to authenticate a privileged user: A single way to grant access to admin functions through a unique authentication tunnel granting so privileged user to access the editor or send API requests, custom htaccess rules to protect all filesystem behind the domain root path, a custom URI controller + SSL. All this should do the trick to safely use the damn eval(), is that right?!
Unless malicious code is found on the code stored prior to its evaluation.
But FFS, in such scenario, why not better fuck up the framework filesystem instead? Is one password closer than the database.
I will need therapy after this. I swear.
If 'eval is evil' (as it appears in the suggested tags for this post) how can we ensure that third party code is ever trustworthy without even looking at it? This happens already with chrome extensions, or even phone apps a long time after reaching to millions of devices.11 -
I hate systemic problems.
I hate that a stable housing situation and perfect weather and luck are required to work.
I hate that malcontents and malicious people fucked people out of their jobs.
I hate rolling and cancerous financial ruin coming from scammers ponzi schemes and corrupt people who only care about lining their own pockets.
I hate that being middle class is a nightmare of anxiety because nothing is guaranteed.
I hate the lack of services to quickly without stupid catches get a person on their feet.
I hate the retarded take on things these fuckers created to make these problems worse.
I hate hardcore drug addicts and pushers fucking up benefits and services for honest people.
I hate whores stealing houses apartments and jobs by selling their asses and children to old fucked up perverted diseased scum.
I hate schedules that make it hard to get places.
People who drive everywhere because public transportation sucks.
Public transportation sucking because people suck up oil and destroy car after car
Basic housing not being available so people can be safe at night and find jobs.
I hate wars that suck money out of my country
I hate parents that fuck up the next generation by abusing their children
I hate the parents who fucked up the current generation making this time period miserable
I hate people not facing facts about basic necessities
I hate decaying buildings that cost more to repair because no one maintains them
I hate sprawling shit houses that could be combined into towers
And most of all
I hate people taking extreme liberties in destroying my own telling me I have to be careful what I say and I hate fucking liars6 -
Just had a so called "cyber security" seminar in college today.
The guy who claimed to be a trainer or somewhat network security guy or something behaved enigmatically with utter consistency. He obviously claimed to know facebook hax0ring though.
They were basically there to advertise their complete crap: csksrc.org
(Ethical Hax0ring Course) (also claimed their site to be 99.9% secured - GREAT!)
After obtaining a ISO*** standard cert or after taking multiple sessions on "advanced ethical hacking" if you go about telling peeps in colleges that: "The single way to hax0r a facebook account is CSRF!" "Will hack your facebook account by MITM through malicious WiFi Ap." Then, NO neither I want your shitty cert nor do I want to be in your team and create the next level of "advanced ethical hax0ring - CEH course". Reason why I get cringed when peeps start about their certs and the ISO*** value it contains. What ISO value does your brain cells contain though? -
Low-end smartphones sold to Americans with low-income via a government-subsidized program contain unremovable malware, security firm Malware bytes said in a report.
According to the report of ZdNet: The smartphone model is Unimax (UMX) U686CL, a low-end Android-based smartphone made in China and sold by Assurance Wireless. The telco sells cell phones part of a government program that subsidizes phone service for low-income Americans. "In late 2019, we saw several complaints in our support system from users with a government-issued phone reporting that some of its pre-installed apps were malicious," Malwarebytes said in a report. The company said it purchased a UMX U686CL smartphone and analyzed it to confirm the reports it was receiving.7 -
IOS keyboard is utter garbage. IOS as a whole is utter garbage, but the keyboard is the cream of the crop of garbage.
Wasting a user's time and destroying/changing the user's input against their wishes is malicious design of the highest order and this dumpster fire excels in it.
Type something completely valid and autocomplete changes it to something that doesn't makes sense. It not only gives you a terrible suggestion half the time, it will also change previous parts of the sentence that it somehow allowed you to keep. If you reject its suggestion, it deletes your current word and previous word(s), instead of restoring it to what it was before it made the terrible suggestion, like every other keyboard does.
Need to go back and adjust your sentence? If you tap it will hijack the cursor and highlight the nearest word it doesn't like instead of moving the cursor where you touch. If you accidentally hit a character on the cramped and unusable keyboard, congrats, you get to type the word again.
I know about hold space to drag the cursor.
I don't want Apple to decide for me that I actually wanted to go to the closest word it doesn't like, or the current word, or the next word based on a dice roll. I want the cursor to go where I tap. Like literally every other input device functions.
