Our business-critical internal software suite was written in Pascal as a temporary solution and has been unmaintained for almost 20 years. It transmits cleartext usernames and passwords as the URI components of GET requests. They also use a single decade-old Excel file to store vital statistics. A key part of the workflow involves an Excel file with a macro that processes an HTML document from the clipboard.
I offered them a better solution, which was rejected because the downtime and the minimal training would be more costly than working around the current issues.
cleartext usernames and passwords as the URI components of GET requests
I’m not an infrastructure person. If the receiving web server doesn’t log the URI, and supposing the communication is encrypted with TLS, which removes the credentials from the URI, are there security concerns?
Anyone who has access to any involved network infrastructure can trace the cleartext communication and extract the credentials.
What do you mean by any involved network infrastructure? The URI is encrypted by TLS, you would only see the host address/domain unless you had access to it after decryption on the server.
Browser history
Even if the destination doesn’t log GET components, there could be corporate proxies that MITM that might log the URL. Corporate proxies usually present an internally trusted certificate to the client.
I’m not 100% on this but I think GET requests are logged by default.
POST requests, normally used for passwords, don’t get logged by default.
BUT the Uri would get logged would get logged on both, so if the URI contained @username:Password then it’s likely all there in the logs
Get and post requests are logged
The difference is that the logged get requests will also include any query params
GET /some/uri?user=Alpha&pass=bravo
While a post request will have those same params sent as part of a form body request. Those aren’t logged and so it would look like this
POST /some/uri
downtime
minimal retraining
I feel your pain. Many good ideas that cause this are rejected. I have had ideas requiring one big downtime chunk rejected even though it reduces short but constant downtimes and mathematically the fix will pay for itself in a month easily.
Then the minimal retraining is frustrating when work environments and coworkers still pretend computers are some crazy device they’ve never seen before.
The library I worked for as a teen used to process off-site reservations by writing them to a text file, which was automatically e-faxed to all locations every odd day.
If you worked at not-the-main-location, you couldn’t do an off-site reservation, so on even days, you would print your list and fax it to the main site, who would re-enter it into the system.
This was 2005. And yes, it broke every month with an odd number of days.
As weird as it may seem, this might be a good argument in favor of Pascal. I despised learning it at uni, as it seems worthless, but is seems that it can still handle business-critical software for 20 years.
What OP didn’t tell you is that, due to its age, it’s running on an unpatched WinXP SP2 install and patching, upgrading to SP3, or to any newer Windows OS will break the software calls that version of Pascal relies upon.
i worked for a hybrid hosting and cloud provider that was partnered with Electronic Arts for the SimCity reboot.
well half way through they decided our cloud wasn’t worth it, and moved providers. but no one bothered to tell all the outsourced foreign developers that they were on a new provider architecture.
all the shit storm fail launch of SimCity was because of extremely shitty code that was meant to work on one cloud and didn’t really work on another. but they assumed hurr hurr all server same.
so you guys got that shit launch and i knew exactly why and couldn’t say a damn thing for YEARS
Not to put the blame on the devs, but the problems might have been attenuated by defining a proper interface layer against the server.
It’s a damn single player game 💀
The company would bid on government contracts, knowing full well they promised features that didn’t exists and never would, but calculating that the fine for not meeting the specs was lower than the benefit of the contract and getting the buyers locked into our system. I raised this to my boss, nothing changed and I quit shortly after.
I’ve worked in IT consulting for over 10 years and have never once lied about the capabilities of a product. I have said, it doesn’t do that natively, but if that’s a requirement we can scope how much it would take to make it happen. Sadly my company is very much the exception.
The worst I saw was years ago I was working on an infrastructure upgrade of a Hyper-V environment. The client purchased a backup solution I wasn’t familiar with but said it supported Hyper-V. It turns out their Hyper-V support was in “beta”. It wasn’t in beta. They were literally using this client as a development environment. It was a freaking joke. At one point I had to get on the phone with one of their developers and explain how high-availability and fail-over worked.
I could very well have been that developer. Usual story, sales promised the world, that our vmware-based system would run on anything and everything, and of course it’s all HA and load balanced, smash cut to me on Monday morning trying to figure out how to make it do that before it goes live on Wednesday.
eh DHCP isn’t really important right? obviously if it hasn’t changed since the 80’s why would you need to reboot your server.
what are vulnerabilities?
I worked in government contracting (and government, for that matter) for years and that blows my mind. I can’t remember the details, but if you even had a bad reviews, much less being found noncompliant, it could disqualify you entirely from some contract vehicles for a matter of years. Wild that there’s some agency that somehow lets people get away with fraud.
