*Disclaimer: Stolen from Reddit & original tweet link https://twitter.com/ladygaga/... *

Everything has to have MAC-Addresses. EVERYTHING!

(yes, I know. That's not one. But similar)
(stolen from https://twitter.com/istar_nil/...)

Previously on devrant
https://www.devrant.io/rants/455085

This little shit is actually worried about her ideas getting stolen.

Do you think she'll pay me in stocks or pennies?

#INB4itsAShitIdea

I’m back for a fucking rant.

My previous post I was happy, I’ve had an interview today and I felt the interviewer acted with integrity and made the role seem worthwhile. Fuck it, here’s the link:
https://www.devrant.io/rants/889363

So, since then; the recruiter got in touch: “smashed it son, sending the tech demo your way, if you can get it done this evening that would be amazing”

Obviously I said based on the exact brief I think that’s possible, I’ll take a look and let them know if it isn’t.

Having done loads of these, I know I can usually knock them out and impress in an evening with no trouble.

Here’s where shit gets fucked up; i opened the brief.

I was met with a brief for an MVP using best practice patterns and flexing every muscle with the tech available...

Then I see the requirements, these fucking dicks are after 10 functional requirements averaging an hour a piece.

+TDD so * 1.25,
+DI and dependency inversion principle * 1.1
+CI setup (1h on this platform)
+One ill requirement to use a stored proc in SQL server to return a view (1h)
+UX/UI design consideration using an old tech (1-2h)
+unobtrusive jquery form post validation (2h)
+AES-256 encryption in the db... add 2h for proper testing.

These cunts want me to knock 15-20h of Work into their interview tech demo.

I’ve done a lot of these recently, all of them topped out at 3h max.

The job is middling: average package, old tech, not the most exciting or decent work.

The interviewer alluded to his lead being a bit of a dick; one of those “the code comes first” devs.

Here’s where shit gets realer:
They’ve included mock ups in the tech demo brief’s zip... I looked at them to confirm I wasn’t over estimating the job... I wasn’t.

Then I looked at the other files in the fucking zip.

I found 3 of the images they wanted to use were copyright withheld... there’s no way these guys have the right to distribute these.

Then I look in the font folder, it’s a single ttf, downloaded from fucking DA Font... it was published less than 2mo ago, the license file had been removed: free for Personal, anything else; contact me.

There’s no way these guys have any rights to this font, and I’ve never seen a font redistributed legally without it’s accompanying licence files.

This fucking company is constantly talking about its ethical behaviours.

Given that I know what I’m doing; I know it would have taken less time to find free-for-commercial images and use a google font... this sloppy bullshit is beyond me.

Anyway, I said I’d get back to the recruiter, he wasn’t to know and he’s a good guy. I let him know I’d complete the tech demo over the weekend, he’s looked after me and I don’t want him having trouble with his client...

I’ll substitute the copyright fuckery with images I have a license for because there’s no way I’m pushing copyright stolen material to a public github repo.

I’ll also be substituting the topic and leaving a few js bombs in there to ensure they don’t just steal my shit.

Here’s my hypotheses, anyone with any more would be greatly welcomed...
1: the lead dev is just a stuck up arsehole, with no real care for his work and a relaxed view on stealing other people’s.
2: they are looking for 15-20h free work on an MVP they can modify and take to market
3: they are looking for people to turn down this job so they can support someone’s fucking visa.

In any case, it’s a shit show and I’ll just be seeing this as box checking and interview practice...

Arguments for 1: the head told me about his lead’s problems within 20mn of the interview.
2: he said his biggest problem was getting products out quickly enough.
3: the recruiter told me they’d been “picky”, and they’re making themselves people who can’t be worked for.

I’m going to knock out the demo, keep it private and protect my work well. It’s going to smash their tits off because I’m a fucking great developer... I’ll make sure I get the offer to keep the recruiter looked after.

Then fuck those guys, I’m fucking livid.

After a wonderful interview experience and a nice introduction to the company I’ve been completely put off...

So here’s the update: if you’re interviewing for a shitty middle level dev position, amongst difficult people, on an out of date stack... you need people to want you, don’t fuck them off.

If they want my time to rush out MVPs, they can pay my day rate.