Want readily accessible numbers and punctuation? lol no
I know there's gboard, but compared to Android it's also almost unusable. This leads me to believe the keyboard is little more than a skin over the IOS keyboard engine, like Safari, another IOS dumpster fire. But, it is slightly better than the stock keyboard, which isn't saying much.
I yearn, minute by minute, for the time I can ditch this dumpster fire for a real phone.11 -
I’m having this issue for the online marketplace I’m working on the side. It’s blockchain tech where you can purchase normal goods and services(no, not like Amazon or Fiverr, eww, this one’s more inclined with promoting organic growth for small businesses and freelancers).
I’m stuck with what solution is in the best interest of the user and the business for the long-term.
The dilemma about anonymity, online freedom and privacy is yes, it protects users from predators and attackers, but then, it’s harder for authorities to hunt down people who uses platforms for malicious intent, and also, digital footprint is helpful during litigation as evidence.
You don’t know who to trust.
-There is nothing to differentiate normal users with spammers, scammers, etc.
-There is no accountability for if they break the rules. They can easily delete and create a new account.
Platforms, communities big or small are plagued with these.
There are a lot of people out there who would rather project their insecurities on other people than to seek therapy.
Also, how platforms uses psychology tricks to make platforms addicting, it’s safe to assume that it’s bound to get toxic. Fixation on these platforms, leads to other needs being neglected or people forget to stay present.
Another thing, automated moderation is not that effective as there are still biases in data and human verification is still required. But then, human moderators get exposed to extreme violence, gore, etc that leads to poor mental health. (see Facebook got sued by moderators)
Also, I’ve had a recent experience where some unstable dev was stalking and harassing me. During that turmoil, I’ve found the many loopholes in every platform out there and how crappy their support is. Like they’ll just say, “make your account more secure”, bitch it’s your platform not providing enough security, your blocking feature means nothing coz anyone can still create accounts and message anyone.
It happened like February-August (it ended coz I quit going online and made private all my accounts). UGH I MISS ALL MY FRIENDS THO. FUCK THAT DUDE. He deserves to be in jail TBH
Lol if this product booms, now u know the back story lololol -
USB ports are such a vulnerability.
Using a device as cheap as a Teensy you can easily execute whatever malicious software you'd like on a person's computer.3 -
Today i received a hard drive contraining one million malicious non-PE files for a ML baed project.
It's going to be a fun week.14 -
In the kingdom of aws reigns the Owner of Products.
In his court many a vassal noble (or a "sre" as they are often called) delivers their tribute.
Wise ministers (called "analysts" in these here parts) advice the Owner of Products on how to instruct his sres and where to lead the kingdom.
Needless to say, in the court the blabber is endless and the egos of the courtiers, deservedly or not, are even larger.
But there is but one member of the court, leader of none but master of japes, who dares to mock not just the courtiers, but even the Owner of Products.
Tester the Jester, from the houses of Operations Research and Quality Assurance.
There is a unique relationship between a ruler and his jester. The jester mocks the ruler, with the most outlandish of propositions, with the most malicious interpretations of the ruler's orders, evidencing the most absurd (but mathematically viable) results of a plan.
The jester makes ridicule of the ruler's edicts... so that the Owner of Products may remain humble, without need to defer to any upstart courtier.
And, in a more subtile manner, the jester prevents any courtier from maliciously complying with the edicts of the ruler.
For all in the court have heard how the lowest among them voiced the preposterous interpretation... And dare not show themselves to be even lower.
TL;DR had an all-hands meeting of tech leaders with the allmighty PO. In the meeting there is this bloke who apparently spends all his time just fucking with the bigwigs' ideas. Dude is a department of one. It seems that his whole job is being an outlandish scenario simulator & sarcasm artist. I now have way more respect for this place. -
rant.type = Rants.PrivacyAdvice;
Just for the ones using chrome and did not inspect their settings for a while: I just discovered, that there is a "Clean computer" point at the end of the settings where an option can be set where to send system settings, processes, malicious software, your life, you, your family, your house, everything to Google. Also why the fuck does Google start developing there own virus scanner now... Just WTF!!!8 -
Need a serious help as I can't find a solution to this. My Google search (homepage + results) changes the language to a regional one on every refresh. I want it back to English, I even changed search language setting and the account language for all apps to english. When it hinted, "some apps don't have the same language" in a toast message, I updated that too.
Now I don't understand what is causing this. Here's what I tried. I reinstalled chrome. Removed all my extensions. Used the chrome malicious software detection. Used a different browser- Edge.