Also, if that cost the government money, there’s a chance you could report that after the fact and make some money.
The contractor I worked for was run by a man who used to say “if the contract says they’ll blow up the contractor on delivery, we’re putting in a bid and solve the problem later”
Promising features that never existed is part and parcel to a lot of software sales, whether gov or private. Speaking from post-sales experience.
There is a million times more counterfeit/fake items at amazon than you think, and they dont care one bit to fix the problem
I recall watching a video about the nature of how things are stored at Amazon warehouses - basically if there are multiple sellers offering the same item it all goes in the same bin. Even if you are providing a genuine product, there’s a very good chance one of the other sellers is not, and that counterfeit gets sent out attached to your seller ID. Then you get a complaint for selling a counterfeit item someone else provided.
Then when that seller is caught and booted, they just register another trademark with 5-10 random characters and do it again. This is causing a massive headache for the US Trademark Office as well.
Having worked for Amazon across multiple facilities. This is not true or at least wasn’t. When stowing everything seemed pretty random for spots. Seemed to be where ever there was space. But the items themselves when not sold directly by Amazon use a different set of numbers than the B00 number I think it is an FBA (fulfilled by Amazon) number.
That being said, just going to the bathroom was enough to tank the rate for day and have to play catch-up. Lunches reset this.
In one facility they caught two people in a Gaylord having some relations. Same facility they found a used sex toy that had biological material.
I wrote a review about a counterfeit item I received. They never approved that one. I haven’t bought cologne from them since.
I bought a bicycle light set (front and rear) a few years ago. They work fine (in fact, I still use the headlight; the rear still works, but it was replaced by a radar light), and I wrote a review. More recently, I was looking back through my purchases, and I came across the review I’d written, but the lights they were now selling on that page were a completely different design than the ones I had.
I edited my review to note that the current lights didn’t match the ones I had, not that it’ll do any good with a million other reviews of those lights. I know Amazon doesn’t really care, but I very often see “There is a newer version of this item available here” links, so I’m surprised that this was possible.
I’ve gone through reviews where it’s not even the same product. 🤬
This is not a secret
I always thought there’s exactly 0 counterfeit/fake items at amazon, so … 0 times million … phew…
/s
I bought a pepper grinder called the Pepper Cannon. Yes, its wonderfully overengineered and costs a fortune. But it’s made in the USA, and they’ve been pretty open with their startup process for making it.
Few months ago I was browsing across amazon and lo and behold, some pepper grinders that look identical to the pepper cannon came up. They were all cheaper knockoffs, selling for a fraction of the cost, and outright stealing PCs industrial design. I didn’t buy one, as I don’t need one and didn’t really care enough to test if the mechanism was the same as the one I bought, but I did drop a line to the pepper cannon guys so they can try to get em delisted
Now I want a Pepper Cannon. Would you recommend getting it, before I ruin my hype by looking up the price or what is actually is? :D
Its really great if you like pepper. It puts out an absolute ton of it, and you’ll find yourself going through way more black pepper than you thought you ever could. And the grind settings are unrivaled; you can get tiny little faerie dusts of pepper, all the way up to big honkin flakes that work great on a steak. Whenever I’m doing a brisket or similar on the smoker, its great to have on hand
Its milled out of a single billet of aluminum, the grinding mechanism js custom built, and the whole thing just screams quality.
And you pay for it. They’re around $200
There’s also a salt cannon, if you want the same sort of thing but built for salt. I got it because I like the matching pair, but you don’t strictly need it; salt is salt, regardless of where it was ground.
It’s what happens when it turns into a marketplace where 3rd party vendors can sell to.
Exactly why I only buy from Amazon when I can’t find it after searching elsewhere for a while.
One of the major issues is counterfeit baby products, specifically sleep products. In the US, sleep spaces for babies are highly regulated. The terms “bassinet, crib, and playard” are terms that can only be used for products that pass rigorous ASTM testing. If something doesn’t complete that testing then they are not allowed to use one of those terms in ads or on their manual. This is why you’ll see many products listed as “loungers” because they’re not safe for sleep. There are hundreds of products online that are horribly made and steal manuals of actual approved products. Amazon is notified (groups I’m in notify them) and they don’t care. There are also products that aren’t knock-off versions of things but just flat out lie and say a product is safe for sleep when it isn’t and will use one of the protected terms - which makes the sale of them illegal.
they dont care one bit to fix the problem
Who is they? Warehouse workers? Because without getting into too many details, I know someone fairly high up at Amazon corporate, and if I recall correctly her colleague runs a whole…divison? I don’t know, largish multi-person unit…and their whole job is addressing the counterfeit problem. I think it’s just really hard to do.