Fuuuuuuuuck... I typed this out whilst listening to the podcast, I’m glad I’m not the only one dealing with shit.

Oh also; I had a lovely discriminatory as fuck application, personality test and disability request email sent to me from a company that seems like it’s still in the 90s. Fuck those guys too, I reported them to the relevant authorities and hope they’re made to look at how morally reprehensible their recruitment process is. The law is you don’t ask if the job can be done by anyone.

Long rant ahead.. 5k characters pretty much completely used. So feel free to have another cup of coffee and have a seat 🙂

So.. a while back this flash drive was stolen from me, right. Well it turns out that other than me, the other guy in that incident also got to the police 😃

Now, let me explain the smiley face. At the time of the incident I was completely at fault. I had no real reason to throw a punch at this guy and my only "excuse" would be that I was drunk as fuck - I've never drank so much as I did that day. Needless to say, not a very good excuse and I don't treat it as such.

But that guy and whoever else it was that he was with, that was the guy (or at least part of the group that did) that stole that flash drive from me.
Context: https://devrant.com/rants/2049733 and https://devrant.com/rants/2088970

So that's great! I thought that I'd lost this flash drive and most importantly the data on it forever. But just this Friday evening as I was meeting with my friend to buy some illicit electronics (high voltage, low frequency arc generators if you catch my drift), a policeman came along and told me about that other guy filing a report as well, with apparently much of the blame now lying on his side due to him having punched me right into the hospital.

So I told the cop, well most of the blame is on me really, I shouldn't have started that fight to begin with, and for that matter not have drunk that much, yada yada yada.. anyway he walked away (good grief, as I was having that friend on visit to purchase those electronics at that exact time!) and he said that this case could just be classified then. Maybe just come along next week to the police office to file a proper explanation but maybe even that won't be needed.

So yeah, great. But for me there's more in it of course - that other guy knows more about that flash drive and the data on it that I care about. So I figured, let's go to the police office and arrange an appointment with this guy. And I got thinking about the technicalities for if I see that drive back and want to recover its data.

So I've got 2 phones, 1 rooted but reliant on the other one that's unrooted for a data connection to my home (because Android Q, and no bootable TWRP available for it yet). And theoretically a laptop that I can put Arch on it no problem but its display backlight is cooked. So if I want to bring that one I'd have to rely on a display from them. Good luck getting that done. No option. And then there's a flash drive that I can bake up with a portable Arch install that I can sideload from one of their machines but on that.. even more so - good luck getting that done. So my phones are my only option.

Just to be clear, the technical challenge is to read that flash drive and get as much data off of it as possible. The drive is 32GB large and has about 16GB used. So I'll need at least that much on whatever I decide to store a copy on, assuming unchanged contents (unlikely). My Nexus 6P with a VPN profile to connect to my home network has 32GB of storage. So theoretically I could use dd and pipe it to gzip to compress the zeroes. That'd give me a resulting file that's close to the actual usage on the flash drive in size. But just in case.. my OnePlus 6T has 256GB of storage but it's got no root access.. so I don't have block access to an attached flash drive from it. Worst case I'd have to open a WiFi hotspot to it and get an sshd going for the Nexus to connect to.

And there we have it! A large storage device, no root access, that nonetheless can make use of something else that doesn't have the storage but satisfies the other requirements.

And then we have things like parted to read out the partition table (and if unchanged, cryptsetup to read out LUKS). Now, I don't know if Termux has these and frankly I don't care. What I need for that is a chroot. But I can't just install Arch x86_64 on a flash drive and plug it into my phone. Linux Deploy to the rescue! 😁
It can make chrooted installations of common distributions on arm64, and it comes extremely close to actual Linux. With some Linux magic I could make that able to read the block device from Android and do all the required sorcery with it. Just a USB-C to 3x USB-A hub required (which I have), with the target flash drive and one to store my chroot on, connected to my Nexus. And fixed!

Let's see if I can get that flash drive back!

P.S.: if you're into electronics and worried about getting stuff like this stolen, customize it. I happen to know one particular property of that flash drive that I can use for verification, although it wasn't explicitly customized. But for instance in that flash drive there was a decorative LED. Those are current limited by a resistor. Factory default can be say 200 ohm - replace it with one with a higher value. That way you can without any doubt verify it to be yours. Along with other extra security additions, this is one of the things I'll be adding to my "keychain v2".

