There's this guy that sits next to me in a class.

Guy: Hey, you're a hacker right?
Me: I'm a programmer.
Guy: Can you hack into my email account?
Me: Nope, I work in a different field of computer science.

In reality, I want to give him a piece of my mind.

I already know his email so I open up the login page and enter it. I click "forgot password", and it asks for his favorite teacher's name. Keep in mind that he made this account this year.

Me: So anyways, who's your favorite teacher?
Guy: *proceeds to give me favorite teacher's name*
Me: 🤦‍♂️

I change his password and log into his account. After that, I show him and tell him about how he should keep his account secure.

He left class with a priceless look on his face.

Hacking/attack experiences...
I'm, for obvious reasons, only going to talk about the attacks I went through and the *legal* ones I did 😅 😜

Let's first get some things clear/funny facts:
I've been doing offensive security since I was 14-15. Defensive since the age of 16-17. I'm getting close to 23 now, for the record.

First system ever hacked (metasploit exploit): Windows XP.
(To be clear, at home through a pentesting environment, all legal)
Easiest system ever hacked: Windows XP yet again.

Time it took me to crack/hack into today's OS's (remote + local exploits, don't remember which ones I used by the way):
Windows: XP - five seconds (damn, those metasploit exploits are powerful)
Windows Vista: Few minutes.
Windows 7: Few minutes.
Windows 10: Few minutes.
OSX (in general): 1 Hour (finding a good exploit took some time, got to root level easily aftewards. No, I do not remember how/what exactly, it's years and years ago)
Linux (Ubuntu): A month approx. Ended up using a Java applet through Firefox when that was still a thing. Literally had to click it manually xD
Linux: (RHEL based systems): Still not exploited, SELinux is powerful, motherfucker.

Keep in mind that I had a great pentesting setup back then 😊. I don't have nor do that anymore since I love defensive security more nowadays and simply don't have the time anymore.

Dealing with attacks and getting hacked.

Keep in mind that I manage around 20 servers (including vps's and dedi's) so I get the usual amount of ssh brute force attacks (thanks for keeping me safe, CSF!) which is about 40-50K every hour. Those ip's automatically get blocked after three failed attempts within 5 minutes. No root login allowed + rsa key login with freaking strong passwords/passphrases.

linu.xxx/much-security.nl - All kinds of attacks, application attacks, brute force, DDoS sometimes but that is also mostly mitigated at provider level, to name a few. So, except for my own tests and a few ddos's on both those domains, nothing really threatening. (as in, nothing seems to have fucked anything up yet)

How did I discover that two of my servers were hacked through brute forcers while no brute force protection was in place yet? installed a barebones ubuntu server onto both. They only come with system-default applications. Tried installing Nginx next day, port 80 was already in use. I always run 'pidof apache2' to make sure it isn't running and thought I'd run that for fun while I knew I didn't install it and it didn't come with the distro. It was actually running. Checked the auth logs and saw succesful root logins - fuck me - reinstalled the servers and installed Fail2Ban. It bans any ip address which had three failed ssh logins within 5 minutes:
Enabled Fail2Ban -> checked iptables (iptables -L) literally two seconds later: 100+ banned ip addresses - holy fuck, no wonder I got hacked!

One other kind/type of attack I get regularly but if it doesn't get much worse, I'll deal with that :)

Dealing with different kinds of attacks:

Web app attacks: extensively testing everything for security vulns before releasing it into the open.
Network attacks: Nginx rate limiting/CSF rate limiting against SYN DDoS attacks for example.
System attacks: Anti brute force software (Fail2Ban or CSF), anti rootkit software, AppArmor or (which I prefer) SELinux which actually catches quite some web app attacks as well and REGULARLY UPDATING THE SERVERS/SOFTWARE.

So yah, hereby :P

So I had my exams recently and I thought I'd post some of the most hacky shit I've done there over here. One thing to keep in mind, I'm a backender so I always have to hack my way around frontend!

- Had a user level authentication library which fucked up for some reason so I literally made an array with all pages and user levels allowed so I pretty much had a hardcoded user level authentication feature/function. Hey, it worked!

- CSS. Gave every page a hight of 110 percent because that made sure that you couldn't see part of the white background under the 'background' picture. Used !important about everywhere but it worked :P.

