Okay.. that was much more than what I had asked for..

Courtsey : An Indian vehicle manufacturing service request portal..

Worst hack/attack I had to deal with?

Worst, or funniest. A partnership with a Canadian company got turned upside down and our company decided to 'part ways' by simply not returning his phone calls/emails, etc. A big 'jerk move' IMO, but all I was responsible for was a web portal into our system (submitting orders, inventory, etc).

After the separation, I removed the login permissions, but the ex-partner system was set up to 'ping' our site for various updates and we were logging the failed login attempts, maybe 5 a day or so. Our network admin got tired of seeing that error in his logs and reached out to the VP (responsible for the 'break up') and requested he tell the partner their system is still trying to login and stop it. Couple of days later, we were getting random 300, 500, 1000 failed login attempts (causing automated emails to notify that there was a problem). The partner knew that we were likely getting alerted, and kept up the barage. When alerts get high enough, they are sent to the IT-VP, which gets a whole bunch of people involved.
VP-Marketing: "Why are you allowing them into our system?! Cut them off, NOW!"
Me: "I'm not letting them in, I'm stopping them, hence the login error."
VP-Marketing: "That jackass said he will keep trying to get into our system unless we pay him $10,000. Just turn those machines off!"
VP-IT : "We can't. They serve our other international partners."
<slams hand on table>
VP-Marketing: "I don't fucking believe this! How the fuck did you let this happen!?"
VP-IT: "Yes, you shouldn't have allowed the partner into our system to begin with. What are you going to do to fix this situation?"
Me: "Um, we've been testing for months already went live some time ago. I didn't know you defaulted on the contract until last week. 'Jake' is likely running a script. He'll get bored of doing that and in a couple of weeks, he'll stop. I say lets ignore him. This really a network problem, not a coding problem."
IT-MGR: "Now..now...lets not make excuses and point fingers. It's time to fix your code."
IT-VP: "I agree. We're not going to let anyone blackmail us. Make it happen."

So I figure out the partner's IP address, and hard-code the value in my service so it doesn't log the login failure (if IP = '10.50.etc and so on' major hack job). That worked for a couple of days, then (I suspect) the ISP re-assigned a new IP and the errors started up again.

After a few angry emails from the 'powers-that-be', our network admin stops by my desk.
D: "Dude, I'm sorry, I've been so busy. I just heard and I wished they had told me what was going on. I'm going to block his entire domain and send a request to the ISP to shut him down. This was my problem to fix, you should have never been involved."

After 'D' worked his mojo, the errors stopped.

Month later, 'D' gave me an update. He was still logging the traffic from the partner's system (the ISP wanted extensive logs to prove the customer was abusing their service) and like magic one day, it all stopped. ~2 weeks after the 'break up'.

@netikras since when does proprietary mean bad?

Lemme tell you 3 stories.

CISCO AnyConnect:
- come in to the office
- use internal resources (company newsletter, jira, etc.)
- connect to client's VPN using Cisco AnyConnect
- lose access to my company resources, because AnyConnect overwrites routing table (rather normal for VPN clients)
- issue a route command updating routing table so you could reach confluence page in the intranet
- route command executes successfully, `route -n` shows nothing has changed
- google this whole WTF case
- Cisco AnyConnect constantly overwrites OS routing table to ENFORCE you to use VPN settings and nothing else.

Sooo basically if you want to check your company's email, you have to disconnect from client's VPN, check email and reconnect again. Neat!

Can be easily resolved by using opensource VPN client -- openconnect

CISCO AnyConnect:
- get a server in your company
- connect it to client's VPN and keep the VPN running for data sync. VPN has to be UP at all times
- network glitch [uh-oh]
- VPN is no longer working, AnyConnect still believes everything is peachy. No reconnect attempts.
- service is unable to sync data w/ client's systems. Data gets outdated and eventually corrupted

OpenConnect (OSS alternative to AnyConnect) detects all network glitches, reports them to the log and attempts reconnect immediatelly. Subsequent reconnect attempts getting triggered with longer delays to not to spam network.

SYMANTEC VIP (alleged 2FA?):
- client's portal requires Sym VIP otp code to log in
- open up a browser in your laptop
- navigate to the portal
- enter your credentials
- click on a Sym VIP icon in the systray
- write down the shown otp number
- log in

umm... in what fucking way is that a secure 2FA? Everything is IN the same fucking device, a single click away.

Can be easily solved by opensource alternatives to Sym VIP app: they make HTTP calls to Symantec to register a new token and return you the whole totp url. You can convert that url to a qr code and scan it w/ your phone (e.g. Google's Authenticator). Now you have a true 2FA.

Proprietary is not always bad. There are good propr sw too. But the ones that are core to your BAU and are doing shit -- well these ARE bad. and w/o an oppurtunity to workaround/fix it yourself.