So I have seen this quite a few times now and posted the text below already, but I'd like to shed some light on this:

If you hit up your dev tools and check the network tab, you might see some repeated API calls. Those calls include a GET parameter named "token". The request looks something like this: "https://domain.tld/api/somecall/..."

You can think of this token as a temporary password, or a key that holds information about your user and other information in the backend. If one would steal a token that belongs to another user, you would have control over his account. Now many complained that this key is visible in the URL and not "encrypted". I'll try to explain why this is, well "wrong" or doesn't impose a bigger security risk than normal:

There is no such thing as an "unencrypted query", well besides really transmitting encrypted data. This fields are being protected by the transport layer (HTTPS) or not (HTTP) and while it might not be common to transmit these fields in a GET query parameter, it's standard to send those tokens as cookies, which are as exposed as query parameters. Hit up some random site. The chance that you'll see a PHP session id being transmitted as a cookie is high. Cookies are as exposed as any HTTP GET or POST Form data and can be viewed as easily. Look for a "details" or "http header" section in your dev tools.
Stolen tokens can be used to "log in" into the website, although it might be made harder by only allowing one IP per token or similar. However the use of such a that token is absolut standard and nothing special devRant does. Every site that offers you a "keep me logged in" or "remember me" option uses something like this, one way or the other. Because a token could have been stolen you sometimes need to additionally enter your current password when doings something security risky, like changing your password. In that case your password is being used as a second factor. The idea is, that an attacker could have stolen your token, but still doesn't know your password. It's not enough to grab a token, you need that second (or maybe thrid) factor. As an example - that's how githubs "sudo" mode works. You have got your token, that grants you more permissions than a non-logged in user has, but to do the critical stuff you need an additional token that's only valid for that session, because asking for your password before every action would be inconvenient when setting up a repo

I hope this helps understanding a bit more of this topic :)
Keep safe and keep asking questions if you fell that your data is in danger
Reeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

Necessary context for this rant if you haven't read it already: https://devrant.com/rants/2117209

I've just found my LUKS encrypted flash drive back. It was never stolen.. it somehow got buried in the depths of my pockets. No idea how I didn't look into my jacket for the entire time since that incident happened... But I finally found it back. None of my keys were ever compromised. And there's several backups that were stored there that have now been recovered too. Time to dd this flash drive onto a more permanent storage medium again for archival. Either way, it did get me thinking about the security of this drive. And I'll implement them on the next iteration of it.

For now though.. happy ending. So relieved to see that data back...

Full quality screenshot: https://nixmagic.com/pics/...

This is a follow-up of my last rant: https://devrant.com/rants/1323422/...

TLDR; My step-son tripped over my HDD power cord, sending it plummeting towards certain death.

So this is just over a year ago. At this point, my GF and I are married, and she's about 7 months pregnant with our daughter. Her son, Nicolas - the one from the last rant - is 13 years old.

So it was a Saturday, and I had Nicolas helping me to clean up the apartment. My wife was off the hook, because, ya know - she's pregnant.

While I was cleaning the living room, I had Nic cleaning the kitchen/dining room area. At this same time, I had my laptop and a 3Tb external USB hard drive on the dining room table, copying a bunch of data or something. This external HDD also had it's own power cord, which was plugged in next to the table.

Next thing I know, I hear an "Ohp!" followed by a crash. It was the horrifying sound of my hard drive plunging 36 inches off the table towards certain death. And death, it had.

Before even checking, I knew this HDD was dead. It took a lot for me not to snap at the kid. I told him to get out of the kitchen and go clean his room. That hard drive... hadn't been backed up. At all, which is on me. Even more so, since that data was really irreplaceable.

Even knowing that the HDD HAD to be dead, I still plugged it in, hoping for a miracle. I got nothing, it wouldn't even spin up.

$ dmesg -w

Showed that linux saw the USB controller and even the HDD controller (it printed out the manufacturer, SeaGate). The data was valuable enough that I was saving up some money to have the data recovered, which would be about $2,000.

