So our public transportation company started to sell tickets online with their brand new fancy​ system.

• You can buy tickets and passes for the price you want
• Passwords are in plaintext
• Communication is through HTTP
• Login state are checked before the password match so you can basically view who is online
• Email password reminders security code can be read from servers response

Oh and I almost forgot admin credentials are FUCKING admin/admin

Who in the fucking name of all gods can commit such idiocracy with a system that would be used by almost millions of people. I hope you will burn in programming hell. Or even worse...

I'm glad I'm having a car and don't have to use that security black hole.

Found a security hole....

A fast food delivery service had an ID for every order it Said
"example.com/order/9237" - i go 9236... finds another persons order, address, and phone number

So What should i do?

i thought of making a crawler and then make statistics on everyones orders and send Them a link 😂

*signs up for Skillshare*
> Sorry, your password is longer than our database's glory hole can handle.
> Please shorten your password cumload to only 64 characters at most, otherwise our database will be unhappy.

Motherf-...

Well, I've got a separate email address from my domain and a unique password for them. So shortening it and risking getting that account stolen by plaintext shit won't really matter, especially since I'm not adding payment details or anything.

*continues through the sign-up process for premium courses, with "no attachments, cancel anytime"*
> You need to provide a credit card to continue with our "free" premium trial.

Yeah fuck you too. I don't even have a credit card. It's quite uncommon in Europe, you know? We don't have magstripe shit that can go below 0 on ya.. well the former we still do but only for compatibility reasons. We mainly use chip technology (which leverages asymmetric cryptography, awesome!) that usually can't go much below 0 here nowadays. Debit cards, not credit cards.

Well, guess it's time to delete that account as well. So much for acquiring fucking knowledge from "experts". Guess I'll have to stick to reading wikis and doing my ducking-fu to select reliable sources, test them and acquire skills of my own. That's how I've done it for years, and that's how it's been working pretty fucking well for me. Unlike this deceptive security clusterfuck!

By the way, Bitlocker is a joke.

"we don't plan on fixing a huge security hole that allows for root on our one server that runs our million-dollar service"

Everyone in family and friends allways ask me "You're a programmer and know a lot about computer, so why you're not in Facebook/Twitter/Instagram?"

My answer: We create these services for you (average people) we don't use them ourselves. It's a security hole to put your information in public.

Arsch has a big security hole! In fact, a backdoor.

Devrant has a big security hole... Just post "Which is better, Linux, Windows or Mac os?"
The internet will crash

fucking hostgator!

go suck a cock you developers!

everything from their payment system to their support is crap.

a few days ago, i purchased a website from hostgator, with a year of hosting during black friday weekend. i had obtained a black friday coupon code that entitled me to roughly $160 off its usual price. that said, i filled out the registration form and clicked the 'checkout' button.

right after i clicked it, i saw i forgot to put in the coupon code, and pressed the back button on my browser. then i put in the code and proceeded with checkout.

guess what?

those MOTHERFUCKING GREEDY ASS BITCHES charged me TWICE, one with the coupon and one without.

i contacted customer support and told them what happened after waiting about double the time i was supposed to be connected to support.

of course, they asked for my fucking "security" pin over the customer support live chat (totally not ironic).

they sent a confirmation email, and cancelled the payment without the coupon.

then ONE FUCKING DAY LATER, I tried to connect to my website.

MY SITE WAS FUCKING SUSPENDED.

die in a hole.

i contacted customer support once more, and after explaining the story, I had to wait four to eight hours.

i'll see how it turns out tomorrow.

die in a hole hostgator🖕

THE FUCK WHY did the company which made the website I'm maintaining now ADD CUSTOM FACEBOOK LIKES AND TWITTER FOLLOWER WIDGETS - IN A SUBDIRECTORY OF THE THEME?

Guess what, you motherfuckers: One year after you made that damn page the Facebook API changed and your stinking widget is broken REQUIRING ME TO REWRITE MOST OF IT!