I'm the only developer in my company. I am a "junior dev" who started working like 6 months ago. Safe to say I am not well experienced and have a lot to learn in this journey. Due to this pandemic, my bosses who have been flaunting their wealth have started making losses and now needs to find another way to get money. Mind you, the company I work with is a marketing firm.
So what the bosses thought of doing was creating a delivery service due to the current situation. It is not their field but since they still need to show people they are the rich people, they need money either way. Since I'm the only developer in the company I've to make this application. I've to make an Android and iOS app with a back-end and an admin portal all in 1 month. My pay is shit and by shit I mean less than even 700 USD. I've not done a project like this before so there would be a learning curve as well. And there is no one to guide me either.
They think just because they have hired one developer anything development related is settled and I will do everything no matter how big or complicated or how shitty my salary is.
The feature list is a whole system, like it is so complicated that someone could really make their own company just to work on that application. It's HUGE.

I'm thinking of saying no I can't do this shit. But just wanted to see what some more experienced devs say about this. I've attached the features list in the rant.

Worst exp. on a collab/group project?

Had a few, here is one.

Worked with a dev team (of two devs) in Norway to begin collaboration on providing a portal into our system (placing orders, retrieving customer info, inventory control, etc)

They spoke very good English, but motivation was the problem. Start the day around 10:00AM...take a two hour lunch...ended the day at, if I was lucky, 4:00PM (relative to Norway time). Response time to questions took days, sometimes weeks. We used Skype, which helped, but everything was "Yea...I'll do that tomorrow...waiting on X....I have a wedding to go to, so I'll finish my part next week."

I didn't care so much, I had other projects to do, but the stakeholders pounded me almost everyday demanding a progress report (why aren't you done yet...etc..etc.)
The badgering got so bad I told the project owner (a VP) if he wanted this project done by the end of the year, the company would have to fly me to Norway so I personally push things along.
When real money was on the line, he decided patience was warranted.

A 3 month project turned into 9, and during a phone meeting with the CEO in December
O: "Thanks guys, this project is going great. We'll talk again in February. Bye."
PM: "Whoa...what! February!"
<sounding puzzled>
O: "Um..yes? It's Christmas time. Don't you Americans take off for Christmas?"
PM: "Yes, but not until Christmas. Its only December 12th. Your taking the whole month of December and January for Christmas?"
O:"Yes, of course. You Americans work too hard. You should come over here and see how we celebrate. Takes about a month so we can ease back into the flow of things."
<Jack is the VP>
PM: "Jack wanted this project completed by the end of the year, that is what everyone agreed to."
O:"Yes, I suppose, but my plane is waiting on me. Not to worry, everything will be fine."
<ceo hangs up>
PM: "Oh shit..oh shit..oh shit. What are you going to do!?"
Me: "Me!?..not a darn thing. Better go talk with Jeff."
<Jeff is the VP>
J: "This is unacceptable. You promised this project would only take a few months. I told you there would be consequences for not meeting the deadline."
PM:"But..but...its not our fault."
J: "I don't care about fault. I care about responsibility. I've never had to fire anyone for not meeting a deadline, but .."
Me: "Jeff, they are in Norway and no one is working this project for the next two months. You've known for months about them dragging their asses on this project. We're ready to go. Services have been tested and deployed. Accounting has all the payment routing ready. Only piece missing is theirs."
J: "Oh. OK. Great job guys. I guess we'll delay this project until February."
<leave the office>
PM: "Holy shit I'm glad you were there. I thought I was fired."
Me: "Yea, and that prick would have done it not giving a crap that it's Christmas."
<fast forward to Feb>
O: "Our service provider fell through, so I'm hosting with another company. You guys know PHP? Perl? I don't know what they called it, but it sounded so cool I bought the company."
PM: "You bought what? Are we still working with Z and B?"
O:"Yea, sort of. How's your German? New guy only speaks German."
PM: "Um, uh... no one here speaks German"
O:"Not to worry, I speak German, French, and Italian. I'll be your translator."
PM: "What? French and Italian?"
O: "On my trip to France I connected with a importer who then got me in touch with international shipper in Italy. I flew over there and met a couple really smart guys than can help us out. My new guy only speaks German, J only speaks French, and R speaks Italian, Russian, and a little English. Not to worry, I'm full time on this project. You have my full attention."

We believe the CEO has/had some serious mental issues, including some ADD. He bailed within the first month (took another vacation to Sweden to do some fishing) and left me using Google Translate to coordinate the project. Luckily, by the end, the Norwegian company hired a contractor from England who spoke German and hobbled together the final integration.

I’ve had enough of shitty ISPs. Time to shame them 😈

Here in the UK, we have a company called TalkTalk who treat their customers as whores by not giving a shit and taking all their money.

I have had an ongoing issue for about 9 months now where our internet is more unstable, but also slower. We pay for 72Mbps at which we used to get, but now our internet tops out at 30Mbps if we are lucky. It can be 20Mbps one minute and 7Mbps the next, and I’ve had it drop below 1Mbps for no goddam reason.

I’ve spoken (well, argued) argued to their so called customer service department over phone and live chat explaining the situation and all they’ve done is said “restart your router”, or “we’ll send out a new router, it’s probably a WiFi issue”, or some bullshit like “I’ve ‘changed’ something on my end”. On one conversation with a so called technician, I had to explain how networking actually worded, and and even called a 7Mbps acceptable when we were paying for 10x that!!!!!