Well the easiest solution is to go back to having Amazon be the seller of products on Amazon, but we all one that ship sailed.
But if the problem is shared bin storage, the solution isn’t free, but it’s also not as expensive as lots of buyer confidence:
Tag every item with a QR code indicating its source when it comes into the distribution center. Use that code to identify the bad actors when there are returns and ban them.
“But what about products not shipped by Amazon?”
In that case, you know who sold and shipped the product, and if they can’t get their shit together they shouldn’t be allowed to work with Amazon.
Amazon has a policy of binning items with the same UPC together, regardless of the source. What this means is if you buy a valid product and any vendor who is part of their warehouse storage system sells counterfeits, then there is a chance of you getting a counterfeit part, regardless of who you buy from. This reduces the number of locations required for a given item. It just requires that you trust your vendors to not counterfeit. If they were kept separate you could easily see who is selling counterfeits, but it would require more space.
So Amazon has traded the ability to sell parts from verifiable vendors for short-term profits. At this point in the game, your best assumption is if there is any knock-off company selling the product you wish to buy you have no way of knowing it it’s legitimate or counterfeit. This is currently diluting their brand and will ultimately impact their sales, if not their profits.
Amazon makes something like 80% of their profit off of Amazon web services. They have no reason to give the tiniest crap about any physical product they will ever sell ever again.
It’s not hard to do it, its hard to do it and make the same amount of money…
Big german TV production company with succesful primetime action series used rented cars for their stunts. Different people from the team rented them with full insurance, returned them crashed. They did this until every car rent in the city stopped offering insurance without retention.
Any chance to get to know which one? :)
This isn’t bound to one production company. Close to every car video prod does this if there’s expected damage.
I quit a well known ecomm tech company a few months ago ahead of (another) one of their layoff rounds because upper mgmt was turning into ultra-wall street corpo bullshit. With 30% of staff gone, and yet our userbase almost doubling over the same period, they wanted everyone to continue increasing output and quality. We were barely keeping up with our existing workload at that point, burnout was (and still is) rampant.
Over the two weeks after I gave my notice I discovered that in the third-party app ecosystem many thousands of apps that had (approved) access to the Billing API weren’t even operating anymore. Some had quit operating years ago, but they were still billing end-users on a monthly basis. Many end-users install dozens of apps (just like people do with mobile phones) and then forget they ever did so. The monthly rates for these apps are anywhere from 3 to 20 dollars per month, many people never checked their bank statements or invoices (when they eventually did, they’d contact support to complain about paying for an app that doesn’t even load and may not have for months or years at this point).
I gathered evidence on at least three dozen of these zombie apps. Many of them had hundreds of active installs, and were billing users for in some cases the past three years. I extrapolated that there were probably in the high-hundreds or low-thousands of these zombie apps billing users on the platform, amounting to high-thousands to low-tens-of thousands of installs… amounting to likely millions per year in faulty and sketchy invoicing happening over our Billing API.
Mgmt actually did put together a triage team to address my findings, but I can absolutely assure you the only reason they acted so quickly is because I was on the way out of the company. I’d spotted things like this in the wild previously and nothing had ever been done about it. The pat answer has always been well people are responsible for their own accounts and invoicing. I believe they acted on this one because I was being very vocal about how it would be ‘a shame’ if this situation ever became public, and all those end-users came after the company for those false invoices at one time. It would be a PR and Support nightmare.
You have definitely interacted with this ecommerce platform if you shop online.
This has GOT to be Shopify
✅️ is a shopping platform
✅️ has an app ecosystem with a billing api
✅️ high probability that someone who shops online has interacted with a store on the platform
✅️ multiple rounds of layoffs w/ staff stretched thin
✅️ unclear ambitions of being a megaplatform, beyond what it already is
I guess we’ll never know, lol
I’m unfortunately dependent upon said company, as a “partner”, which just means a hack indie developer who herds customers to the slaughter for the corp.
The last round of layoffs was a brutal experience for the “Plus” customers. They lost crucial advisers and support, and now the guidance available is a bored and untrained chat support thrall on the other side of the world, or a stochastic parrot.
You can smell the enshittification from here. The vendor lock-in is so intense it seemed inevitable.
You’re absolutely right on all counts. And that’s why I quit (without waiting around to be laid off which frankly the severance package would’ve been nice). I got hired into the first (private) company I applied to, I’m thriving, and I don’t miss that stink of wall street/silicon valley money at all.
Ohhh shit that’s a good one.