Also WHO THE FUCK LEFT HIS BRAIN ON HIS BEDSIDE TABLE the day he decided to HARDCODE ASSETS WITH AN http:// (no tls) URL? YES, browsers will block that shift if the website itself is delivered over tls, because it's a GAPING SECURITY HOLE!

People who sells websites that have user management and thus request authentication without AT LEAST OFFERING FUCKING STANDARD TLS SHOUD BE TARRED AND FEATHERED AND THEN PUT IN A PILLORY IN FRONT OF @ALEXDELARGE'S HOUSE!

Maybe I should be a bit more thankful - I mean I get payed to fix their incompetence. But what kind of doctor is thankful for the broken bones of his patient?

Was just recalling one of the worst calls I ever got in IT...

Many years ago we had a single rack for all of our servers, network and storage (pre virtualization too!).

We had a new security system installed in the building and the facilities manager let the guy into the server room to run all the sensor cables in because that is where they wanted their panel... the guy was too lazy to get up on the roof and in the attic repeatedly so after he checked it out he went around every where and drilled a hole straight up where he wanted the sensor wire to go... well the server room was not under an attic space... when he found he had drilled through to the out side... HE FILLED IT WITH EXPANDING FOAM.... the membrane on the roof was damaged... that night it rained... I got a call at 4 am that systems were acting funky and I went in... when I opened the door it was literally raining through the corners of the drop ceiling onto the rack... An excellent DR plan saved our asses but the situation cost the vendor's insurance company $30k in dead equipment and another $10k in emergency labor. Good thing for him we had so little equipment in that room back in.

Moral of the story... always have a good DR plan... you never know when it will rain in the server room.... :)

I swear, the next time I hear a web developer say to me: "Yeah let's pretend as if the security hole in the website isn't there, because truth be told, i cannot be bothered to fix it."

Got fucking graduated, a whole day wasted, fucking ass hole literally trapped us cannot even got to release some water.

To get a fucking degree you have to bear with fucking teacher who don't shit about privacy, security.

And answering fucking theroy questions which has fucking string Match with the fucking textbook paragraph.

Do a fucking report which will be fucking 100 pages and take fucking 2 copy (10 rough copies)

The register to fucking leaky placement centre. Who leak you data to all hiring companies as well as your co-students.

Then fucking attend the fucking ass hole ceremony where some old guy lectures for fucking long time about some civil infrastructure , road and other stuff.

And I have not mentioned other fucking ass hole slutty stuff.i don't know fucking until what time I can hold on.

This Fucked the fuck out of me

I started to work in the CreditCard / Bank business a year ago.
Now they stopped the hole server migration project, so I leave again. They could have had it all. Server 2016, SQL 2016, Citrix, Surface Books and so on.
But no, the new shitty projects are more important than security or on what technology the system is build on.

Seems like the FTP Server will run on Windows 2003 forever...

Rant considering the latest Cyber attack and the news around it.

(A recap: a lot of Windows computers were infected with ransomware (due to security hole on Windows), which demanded 300$ in bitcoins to unlock data. After 3 days the price would double, and after 7 days the data was to be deleted)
1) In our country, one of the biggest companies was attacked (car factory). The production stopped and they got for around 1 000 000€ damage in less than 24h (1300 people without work). The news said that they were attacked because they are such a big company and were charged more, as the hackers "knew who they were dealing with" - another reason being the fact that the text was in croatian (which is our neighbor country), but noone realized that it is just a simple google translate of english text - which is obviously not true. The hackers neither know nor care who is hacked, and will charge everyone the same. They only care about the payment.
2) In UK whole (or large part) of medical infrastructure went down. The main thing everyone was saying was: "Nobody's data is stolen". Which, again, is obvious. But noone said anything about data being deleted after a week, which includes pretty much whole electronic medical record of everyone and is pretty serious.
And by the way, the base of the ransomware is code which was stolen from NSA.
All that millions and millions of dollars of damage could be avoided by simply paying the small fee.
The only thing that is good is that (hopefully) the people will learn the importance of backups. And opening weird emails.
P.S. I fucking hate all that 'hacky thingys' they have all over the news.