The thing that makes it worse is they actually have systems that detect any issues with customers internet lines, but they only alert the customer to the issue through an online portal, telling the customer to call up and get it dealt with rather than passing the info to a tech department and having issues fixed without the customer knowing unless it’s absolutely necessary.

So 9 months in and I still have a fluctuating, unstable internet connection which is slow and overpriced with no tunnel in sight. GIVE ME BACK MY GODDAMN MONEY YOU FUCKING THIEVING BASTARDS.

Last year I was asked to optimize a code in our legacy portal (yet to be replaced with the new portal). The legacy system didn't have a design phase. Straight away went to development by whatever developer available at that time.
It was seriously fucked up.

So I went and had a look at the vanilla PHP code that served data for a datatable.
** I nearly fainted **

A query was done to get data from a table without any joins.
Then for loop to display those data.
Then inside for loop, for every single column that gets data from a related table there's a fucking query.
Eg: select * from users where.... to display username. Then again select * from users where..... to display user's email, then another query for his phone number. Then another query to get service providers name, then another to get their phone number.

I think the guy who did it wrote his first hello world app with a bunch of queries and sent it to production. No one bothered to check until 4 years later when it slowed down like a friggin snail.
I'm surprised it even survived that long.

Nothing makes me not want to take a full-time job at your company more than having to go through IT tickets every quarter year when my password expires to actually change my password. Why have a fucking self-service portal for employees if logging in with an expired password doesn't work and the reset password link tells me that I need to log in to enroll with security questions (???). It feels like these websites are glued together with sticks and spit and there's a million of them each sporting one specific purpose! I have to go through this shit multiple times since I'm an intern and I didn't have access to my account through the course of the semester. Get your fucking shit together!

I've got a kinda basic networking question I can't quite figure out

How does a push notification work?

Like, on an Android app. A good example is an authenticator. Say I don't login to the service for 4 months.

Then, one day, I try to log into the web portal and it prompts me to accept the request on my authenticator app on my phone.

Immediately, there's a push notification on my phone.

Wtf.

Is there a socket open for 4 months? Does it send requests every few seconds for 4 months? I can't imagine that either of these options scale whatsoever: both horrendously waste bandwidth and server connections.

How the fuck does it work? I don't even have the first idea.

holy shit I swear taxes are like the government trying to tell you you're a peasant to them

my medicare card is about to expire and FOR SOME REASON now the process to renew is a fucking interrogation about various documentation the government has given you. before it was just your damned name, date of birth, and a new photo for the card.

evidently they were supposed to send you snail mail 3 months before expiration. evidently also the only way to renew is get this said snail mail.
and evidently I have to go through this "catchall" change your address with everything in the government process
which is a little ironic
because
to use this service you need to give them something called a notice of assessment, which is when the government accepts your taxes they send you back one of those
well I haven't had access to my tax portal for years. I keep filing them and getting excess money back but I can't actually see any of my returns.
so I tried this time
12 pages of verification and more verification... you do one step, it says wrong info because if you have to write in 2,474 well turns out the , fucks it up and your info doesn't match what's on file and if you fail more than 3 times you'll be locked out. repeat. page after page. how many fucking pages are there? what format are they expecting? nobody fucking knows. you'll get to find out if you pass just this one more!
after about 4 hours of this shit
and they have 2 factor authorization now?! wtf.

then this next step is id verification or we snail mail you a code (WHICH AGAIN IS IRONIC)

I chose id. health card doesn't count, it notifies me later. thankfully I have a passport. bad news, passport expires this September so guess who is gonna be having more fun later
the app of course can't use my camera in the browser I have, so I start downloading fucking other browsers and finally hit one that works
also they lied. they also want a selfie. then it tells me I failed to look like myself. if you fail to look like yourself 3 times you are denied.

ok. so I try snail mail. the page says if I revoke consent to id I can go do the snail mailed code. they lied. if you revoke consent it exits the whole wizard. you enter all the verification steps again.

I try to get them to snail mail me the code. they want some basic info they asked me like 16 times now, and a postal code. ironic. well this is the tax people, so by this point I found all my previous sent in tax returns (though I can't access the government's replies). checked. yep. address all the same. put in the postal code. nope. somehow it's wrong. 3 times I put all this random info in in different ways. 5 times and I'm locked out.

now fucking what.

THE FUCKING IRONY OF
I NEED TO CHANGE WHERE I LIVE SO YOU CAN SNAIL MAIL ME SOMETHING
AND TO CHANGE WHERE I LIVE I HAVE TO CONFIRM WHERE I LIVE SO YOU CAN SNAIL MAIL ME SOMETHING FUCKING ELSE

the government just fucking dunks on you

guess we're all not having fucking medical cards anymore. all we do is pay taxes, and can't even see the paperwork to those taxes we pay.

New ad self-service portal too hard to integrate ssl and can't have users send their passwords in plaintext.

Setup apache proxy with ssl in same vpc to encrypt traffic to and from vpc.

All good as long as nobody is in my vpc sniffing traffic...