131–140 of 243 posts
Gradebusters / Making the Grade, or something with names like that, used to use a Java applet to "secure" the web site with student grades. You could just download the applet and decompile it to figure out their trivial encoding of the IDs and PINs (which were just params in the HTML). Or you could figure out just an ID (typically a student ID number, although more than a few were social security numbers, apparently)…
In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then somet…
This story almost had me in tears (a mix of schadenfreude and shame for my profession). I hope they learned something not to give business critical work to college students. Makes me think that IT Risk management should be right at the top of what MBAs have to learn.
I've once come across: if (!Boolean.FALSE.equals(aBoolean)) { // ... } I was pretty baffled.
I've seen undergrads trying to write Ada: case x is when true => y; when others => z; end case; You know, so the code doesn't stop compiling when someone comes along and adds values to the Boolean type.
Clearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.
Earlier quoted context omitted.
Not necessarily. They may be using a reversible hash. Not much more secure, but it beats plaintext.
Yeah, maybe they just look up the MD5 hash on http://md5.gromweb.com/ and sent him the result. I used that site to show my boss his plaintext password to explain why MD5 alone is barely more than security though obscurity when trying to convince him that we needed to salt them as well - he agreed with me on the spot.
So I had gotten tired of people forgetting their single-english-word passwords and making me overwrite their MD5 hashed password to a known-value that mapped to something like "password123" (yes, no salting for the hashes). So instead of manually resetting the password in the database all the time, I banged out a small web app that ran on my machine for printing every user and reversing all of their MD5 hash'd passwords. It didn't work for the ones who had chosen actual, random strings for their passwords, but that was maybe 1% of cases.
And then I shared the IP address to my machine as a link for every other engineer in the company (all 3 of them). One of the other engineers freaked out that I had "exposed" the passwords, but as far as I was concerned, the passwords were already exposed. He shut up when I pointed out that the work was done and that I had other things to do, things that were his responsibility but he couldn't do because he had a habit of taking on too much work.
From that point on, any time I had more than 2 repetitions to do something, I'd write the most basic of web app to do it, and I'd shove it onto that little server on my machine. The future repetitions would invariably come in and I'd save tons of time not doing it the manual way.
Seriously, this was easy stuff. Don't take this to mean I'm bragging about it. I'm mentioning it because it is so simple and so obvious of work to do in these cases, and it eventually got me fired. I made the mistake of trying to get credit for the work I did, for saving the company time, freeing myself up to do other work, and all the CEO could see was that I was no longer able to charge 3 hours to create new accounts in the system now that it took less than a minute through my admin app. "Wasn't bringing enough value to the company." One of my reports found a quarter million dollars in lost licensing revenue. Wasn't bringing enough value to the company.
So it's not just programmers who can be grossly incompetent. Oh, they certainly can be, I've had to clean up my fair share of systems. But I've found far more often that systems are bad because the programmer's manager was an asshole idiot who made unreasonable demands and forced the programmer to make compromises. Maybe that programmer wasn't the best programmer, but nobody can do as good of work as they are capable in that situation.
Earlier quoted context omitted.
What's worse is when fake delays are put into the code because (stupid) people think that the computer can't possibly be doing a good job if it retrieves the results in under a second. If it's "thinking", it's working well!
I thought the fake delays were so the programmer could cash in on doing optimisations at a later date.
Earlier quoted context omitted.
How did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authentication, not just JS. Just because GoogleBot won't crawl your PUT requests doesn't mean others won't -- including users (malicious or otherwise)! Just sayin'.
If I recall correctly the code looked something like this: if (!admin()) echo " window.location = '/signin'; "; delete_bid($_GET['bid_id']); ?>
In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then somet…
The first time someone wanted to hire me was even before I started college. "so how much will you bill me?" "Well right now I get 7€ (9.2$ at current rate) for unloding trucks ..." He interupted me before I could finish the sentence and demand 8€. "I can not pay you 7€! taht is just to much!" Sooooo I declined but someone took the job ... for under 8$ an hour. How much quality can you expect for that price???
Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…
> hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP. That's pretty unfair to people coming from history or psychology who actually can write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.