In my office, it requires security clearance, but the office is sooo fucked up it takes months to get it sorted

So, now in the position of people knocking at doors, annoying you at your desk to take your pass, often for large periods,,, leaving me sweating when im dying for a piss

WTF is going through MGMT heads,

Of course im sitting next to the fucking door, so when u sitting down to do some nice code, fucking knock on the door,

And wouldnt mind but its the same fucking Wagon who smokes, pisses and chats on the phone like its a God damn super power, as i type this im looking over my divider and they're rolling yet another fucking smoke!

I need out of this fucking 7th ring of Dantes inferno hello hole

Who thought Lua was a good idea for extending gameplay functionality??

It's weakly typed, has no OOP functionality and no namespace rules. It has no interesting data structures and tables are a goddamn mystery. Somebody made the simplest language they could and now everybody who touches it is given the broadest possible tools to shoot themselves in the foot.

Lua's ease of embedding into C++ code is a fool's paradise. Warcraft 3's JASS scripting language had way more structure and produced much better games, whilst being much simpler to work with than Lua.

All the academics describing metatables as 'powerful extensionality' and a fill-in for OOP are digging the hole deeper. Using tables to implement classes doesn't work easily outside school. Hiding a self:reference to a function inside of syntactic sugar is just insanity.

Nobody expects to write a triple-A game in lua, but they are happy to fob it off to kids learning to program. WoW made the right choice limiting it to UI extensions.

Fighting the language so you can try and understand a poorly documented game engine and implement gameplay features as the dev's intend for 'modders', is just beyond the pale. It's very difficult to figure out what the standard for extending functionality is, when everybody is making it up as they go along and you don't have a strongly-typed and structured language to make it obvious what the devs intended.

If you want to give your players a coding sandbox, make the scripting language yourself like JASS. It will be way better fit for purpose, way easier to limit for security and to guarantee reasonable performance. Your players get a sane environment to work in and you just might get the next DOTA.

Repeatedly shooting yourself in the foot on invisible syntax errors and an incredibly broad language is wasted suffering for kids that could be learning the programming concepts that cross all languages way quicker and with way more satisfying results.

Lua is hot garbage for it's most popular application, I really don't get it. Just stop!

I have found a website that allows HTML in comments. They blocked <script>, but not <iframe>. I can just load a script from my personal website using it. What should i do?
(something innocent)

I don’t understand how Microsoft can continue to ship functionality in modern versions of SharePoint that only work on IE11 (open in Explorer, open in InfoPath, Skype presence integration). The only reason my company has to make web apps compatible with that browser is because of the hot garbage that is IE11. Just kill the functionality and kill the browser. Please.

Yes I know *why* they only work in IE11, it’s because activex is a massive security hole, but just kill the functionality if you can’t recreate it in modern browsers.

Just found the most embarrassing security hole. Basically a skelleton key to millions of user data. Names, email addresses, zip codes, orders. If the email indicates a birthdate, even more shit if you chain another vector. Basically an order id / hash pair that should allow users to enter data AND SHOULD ONLY AUTHORIZE THEM TO THE SITE FOR ENTRING DATA. Well, what happend was that a non mathing hash/id pair will not provide an aith token bit it will create a session linked to that order.

Long story short, call url 1 enter the foreign ID, get an error, access order overview site, profit. Obviously a big fucking problem and I still had to run directly to our CEO to get it prioritized because product management thought a style update would be more important.

Oh, and of course the IDs are counted upwards. Making them random would be too unfair towards the poor black hats out there.

Just got a lovely update on Windows 10. It pops up on login and informs me of this great new browser called edge. Then it fucking takes over the screen and gives me one fucking option: "Get Started". I cannot escape, I cannot close the app, I cannot right click the app icon on the toolbar and close this POS. My only option is to fucking ctrl-alt-del and kill this piece of garbage. You also cannot uninstall this shit either. I even found a thread where the MS guy was trying to help them uninstall, but the end result is that you cannot on newer Windows 10. So I have this POS thing that keeps updating flash and other shit periodically that is nothing but a security hole. Now I never want to ever run this garbage.