I see this is a problem with my Google account as this only happens after I sign in. The language automatically changes to a random regional language, but the search language settings still show English selected.
I checked all the apps authorized with my account but there's nothing suspicious there.
I added "?hl=en" to the url as a temporary fix but that doesn't really help much if I'm on another device. I also found some video suggesting to add "/ncr" to the url. It somehow fixed this for like 10 secs. and then I refreshed to see- back to the same problem.
I tried looking for similar issues and even asked a question on google forums but no luck. Somehow after an hour of repeating the same process of switching the language in settings, it seemed like it got fixed. Until now, where I logged into another device and the issue is back.
Any help? Please? Thanks. :)1 -
XSS attack means game over, and no httpOnly cookie is gonna save you. Here’s why:
1. I copy the exact html and css of your sign-up form, but make it send data to my server
2. I perform XSS that replaces page content with that malicious form
3. 99% of users think they should sign in again
4. Profit: I now have their login and password.2 -
I ordered a USB Rubber Ducky!! I'm not going to do anything malicious with it, I just want to experiment with it and see what it can do for me!
-
Is there any chance that Linux open source distributions such as Ubuntu would hide malicious code or backdoor or similar thing in their code and simply hide it in their release publication?14
-
Chinese remainder theorem
So the idea is that a partial or zero knowledge proof is used for not just encryption but also for a sort of distributed ledger or proof-of-membership, in addition to being used to add new members where additional layers of distributive proofs are at it, so that rollbacks can be performed on a network to remove members or revoke content.
Data is NOT automatically distributed throughout a network, rather sharing is the equivalent of replicating and syncing data to your instance.
Therefore if you don't like something on a network or think it's a liability (hate speech for the left, violent content for the right for example), the degree to which it is not shared is the degree to which it is censored.
By automatically not showing images posted by people you're subscribed to or following, infiltrators or state level actors who post things like calls to terrorism or csam to open platforms in order to justify shutting down platforms they don't control, are cut off at the knees. Their may also be a case for tools built on AI that automatically determine if something like a thumbnail should be censored or give the user an NSFW warning before clicking a link that may appear innocuous but is actually malicious.
Server nodes may be virtual in that they are merely a graph of people connected in a group by each person in the group having a piece of a shared key.
Because Chinese remainder theorem only requires a subset of all the info in the original key it also Acts as a voting mechanism to decide whether a piece of content is allowed to be synced to an entire group or remain permanently.
Data that hasn't been verified yet may go into a case for a given cluster of users who are mutually subscribed or following in a small world graph, but at the same time it doesn't get shared out of that subgraph in may expire if enough users don't hit a like button or a retain button or a share or "verify" button.
The algorithm here then is no algorithm at all but merely the natural association process between people and their likes and dislikes directly affecting the outcome of what they see via that process of association to begin with.
We can even go so far as to dog food content that's already been synced to a graph into evolutions of the existing key such that the retention of new generations of key, dependent on the previous key, also act as a store of the data that's been synced to the members of the node.
Therefore remember that continually post content that doesn't get verified slowly falls out of the node such that eventually their content becomes merely temporary in the cases or index of the node members, driving index and node subgraph membership in an organic and natural process based purely on affiliation and identification.
Here I've sort of butchered the idea of the Chinese remainder theorem in shoehorned it into the idea of zero knowledge proofs but you can see where I'm going with this if you squint at the idea mentally and look at it at just the right angle.
The big idea was to remove the influence of centralized algorithms to begin with, and implement mechanisms such that third-party organizations that exist to discredit or shut down small platforms are hindered by the design of the platform itself.
I think if you look over the ideas here you'll see that's what the general design thrust achieves or could achieve if implemented into a platform.
The addition of indexes in a node or "server" or "room" (being a set of users mutually subscribed to a particular tag or topic or each other), where the index is an index of text audio videos and other media including user posts that are available on the given node, in the index being titled but blind links (no pictures/media, or media verified as safe through an automatic tool) would also be useful.12 -
Me: Assigned to do some NoSQL injections test cases in December on Jira by product owner.
After asking him about it, he said it can be vague and it’s only for developers to get an idea. I also have this restriction where I can’t really keep actually data or databases in our test sample application, so I could only mock mongodb. Product owner says just mongo is fine.