- Completey forgot (stress, time pressure etc) to make the user ID's auto incremented. 'Fixed' that by randomly generating a user id and really hoping during every registration that that user ID did not exist in the database already. Was dirty as fuck but hey it worked!

- My 'client' insisted on using Windows server.Although I wouldn't even mind using it for once, I'd never worked with it before so that would have been fucked for me. Next to that fact, you could hear swearing from about everyone who had to use Windows server in that room, even the die hard windows users rather had linux servers. So, I just told a lot of stuff about security, stability etc and actually making half of all that shit up and my client was like 'good idea, let's go for linux server then!'. Saved myself there big time.

- CHMOD'd everything 777. It just worked that way and I was in too much time pressure to spend time on that!

- Had to use VMWare instead of VirtulBox which always fucks up for me and this time it did again. Windows 10 enjoyed corrupting the virtual network adapters after every reboot of my host so I had to re-create the whole adapter about 20 times again (and removing it again) in order to get it to work. Even the administrator had no fucking clue why that was happening.

- Used project_1.0.zip etc for version control :P.

Yup, fun times!

Story time. My first story ever on devRant.

To my ex-company that I bear for a long time... I joined my ex-company 3 years ago. My ex-company assigned me and one girl teammate to start working on a brand new big web project (big one - two members - really?)

My teammate quitted later, I have to work alone after then. I asked if someone can join this project, but manager said other people are busy. Yea, they are fucking busy reading MANGA shit everyday... Oops, I saw it because whenever I about to leave my damn chair, they begin chanting some hotkey magic and begin doing "poker face" like "I'm doing some serious shit right here".. FUCK MY CO-WORKERS!

My manager didn't know shit about software development, and keep barking about Agile, Waterfall and AI shit... He didn't even fucking know what this project should look like, he keep searching the internet for similar functions and gave me screenshots, or sometimes they even hold a meeting of a bunch of random non-related guys who even not working on the project, to discuss about requirements, which last for endless hours... FUCK MY MANAGER!

I was the one in charge for everything. I design the architecture, database, then I fucking implement my own designed architect myself, and I fucking test functions that I fucking implemented myself based on my fucking design. I was so tried, I don't know what the fuck I am working on. Requirement changes everyday. My beautiful architecture began to falling off. I was so tired and began use hack fixes here and there many places in the project. I knew it's bad, but I just don't have time to carefully reconsider it. My test case began becoming useless as requirements changed. My manager's boss push him to finish this project. He began to test, he start complaining about bug here and there, blaming me about why functions are broken, and why it not work as he expected (which he didn't even tell my how he expected). ... I'm not junior developer, but this one-man project is so overwhelmed for me... FUCK MY JOB!

At this time, I have already work this project for almost 2.5 years. I felt very upset. I also feel disappointed about myself, although I know that is not all my entire faults. The feeling that you was given a job, but you can not get it done, I feel like a fucking LOSER. I really wanted to quit and run away from this shithole. But on the other hand I also want to finish this project before I quit. My mind mixed. I'm a hard-worker. I keep pushing myself, but the workplace is so toxic, I can feel it eating up my motivation everyday. I start questioning myself: "Is the job I am doing important?", "If this is really important project, didn't they should assign more members?", I feel so lonely at work... MY MIND IS FUCKED UP!

Finally, after a couple months of stress. I made up my mind that no way this project is gonna end within my lifespan. I decide to quit. Although my contract pointed that I only need to tell one month in advance. I gave my manager 3 months to find new members for project. I did handle over what I know, documents, and my fucked up ultra complexity source code with many small sub-systems which I did all by myself.

Well, I am with a new employer right now. They are good company. At least, my new manager do know how to manage things. My co-workers are energy and hard-working. I am put to fight on the frontline as usual (because of my "Senior position"). But I can feel my team, they got my back. My loneliness is now gone. Job is still hard, but I know for sure that I'm doing things on purpose, I am doing something useful. And to me that is the greatest rewards and keep me motivative! From now, will be the beginning for first page of my new story...

Thanks for reading ...

I was stuck with an architectural problem for a few days. Tried to solve it in many different ways. I could always do a quick hack and call it a day, but.. That's not pretty and it would be a trip wire for future developments.

Went to bed at ~2am. Took a few hours before I finally fell asleep. In my dream I was solving the same problem as in real life, except there I found an obvious and simple solution. Woke up at 8am, repeated that solution to myself a few times to not to forget it. Implemented it in the evening and it worked perfectly!