I recently de-googled but I completely forgot to check if I had any old app subscriptions. Thank you for indirectly reminding me to do that.
I recently discovered that somehow I set up billing for a VPN directly from the company and also through Google Play. I probably got a renewal email and just followed the instructions. I went back through my bank statements and I’ve been double charged for probably at least 2 years and just never noticed it. It was only about $10 a month. I just feel really stupid for not noticing it until now and it’s entirely my fault. I cancelled the one through Google Play. You live and you learn!
lmfao. Does the VPN company’s name start with a W by any chance? If so, I am very aware of that issue as well. 😂
I guessing it’s Amazon’s old android app store? I remember lots of users having a lot of hope for that app store bringing competition and higher quality app and app store quality. Oh how naive we were.
Name and shame!
just guessing here but sounds like the rain forest company.
I’m guessing that if you have the right kind of Pal, you could figure out a way to Pay them to help you figure it out…
The buildings alarm code was 0711. Guess where I worked…
No way.
Dollar tree?
1-800-got-junk? doesn’t care at all about its environmental impact. No sorting what so ever happens to what goes on their trucks it all goes to landfills. All the ads will say they recycle and that they repurpose old furniture but I was threatened with being fired when I recommended donating antiques instead of dumping a load of furniture.
More jobs and more profits comes before anything else in that company, including employee health and safety. Several times I was told to enter spaces we werent trained for (attics and crawl spaces) and carry waste I legally couldn’t transport (human/organic wastes and the laws states the driver is fined, not the company). One guy injured his shoulder during an attic job and was told to finish the shift or lose his job. Absoulte scum of a company with very sleazy management and possibly the labour board in their pocket as they kept “losing the files” when I tried to file a report with buddy’s shoulder (he was hesistant to report for fear of losing his job).
I’ve had a few friends work for them out in Montreal, and their parent company (2 Men and a Truck). According to them it’s a mob-operated business.
Oh no! I had a great experience with 2 men and a truck when I he used them! No idea it was associated with the 1 800 junk folks
Thats painful to read
I worked for for the railroad. Nothing is fixed ever. I witnessed hundreds of code violations every day for years. Doesn’t matter if a rail car or locomotive meets code as long as it “can travel” its good to go.
When an employee inspector finds a defective rail car management determines if it will get fixed. If the supervisor “feels” like “it’s not that bad” then the rail car is “let go”.
Oh, so like ambulances in the USA.
“The ambulance had issues making it unsafe (or even illegal) to drive? But it can still drive down the road? Doesn’t seem too bad: keep an eye on it.”
You’d think they’d have money to keep it pristine, with how much a short ambulance ride costs in the USA
Just like hospitals, that money is going straight to the top and staying there.
With the amount of money a 3 mile ambulance trip costs, you could buy a beater car and drive yourself there.
A lot of US freight railroads seem to love to manage themselves into the ground.
US? Or somewhere else? Not saying that it doesn’t happen other places just curious.
The use of ‘railroad’ instead of ‘railway’ would seem to indicate American English
What do they call those in other countries?
If I had to guess, ‘railway’.
There’s three ways to do a job. The right way, the wrong way, and the rail way. Also it was the great white north!
I worked for a furniture store. They used to buy mattresses and furniture sets for like $200-300 and arbitrarily sell them for around $700-1000. I used to be able to haggle with people and still sell them for like double what they cost. I hated that job for so many reasons
Used to work in garden/hardware supply company. The best selling product cost $16 for manufacturing and delivery to our warehouse from China. They would sell in [national hardware chain] for $699. It was about a 40% markup in store, the rest of that $699 was eaten up by warehousing, shipping and staffing costs. If you couldn’t move that product in a reasonable timeframe then you’d start losing money on warehouse costs.
I figure most items I’ve purchased are 40% profit, 50% warehouse/shipping/staffing, 10% manufacturing/import.
We used to live near a furniture store. It had a going out of business sale when we moved in. The sale was still going on when we moved out 6 years later. Then I started noticing how many other furniture stores seemed to be having going out of business sales.
I work in IT. Most systems have laughable security. Passwords are often saved in plain text in scripts or config files. I went to a site to help out a very large provincial governmental organization move some data out of one system and into another. They sat me down with a loaner laptop and the guy logged me into his user account on the server. When I asked for escalated privileges, he told me he’d go get someone who knew the service account passwords.
After a few minutes, I started poking around on my own… And had administrative access within an hour. I could read the database (raw data), access documents, start and stop the software, plus, figured out how to get into the upstream system that fed data to this server… I was working on figuring out the software’s admin password when the guy came back. I’m sure that given some more time, I could have rooted the box because the OS hadn’t been updated in years.