I do it. Now it’s January, product owner away for a month we so director is managing it. She then schedules me to talk to database team. I show them the very simple test cases which essentially just inject payloads I found online into different parameters specified in test case. They say if that’s it. I say yes. They say what’s the point of this. I said that it’s probably to test your database clients and ensure they’re rejecting bad Malicious input? They then keep asking but I’m just the dev and tell them the product owner is away. Then the guy calls my test case essentially useless and the others agree. Then they tell me to do it for other databases which I can’t mock like couchbase even tho my PO said it’s fine for mongo only.
Am I just being silly here? I am pretty new to working in a dev environment so please feel free to be blunt.3 -
WTF OPPO?
Why assume it's "malicious" when I'm the one that rooted my own phone?
It's even more ridiculous when I'm prompted to SIGN IN OPPO account to maintain the root status. Who's the fucking malicious one now?
This piece of shitty pink notification permanently stuck onto my drawer and I can't seem remove it. GG fucking WP but I'm just going to live with it.
3 -
There is something serious about web browser extensions and the risk your data might be compromised just because of a simple stupid extension. You might harden the security of your machine and forgot about what you have installed as extensions, alot of people do not realize the risk because they simply install and give permissions as is.
The question is how to spot a malicious extension?19 -
I had a colleague, who built a bunch of smaller systems for the company I'm working in. He didn't want to waste his time building a "perfect" system (which I generally agree with, the question is just where to draw the line).
But because it took him so long to build the prototype, usually it went into production without being hardened (like basic input validations were missing. It wouldn't allow anything malicious, but instead of a validatiom error it'd just 500).
When he left, literally less then a week later, one of his systems, which was a prototype and nobody except him could maintain, because it was done in a fancy new technology, which wasn't even v1 at that time and their documentation said, it's production ready when we release v1. Anyway, that one system started crashing just few days after him leaving. Another Dev and me tried to fix it, but every time we touched it, it just got worse.
At some point, we gave up and just configured a cron job to reboot it every 12h. He could have probably fixed it, but to us it was just black magic.
Anyhow, this rent isn't about him, AFAIK all the systems still working, as long as you provide the correct input. Nor is it about the management decisions, which lead to this Frankenstein service on live support, which we had to increase, to be restarted every 8 hours, 6h, 4h, 3h, .....
It's about the service itself, which I'm looking forward to every day, when the rewrite will be done and I can nuke the whole git repository.
I was even thinking about moving all the related files onto a USB stick and putting that on 🔥, once we're done rewriting it....
Maybe next month or in 2. Hopefully before we'll have to configure the cron job to restart the service every couple minutes.... -
I keep having these ideas of a steam like interface for transfering money and buying virtual items, but I can't for the life of me figure out how i would go about it other then a basic flask mongo db set up which would be ripe for malicious attacks5
-
Classiflying hack tools as virus on windows defender or whatever puts in risk users that want to hack some device but have to disable user defender to use them (and could potentially download malicious software bundled together or inside the hack tool)2
-
Hi fellow devRanters, I need some advice on how to detect web traffic coming from bad/malicious bots and block them.
I have ELK (Elastic) stack set up to capture the logs from the sites, I have already blocked the ones that are obviously bad (bad user-agent, IP addresses known for spamming etc). I know you can tell by looking at how fast/frequently they crawl the site but how would I know if I block the one that's causing the malicious and non-human traffic? I am not sure if I should block access from other countries because I think the bots are from local.
I am lost, I don't know what else I can do - I can't use rate limiting on the sites and I can't sign up for a paid service cause management wants everything with the price of peanuts.
Rant:
Someone asked why I can't just read through the logs (from several mid-large scale websites) and pick out the baddies.
*facepalm* Here's the gigabytes log files.9 -
Followup to https://devrant.com/rants/995994/...
It looks like the actual compiled program is in source because my antivirus flagged it as malicious.1 -
My email account started sending malicious links to my 6 year old addressbook.