The irony is this. I have read a lot of good things about Edge. I was considering it as an alternative to Chrome for specific use cases. Now I absolutely no longer want to run this fucktard pos software. This one experience has now tarnished any gains MS has in the browser arena. It is just more overbearing malware being pushed by assholes. Tech these days is defined by assholes. Apple is assholes, Google is bigger assholes, and MS is still the classic assholes.

Microsoft LET ME FUCKING JUST WORK! Is this not the pro version or what?

Fuck you edge and your pos os.

Now I feel better!

Edit: That was a rendition of the evil caption Kirk from episode 27.

So a while back I had found a hole in a website's security, one that I has used pretty frequently. I was able to change my cookies and become any user I wanted. The only caveat was that I had to log in as a user in order to get things started. But once I was in I could basically be anyone I wanted to be just by changing a few numbers in the user ID of the cookie. They also did all of their user processing on the client side. Even password checks.

A couple weeks back I decided to go back in to see if anything had changed since then. It did! But not in the way I had thought.

So these guys decided that instead of fixing their security hole, they would have users just contact their people directly in order to get a new account.

Wow that's so much fucking overhead for basically being a lazy shit and not fixing the security holes. I mean how bad is your architecture if you can't go in and fix this?

Not only that I found that they actually stripped all of the users of their original subscriptions. So now if you want to get back on your subscription you'll have to fork over another $399. So that means going to their shitty form filling out your name, your number, email, and just hope that someone contacts you via phone call.

I'm glad I dropped this service. They clearly can't get their shit together.

>be me
>watching Clone Hero video
>streamer mentions something about HTML color tags being in a chart's metadata that's displayed properly
>...
>...
>...

>you WHAT

>really

>aight, let's test the clear security hole

*makes 1 note long chart and adds JS to metadata*

*metadata payload triggers when you attempt to play the chart*

FUCKING...

this is dumb.

After brute forced access to her hardware I spotted huge memory leak spreading on my key logger I just installed. She couldn’t resist right after my data reached her database so I inserted it once more to duplicate her primary key, she instantly locked my transaction and screamed so loud that all neighborhood was broadcasted with a message that exception is being raised. Right after she grabbed back of my stick just to push my exploit harder to it’s limits and make sure all stack trace is being logged into her security kernel log.
Fortunately my spyware was obfuscated and my metadata was hidden so despite she wanted to copy my code into her newly established kernel and clone it into new deadly weapon all my data went into temporary file I could flush right after my stick was unloaded.
Right after deeply scanning her localhost I removed my stick from her desktop and left the building, she was left alone again, loudly complaining about her security hole being exploited.
My work was done and I was preparing to break into another corporate security system.
- penetration tester diaries

Just sat through a demo of some clicky-draggy data visualisation stuff.

The guy showed us how you can write a custom script that takes a user input and pokes it into a sql command using string concatenation, so a very obvious injection vulnerability.

Ok, so it's only a demo. But you wouldn't do a demo with an example user called Captain Cock, so why do a demo with a screamingly obvious security hole?

Whole thing was basically pivot tables in a short skirt anyway.

I think alot of things supposedly already being done and the profit based bent of the world discourages young developers who don't know that half of the touted projects are crap in many cases and there is still large amounts of room for development.

Not to mention the glaringly obvious security hole and the need to build teams that understand the comp from top to bottom so certain scheisters can't push bullshit on us that would take a single person too long to understand every aspect of.

Since Electron is getting some well deserved flak, I think I'll add my two cents.

Why in the actual fuck can it not proceed any way to allow us to USE OUR SELF FUCKING SIGNED CERTIFICATES.

Yes, security hole, but for messing about with new software, I'm not going to pay a CA for a certificate so I can put it on a server that only I and a few select individuals use!

At least give us a usable frontend for allowing our self-signed certificates so I can use my fucking server!