Moral of the story: do not work late. Better go to sleep, rest your mind. You might solve the problem while resting, and you will need a clear mind in the morning to remember and implement the solution :)

p.S. This happened to me more than once.

Just got a call from an Indian scammer. He did the whole press Win + R shabang and I did what he said but the run box didn't appear (maybe cause I'm on a mac) I tried a few more times and then had a moment of enlightenment, I have a mac so that must be why the shortcut isn't working. He then goes on a rant saying everything is fine because he is the best technician and he can fix my mac too. He threatens to hack me and get my name and hack my computer but then goes straight back to his script and asks me to open my browser. I'm asked to go to a website which he mumbles so I don't understand and ask him to spell it for me. This of course is unacceptable and he goes no just type whatever you feel like typing, immediately changing his mind to xvideos.com instead. I say I can't visit the site since I am at work and he goes straight into trying to recruit me. Promises of infinite money and all I could ever wish for. Then he says I should work for him and he would pay me to watch porn which I politely decline. The final interaction was me letting him know I need to get back to work and to tell his call center buddies to never call me. He got super mad at me for accusing him of working at a call center whilst you can hear other calls in the background. 10/10 interaction.

I don't think I could give the best advice on this since I don't follow all the best practices (lack of knowledge, mostly) but fuck it;

- learn how to use search engines. And no, not specifically Google because I don't want to drag kids into the use of mass surveillance networks and I neither want to promote them (even if they already use it).
- try not to give up too easily. This is one I'm still profiting from (I'm a stubborn motherfucker)
- start with open source technologies. Not just "because open source" but because open source, in general, gives one the ability to hack around and explore and learn more!
- Try to program securely and with privacy in mind (the less data you save, the less can be abused, compromised, leaked, etc)
- don't be afraid to ask questions
-enjoy it!

Thanks to Devrant I've learned about rubber duck debugging. Never heard of it before! It reminds me of a story many moons ago when I worked for a certain multinational company as a business analyst. The company brought in some consultants who basically stole the work my team was already doing on a big project (a horrendous series of spreadsheets linked to data coming from the core systems) and sold it back to the company for an insane amount of money as their idea.

When they launched the new product, the team I was in was asked to test and review it. It took my colleague ten seconds to bring the whole thing to its knees and trigger a corrupt data export back into the core systems. Bearing in mind this external company somehow managed to charge tens of thousands of pounds. So what did my colleague do? Hack the system? Some kind of complicated sabotage? Nope. He typed "FISH" into one of the spreadsheet cells! Thus the FISH test was born.

That day I learned several things: it's easy to break things with a fish; the importance of validating your input; and the satisfaction of showing up the smug bastards who stole your ideas and work.

Hey, Unity!

I love you and how your bug system works, but can you polish your errors?
I don't have any experience in programming and I am only a level designer.
I have no idea what this error meant so I begged to my boss crying that this FATAL error popped up.
Then my boss comforted me with pizza and coke.
I just realized that my boss is better than Unity.

I'm sorry, Unity. I was just about to buy the Unity license, but I changed my mind to just use the [personal edition and hack the dark theme by hex edit.

Best regards,
cozyplanes

(* This is a real e-mail sent to Unity Help Center *)

Oh boy, finally something to rant about.

I got hired in a "small" company (not even 2000 people in it), then got "shipped" to a way bigger company. Basically, I work for this company (the french biggest internet / phone service provider) but in the name of my own. And this since last wednesday.

First off, I'm fucking stupid. After leaving the big company that I was in before, I swore to myself that from now on, I would work for smaller companies, mainly because I couldn't stand the inertia that big company have. You ask for something, you get it a month and a half after. The old company has about 6000 employees... This company has 98k people in it. Fuck. My. Life.

Now, to the rant: Orange (the company) decided that they had to move their office somewhere else. They set up a lot of things so that all we needed to do was to put things in boxes, to work somewhere else until next monday, then we could go to the new office on tuesday morning.

Keep in mind that I have been there for 8 days: I keep learning how they do their stuff. For example, if I need a specific docker image, I can't get it from the Docker Hub, the download will fail. However, if I hit an Orange subdomain's registry, I will get this image from a mirror. Because fuck logic.

When we join the company, they give us a Windows laptop ("yeaah we have useless but required Orange softwares that don't run on Linux" "Yeeaaah fuck you") that have a specific VPN allowing us to use the Orange network and, in theory, you can download docker images or clone orange repositories from that network.