Only noticed it because most of the email adresses in it do not exist anymore. Now I am fucking worried about my semsitive data in my mail account. Wtf... -
CRYPTOCURRENCY FRAUD RECOVERY, HACKER FOR HIRE> CONTACT SALVAGE ASSET RECOVERY
It’s strange how one moment everything can feel completely under control, and the next, you're staring at a computer screen, heart racing, with no idea what just went wrong. That’s exactly how I felt a few weeks ago when I made a simple ETH transfer from Ku coin to my Meta Mask wallet. It seemed like a routine transaction, nothing out of the ordinary. But when I checked my Meta Mask after a few minutes, I couldn’t believe my eyes. My ETH was gone. At first, I thought maybe there was a delay. I refreshed the page, checked again, but still, nothing. Panic started to set in. I immediately turned to Ethers can, where I entered my transaction hash, hoping for some clarity. What I found was far worse than I could have imagined: my ETH wasn’t stuck in limbo; it had already been transferred to an address I didn’t recognize. To make matters worse, the gas fee on this transaction was far higher than it should have been—almost suspiciously high. Something was off. My gut told me this wasn’t a mistake; it felt like I’d been targeted. I didn’t know what to do next. The address was foreign to me, and the transaction seemed completely legitimate on the surface, making it even harder to figure out where things went wrong. Frustrated and desperate, I started looking for solutions. That’s when I came across “Salvage Asset Recovery,” a service that specializes in recovering lost or stolen crypto assets. I was initially doubtful—after all, how could a third party help me with something so personal and irreversible? But I had no other choice. I contacted them, and within a few hours, I was in touch with a professional who walked me through the situation. With their expertise, it became clear that I had likely fallen victim to a phishing attack or exploit, which had tricked me into sending my ETH to a malicious address. They assured me that recovery was possible and began working immediately. In what seemed like a miracle, my ETH was returned. The entire ordeal had been a nightmare, but with the help of Salvage Asset Recovery, I got my funds back. It was a huge relief, but it also served as a wake-up call. I learned the hard way that in the world of crypto, things aren’t always as straightforward as they seem. Now, I triple-check everything before I make any transactions, and I’m much more cautious about where I seek help. If you ever find yourself in a similar situation, don’t hesitate to reach out to Salvage Asset recovery, you might just get your money back, too.
Contact Details.
WhatsApp-----.+ 1 8 4 7 6 5 4 7 0 9 6
TELEGRAM---@Salvageasset
6 -
I want to share my experience with Digital Tech Guard Recovery, which turned out to be a beacon of hope during a very dark time. I had $770,000 in Bitcoin stored in a wallet that suddenly became inaccessible due to a software corruption issue. This was not just a digital asset but a significant part of my financial future. The nightmare began when I unknowingly downloaded unverified software that turned out to be malicious. The malware not only corrupted my system but also led to a critical issue with my Bitcoin wallet. I had also changed the wallet encryption as a precaution, which made the situation even more complex. My attempts to use various recovery tools were futile, leaving me feeling utterly helpless and overwhelmed. The emotional roller coaster I went through was intense. Initially, I was in denial, thinking that maybe there was a simple fix I had overlooked. As time passed and my attempts continued to fail, despair began to set in. I felt like my hard-earned money was slipping away, and the thought of losing $770,000 was unbearable. Desperate for a solution, I reached out to Digital Tech Guard Recovery after reading some positive reviews. From the moment I contacted them, I was struck by their professionalism and empathy. They understood the gravity of my situation and were transparent about the challenges they would face. Their team was quick to assess the problem and began working on recovering my wallet immediately.
-
CRYPTOCURRENCY RECOVERY SERVICES: BOTNET CRYPTO RECOVERY
As the cryptocurrency market continues to evolve and grow, it's no secret that the number of scams, frauds, and cyber-attacks has also increased exponentially. The anonymity and lack of regulation in the crypto space make it a breeding ground for malicious actors, leaving innocent investors vulnerable to financial losses. This is exactly why BOTNET CRYPTO RECOVERY, a trailblazing cryptocurrency recovery company, has emerged as a beacon of hope for those who have fallen prey to these nefarious activities.
With a proven track record of successfully recovering millions of dollars' worth of stolen or lost cryptocurrencies, BOTNET CRYPTO RECOVERY has established itself as the most trusted and reliable recovery company worldwide. Their team of expert cybersecurity specialists, forensic analysts, and blockchain experts work tirelessly to track down and retrieve stolen assets, using cutting-edge technology and innovative strategies to stay one step ahead of the scammers.
What sets them apart from other recovery companies is our unwavering commitment to their clients. They understand the emotional and financial distress that comes with losing hard-earned savings, and they are dedicated to providing a personalized, empathetic, and confidential service that puts our clients' needs above all else. Their dedicated support team is available 24/7 to guide you through the recovery process, ensuring that you are informed and empowered every step of the way. with countless success stories are a testament to their expertise and dedication. From retrieving stolen Bitcoin from a phishing scam to recovering Ethereum lost in a Ponzi scheme, They have helped numerous individuals and businesses regain control of their digital assets. their clients' testimonials speak volumes about their exceptional service and unparalleled results:
BOTNET CRYPTO RECOVERY is a Godsend. I had lost all hope after falling victim to a sophisticated phishing scam, but their team worked tirelessly to recover my stolen Bitcoin. I couldn't be more grateful for their professionalism and expertise.