Having worked network support, the number of times I’ve been on a screen share with someone who opens an excel sheet from the share drive that holds all the root passwords for every network device they own is high. A bad actor could take down some very large companies with some simple social engineering skills.
I work as a pentester and Red Teamer, I can attest that even for some large companies, you always stumble upon something that’s just dumb, and completely renders their multi-million investment they are probably making into security tools and solutions worthless.
Health insurance company I worked for would automatically reject claims over a certain amount without reviewing them. Just to be dicks and make people have to resubmit. This was over 25 years ago, but it’s my understanding many health insurers still pull this shit. They don’t care if it’s legal or not. Enforcement is lazy and fines are cheaper than medical claims.
Obviously this is in the USA.
We need a whole branch of government dedicated to fucking with insurance companies. They basically generate free money by having money, they don’t actually provide any net positive outside of just having money
We need to move to single payer healthcare and just eliminate the need for insurance companies.
Here is an alternative Piped link(s): https://piped.video/watch?v=-wpHszfnJns
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source, check me out at GitHub.
How does this work? Had someone already uploaded it to an instance of peertube?
From what I can understand, it’s just youtube with another frontend (i.e. it’s an app that shows youtube content)
That’s pretty much the only BDG video I couldn’t finish. Too dark. Everything else has been delightful
I did finish it but I need like at the beginning without understandong anything. Lucky for me I am not in USA.
I don’t think I’ve finished it either tbh
Everything comes in frozen. Before mixing with the sauces it smells off. Half the staff mix without gloves. Dont get the tuna but have it your way…
Working at the morgue must have been tough
An uncle of mine ran a funeral home. He and his staff took hygiene freaken seriously.
I used exclusively go into subway for the tuna sandwich…
Anybody knows that one waterfall attraction in the Southeast US? The one that advertises bloody everywhere? Waterfall is pumped during the dry seasons, otherwise there’d be nothing to see. Lots of the formations are fake, and the Cactus and Candle formation was either moved from a different spot in the cave, or is from a different cave in New Mexico. Management doesn’t want people to know that, but fuck 'em.
Ruby Falls?
After looking it up, you can find reports from others stating the same things. When I was there as a kid, I remember that they claimed no one knew where the source of the water came from… I guess they actually know enough to help it out at least, lol
I really enjoyed it and would like to go again, but it’s no Mammoth Cave.
Ye!
The first steel mill I worked for, the test requirements were more of a suggestion than a rigid specification. I, a trained and skilled engineer with the capacity to make informed decisions, had to run all rejections by my boss who would tell me “it’s close enough” even if it wasn’t. Sometimes it bit us in the ass with warranty failures, but the warranties were probably cheaper than internal rejections (and what is brand perception worth?).
My second steel mill job, I was the one making the rejection decisions. I did the hard thing and rejected our failures but I also troubleshot them to prevent recurrence, making our product and capability better over time.
It very much matters who you buy your steel from; two mills can have vastly different performance for the same products based on how they handle these situations.
A lot of companies seems to do that a lot, cut corners on the quality a little bit, push out the extra reserve capacity, etc. Then when a complaint occurs y’all quality engineers get the short end of the stick. What doesn’t cost the company costs us more time, effort, mental and physical health.
I’m curious: is this a major lawsuit waiting to happen, or is the mill somehow protected from that?
I’m picturing a situation where bad steel is provided, used by the purchaser, and later the product they put the steel in fails, causing a serious accident, death, or other severe issue. does the mill’s responsibility somehow end at warranty replacement or have they created a bigger liability for themselves?
This is indeed illegal and immoral. Example.
Elaine thomas did this, lied to her bosses, and the industry. People even considered her an expert. Reading the usdoj interviews with her, she may have just been arrogant, and kinda dumb.
Section 54 of the complaint against Elaine Thomas
During the November 19, 2019 interview, THOMAS criticized the -100F Charpy V-notch test. THOMAS said -100 F was a “stupid number” to test because nothing operated at -100 F in the water. She also admitted, however, she did not know the Navy’s reasoning for testing at this temperature. THOMAS acknowledged that someone at Bradken had been changing failing -100F Charpy V-notch testing results to passing. THOMAS also admitted that she could have been the one to raise the numbers because she believed the -100F Charpy V-notch testing was "a stupid stupid requirement. When asked why she raised the yield strength numbers for the 1990 heat, THOMAS stated, “It looks like I raised the numbers to make it pass. This was not the right thing.” THOMAS said occasionally she would consider rounding up -100F Charpy V-notch results if the numbers were “super duper” close to passing.>