In practice, you can simply just go fuck yourself. Why? Because whenever you want to curl, wget or pull anything (or even pip install), your connection keeps being shut down while it waits for the response's header.

The worst part? According to my (new) boss's evasive answers, the way to fix that works with glue, sticks and the power of the Force.

WHY THE FUCK DO YOU ENFORCE US A SHITTY OS FOR DEVELOPMENT, WHEN THE TOOLS YOU SHOVE IN IT WITH A FAKE SMILE DON'T EVEN WORK, AND WE HAVE TO HACK OUR WAY TO FUCKING WORK?

Imagine asking your friends to help you rate your app on the google play store and instead of saying NO I DONT WANT TO RATE YOUR APPLICATION no... they decide to fuck with your mind.

1)
I will rate it tomorrow. (she never rated it tomorrow nor the next couple of weeks later)

2)
I will keep it in mind and rate it later :). (she never rated it later)

3)
I rated it haha (less than 30 seconds later they deleted the rating)

4)
Send me a link and I'll rate it (i send the link, they never respond or read my message again)

5)
I dont have memory on my phone :) (because 13MB of memory is a lot of storage requirements but taking 1 million selfies of up to 25GB is completely fine)

6)
I dont have memory on my phone what dont you understand :) x2 (this is the second girl)

7)
Your trying to give me a virus?? No (i got blocked multiple times)

8)
You want to hack me by making me install this application from the link that you sent me that leads to google play store? No (blocked)

9)
Rate your app? Haha i dont care about it because it doesnt bring me any benefit only the fat cocks that fill my pussy up satisfy me and not ur app haha

10)
Haha send me a link ill rate it (i send link, 8 hours later no reply or reading my message, i text her back if she had done it and im still put on ignore)

...

N)
more

----

Notice how none of these people have said the 2 letter word: "no".

All of these 10 examples are based on a true story.

All of these 10 examples are different people.

---

How hard
Can it be
To just
Write

no

---

.

---

For all of you who are about to trash talk saying i am desperately trying to beg people to rate my app:

i know all of those people for a long time. But when it comes to asking (and not forcing) someone to do you a favor for free that takes no more than 30 seconds, no one seems to have 30 seconds of their free time. Dont get me wrong, some of my friends did politely rate it and left a review, even the people who i barely knew left a review and rated it, but the people with whom I was closer by, didnt.

---

In the beginning i used to not care about this at all. Then i started falling into depression because of it. I fell then into deep depression. Then i sunk so deep that i couldn't feel any emotions anymore so i laughed as an anti depressive mechanism whenever something depressing happened. Now i cant even laugh because i have no more energy. Now i actually leave man tears

---

The only thing more valuable than people, any materialistic thing, animals, coding and even money - is time....

----

why do you waste my time

if i ask you to do something that takes 30 seconds and you dont want to do it

why cant you just say no

why do you drag me

why do you say you're going to do it when you know you wont do it

what do you gain by unnecessarily lying to someone for such a small thing?

to someone who has been a good person to you?

do you feel superior?

is your ego bigger?

----

This experience has taught me that not even a human from the same blood can be trusted.

All of your are fucked up in the head in your own style and i am guilty of it too, all of us are.

But i have never seen the human evolution went from simplicity to overengineered complexitory bULLSHit where you have to lie to someone and waste hours, days, weeks, months and sometimes years of his time just because you dont want to say a 2 letter word, no.

But when that person becomes more successful than you and achieves higher status, Theen you have those 30 seconds of free time. All of you are fucking cynics. and i am so much overly disgusted by all of this fucking bullshit....

-----

This experience has proven to me to simply focus on investing into myself and learn and improve myself and no one else. To not even bother asking even for a small kind of help, a feedback from my work because people don't have 30 seconds of their free time. That is all.

My productivity hack? I code in the shower and use a water whiteboard. I have to be up very early and feel the most clear headed right when I wake up.

If I'm stumped on something, I can usually tackle it from a new perspective. For the most part it works out. Other then the occasional profanity if I accidentally erase something and the sometimes longer than usual showers, my wife doesn't mind. Usually because it's 5 in the morning and when she takes a shower there is this scribble that she tries to decode!

I worked with this hack of a backend dev that was too lazy to add a complex(ish) object to our CMS tool. His solution?