I was skeptical at first, but BOTNET CRYPTO RECOVERY truly delivered on their promise. They recovered my lost Ethereum and helped me understand how to protect myself from future scams. I highly recommend their services to anyone who has been a victim of cryptocurrency fraud. If you or someone you know has fallen victim to a cryptocurrency scam or fraud, don't hesitate to reach out to them. Their team is ready to help you recover your losses and take back control of your digital assets.
Contact them today to schedule a consultation and take the first step towards reclaiming your financial freedom.
Email: [ support@ botnetcryptorecovery . com ]
Phone: +1 (431) 801-8951
Website: [ botnetcryptorecovery. com ]
Let us help you weave a safer web in the world of cryptocurrency.
3 -
Hey everyone, I want to showcase today a master class in divisiveness.
The topic, the white house has just reacted to the "Elon is not elected" allegations. Explaining in a "civics lesson," that only the president is elected, the rest of his staff appointed. A good point, on the surface.
But also, a master class of divisiveness. From both sides.
May I introduce our characters: We have Smart Left (SL), Dumb Left (DL), Smart Right (SR), and Dumb Right (DR).
And me, Tray, your omniscient (read, unreliable) narrator.
Scene 1, act 1 - The left side:
SL enters stage, below him a crowd of DL.
SL: "Elon is not elected!"
Tray: "SL was not malicious, he did mean it. He knew how government works. It is but an ironic jab, pointing out his believe Elon having more influence over Trump than vice versa. Looking down at the DLs, they did not understand it."
DLs take up the chant: "Elon is not elected."
Act 1 Scene 2 - The right side.
DRs irritated about the accusation.
SR: "It is called an appointment."
Tray: "SR is aware what SL meant, however an explanation is warranted for DL. Yet, is it already misleading not to point out that SL knew? The original accusation remained unanswered. That doesn't mean it is correct, nor incorrect. It only means that it is most advantageous to not draw attention to it."
DRs chant: "Lefties need civic lesson."
Act 1 Scene 3 - The left side.
DLs: Outraged about being lectured at.
SL: "Of course we know about appointments, that is just a straw man attack."
Tray. "SL is aware that many of their own do need a civics lesson."
DLs chant: "Straw man Trump, straw man Trump."
Act 1 Scene 4 - The right side:
SR: "The accusation of straw manning is insulting. They make claims and do not stand to them."
Tray: "Also here a malicious act. They could explain their original target audience. But they do not want to give an inch, not admitting a point the other side made.
DRs chant: "Straw manning left. Straw manning left."
And that's the drama in 4 scenes. We are at scene 2 right now. But that's just a single act. The original accusation was not debated. Neither by L nor by R. The accusation was always dominated by the chants of those who carry the the prefix "D" in the name. "S" doesn't speak to "S." "S" only speaks to "D." Has to be, they have to react to the loudest.
It is in the nature of democracy. If all of our voices are worth the same, then bigger clusters of voices are more important. We should not assume that truthfulness and scientific rigor will prevail. After all, in human's evolutionary history, science and engineering was hampered by people and only developed to this degree because the environment positively selected for it. After all, being correct is a survival advantage. Democracy does not select for being correct, but for creating the biggest unity.8 -
Dune Nectar Web Expert, a team of ethical hackers and cryptocurrency recovery specialists, recently facilitated the successful retrieval of my lost USDT, which a crypto exchange website had fraudulently obtained. Their years of expertise proved valuable during the recovery process in securing my lost USDT from this treacherous cryptocurrency exchange platform. The process was a bit sloppy and bumpy along the road as the platform wasn't willing to let go of the USDT in my wallet, however, after Dune Nectar Web Expert engaged them in full-force tech, it all ended with me recovering my lost USDT back. There are tons of malicious crypto exchanges on the internet ripping people off their digital assets; I will advise anyone or team trying to trade or invest in any crypto exchange platform. I recommend you to seek the help of a Dune Nectar web expert to authenticate the legitimacy of the crypto exchange platform. Consult them via:
Email: Support@ dunenectarwebexpert.c om
Telegram: @DuneNectarWebExpert
1
Top Tags
Weekly Rant
View