However, before I had saved up enough money... My apartment was broken into and all my external HDD's (and some internal ones I had laying around) were stolen.

Stolen from twitter

https://twitter.com/kashthefuturist...

Tldw: f*cking people - nelson mandela

!rant

Bit of a shameless plug but...

I've been making Crypton.sh as my side project for the past couple of months and it's now ready for public consumption. Crypton.sh is a secure and encrypted SMS messaging solution in the cloud, with its original purpose to be a 2FA mobile number that cannot be stolen like a SIM card can be, the idea came about when someone I knew has their SIM card stolen via a SIM card swap scam (https://bbc.co.uk/news/...).

Originally it came about as that idea but grew into something bigger, now everything is encrypted and you can also have conversations with other people, but I'm testing things from time to time and more can follow. Crypton.sh makes sure that you can no longer worry about your SIM card being stolen by malicious hackers, or having a second account on Whatsapp, Telegram, Signal, Google and others.

r/Unixporn in a nutshell

Shamelessly stolen from reddit
(https://redd.it/5tzzck)

Has anyone read the latest rant from Microsoft?

https://blogs.microsoft.com/on-the-...

<<Finally, this attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem. This is an emerging pattern in 2017. We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world. Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage.>>

Not mine, but absolutely essential rant:

https://gizmodo.com/programming-suc...

One portion:

"You start by meeting Mary, project leader for a bridge in a major metropolitan area. Mary introduces you to Fred, after you get through the fifteen security checks installed by Dave because Dave had his sweater stolen off his desk once and Never Again. Fred only works with wood, so you ask why he's involved because this bridge is supposed to allow rush-hour traffic full of cars full of mortal humans to cross a 200-foot drop over rapids. Don't worry, says Mary, Fred's going to handle the walkways. What walkways? Well Fred made a good case for walkways and they're going to add to the bridge's appeal. Of course, they'll have to be built without railings, because there's a strict no railings rule enforced by Phil, who's not an engineer. Nobody's sure what Phil does, but it's definitely full of synergy and has to do with upper management, whom none of the engineers want to deal with so they just let Phil do what he wants. Sara, meanwhile, has found several hemorrhaging-edge paving techniques, and worked them all into the bridge design, so you'll have to build around each one as the bridge progresses, since each one means different underlying support and safety concerns. Tom and Harry have been working together for years, but have an ongoing feud over whether to use metric or imperial measurements, and it's become a case of "whoever got to that part of the design first." This has been such a headache for the people actually screwing things together, they've given up and just forced, hammered, or welded their way through the day with whatever parts were handy."

I just realized this is the dumbest marketing stunt McDonald's can come up with

https://thrillist.com/news/nation/...

The card is actually a phone case with your name etched into it.

1. How do I use it if I'm ordering online?
2. Why is the prize meant to encourage mobile ordering a physical card to use in stores?
3. So every time the winner takes out their phone, s/he is just asking to get mugged or have it stolen?

!rant

This is fucking how you do it!

Ticketmaster UK had a "data security incident" where they don't really know if any data was actually leaked/stolen/"accessed by an unknown third-party" — their response:

1. Disable the compromised service across their platforms
2. Send a mail to any customer that may have been affected (I got one in Danish because I had only interacted with them through a Danish subsidiary)
2b. All notified customers have their passwords reset and must go through the "Forgot password" process; the _temporary_ password they sent me was even pretty nicely random looking: ";~e&+oVX1RQOA`BNe4"
3. Do forensics and security reviews to understand how the data was compromised
3b. Take contact to relevant authorities, credit card companies, and banks
4. Establish a dedicated website (https://security.ticketmaster.co.uk/...) to explain the incident and answer customer questions
5. "We are offering impacted customers a free 12 month identity monitoring service with a leading provider. To request this service please visit [this page]"

EDIT: As mentioned and sourced in the first comment, the breach was apparently noticed by a banking provider and reported to Ticketmaster on the 12th of April and later to Mastercard on the 19th of April.
Ticketmaster's internal investigation found no evidence of breach (which makes sense, as it wasn't an internal breach), but when Mastercard issued an alert to banks about it on the 21st of June, Ticketmaster followed up by finding the actual breach and disabling the breached third party service on the 23rd of June.

I still think they did the right thing in the right way...