One giant-ass text box with the label "put JSON here".

If tech people were using it I wouldn't mind, but our poor content managers have no idea what json is. Plus like... no examples, no schema... they would have to change shit then go look at the website to see if it worked. Fucking asshole.

Plus.. I mean SHIT, MAN! This was in a Node.js tool... if you have the Json parser you could just GENERATE the respective form fields. DO YOUR JOB

PouchDB.

It promised full-blown CRDT functionality. So I decided to adopt it.

Disappointment number one: you have to use CouchDB, so your data model is under strict regulations now. Okay.

Disappointment number two: absolutely messed up hack required to restrict users from accessing other users’ data, otherwise you have to store all the user data in single collection. Not the most performant solution.

Disappointment number three: pagination is utter mess. Server-side timestamps are utter mess. ANY server-side logic is utter mess.

Just to set it to work, you need PouchDB itself, websocket adapter (otherwise only three simultaneous syncs), auth adapter (doesn’t work via sockets), which came out fucking large pile of bullshit at the frontend.

Disappointment number four, the final one: auth somehow works but it doesn’t set cookie. I don’t know how to get access.

GitHub user named Wohali, number one CouchDB specialist over there, doesn’t know that either.

It also doesn’t work at Incognito mode, doesn’t work at Firefox at all.

So, if you want to use PouchDB, bear that in mind:
1. CouchDB only
2. No server-side logic
3. Authorization is a mess
4. Error logs are mess too: “ERROR 83929629 broken pipe” means “out of disk space” in Erlang, the CouchDB language.
5. No hosting solutions. No backup solutions, no infrastructure around that at all. You are tied to bare metal VPS and Ansible.
6. Huge pile of bullshit at frontend. Doesn’t work at Incognito mode, doesn’t work at Firefox.

The day I read The Simulation Argument, by Nick Bostrom, a thought popped into my mind: "if we are made of code, maybe there are ways to hack life as you would hack some random program", I started thinking privilege escalation over the simulation, buffer overflow, picking signals as if I was eavesdropping... it was an epiphany and also fun

I once used some Windows theme hack in Windows 7 to be able to get a dark background in Explorer.

As a side-effect, Microsoft Word shows me the same dark background as well for its documents even though I didn't tell it to. I didn't mind, though...

But now the fun part: When I wanted to print out the document, it prints with that same dark background... seriously, is this shit hardcoded in?! No wonder you couldn't get a proper dark theme with Windows 7!

(I hope Windows 10 full dark theme won't have this weird issue!)

Legitimately lost an old very terrible project. But I didn't have to deal with it anymore so it was ok. Just called it no longer maintainable. I was so convinced it was gone that when I found it 6 years later I finally realized "losing" the project was my mind just protecting itself from insanity.

Electronic companies nowadays are no different than ranchers that force their slaves to earn money to buy new stuff cause people can’t repair old electronics or fix software bugs cause it’s not theirs or it’s not maintained and source code is not existent.

Damn you software and hardware corporations.

You tell everyone that you care about environment, yet you don’t fucking support your software and hardware as long as people use it. When you stop support you don’t make everything open source but keep it on your private repositories as intellectual property and fuck your clients.

Literally all electronics and software should be mandatory made open source to the people who purchased product so they can use it as long as they want not as long as corporate assholes want. This is insane law that is splitting our world and making it burn. If I could fix my laptop in nearby shop I wouldn’t have to purchase new one.

If it won’t change we will end up with <10 corporations that would rule world economy, everyone who will work for those corporations will be rich and happy and everyone else will be poor and unhappy . Mind me if this is not already happening and this planet slowly becomes Elysium movie nightmare.

Stop buying new stuff you stupid people cause this make things worse.

If it won’t change in 10 or so years there will be connected to cloud robots all over the world guarding us and some dick shit rich John Conor kid will hack them to exterminate humans by executing order 66. After that there will be big power outage that will put us into the role of battery and we would be closed in the barrel full of pink shit connected to matrix.

Get me out of here you asshole.

Every time I'm working on a task as soon as I need to write some hack, dirty code, that does work, but creates overhead in the run time performance or makes the project a mess. I stop and can't continue with this task...

it locks my mind and progress where after a while. I simply give up and do it anyway or give someone else the task.

How to deal with task that have no clean solution?

My friends think there is a hack button for Facebook. My mind obviously goes on wtf mode.