Fucking awesome. The 'encryption backdoor law' in Australia went through!

Now, whenever served with such warrants, companies which are active in Australia will have to pay hefty fines if they don't give encrypted messages to law enforcement in readable form. No matter whether this means just decrypting it with the keys they have or pushing backdoors/inject code into the messaging apps/services in order to extract the contents.

Now let's see how much the big companies really care about their users! (I'd expect them to pull out of Australia but the chance that this'll happen is as tiny as about nothing)

Confessions of a Programmer

#1
If a client is an unbearable asshole during the initial communication, I look for every excuse to pad on the hours for the estimate to get paid more. If a client goes above and beyond in their douchbaggery, I tack on an additional $40/hour.

#2
Sometimes I will present an elaborate solution to a client, but really I'm just reading off the features of a plugin or library I'm going to download or buy after the call. Not because I can't build it myself, but because I'd rather spend more time on other/my own projects.

#3
Clients assume because I know one language, I know them all. Rather than turning down the work, I take a crash course to work in that language, or outsource the work and clean it up afterwards, whichever is more practical at the time.

#4
I use cPanel on a dedicated to manage our client websites. I'm not paid enough to bother with setting up everything manually.

#5
Certain projects I build have a 3-day backdoor built into it. If the client doesn't pay upon completion, a unique hash triggered as a GET variable deletes a core file in my work, rendering the work useless. If it wasn't triggered by the 4th day, the file allowing me to trigger this backdoor is removed. This is only used for clients where the project must be launched on their servers, or if there has been a previous issue collecting payment.

#6
I slip in the initial contract that all preceeding phone calls will be monitored and recorded, and that they acknowledge the recordings are admissable in court. This has saved me from losing money twice now.

#7
I have never used an IDE. (I know, I know, it's really inefficient and dumb, but I'm just more comfortable with Sublime. Plus I often find myself mobile and without my computer, so I have to program from my phone.)

#8
Each day resembles a betting spectacle of which work will be late, which will be rushed out and which will never see the light of day.

#9
I have used "sick" and "family emergency" as an excuse to just sleep in far more than I can count.

#10
When a client from hell crosses over the line in their conduct (such as getting very nasty and personal, or sending threats), I anonymously report them to the BBB and on RipOffReport.

I. FUCKING. HATE. MOBILE. DEVELOPMENT.

I already manage the data, devops, infra, and most of the backend dev.

We had a mobile guy. He was great. I never had to think about it and kept moving quickly on my work. #SpecializationOfLaborFTW

He left. Why? Because they wouldn't give him a small raise despite being one of the best mobile engineers in the firm. WTF.

I made the mistake of picking up just enough slack on this workflow in the interim such that I'm, apparently, the fucking god-damned release manager, fixer of pipelines, fixer of build configs, fixer of anything where someone just needs to RTFM for a half-hour to not fucking break things.

Now, 8 months later...and, apparently, Fortune 500 companies are too fucking god-damned cheap to pay for someone who actually knows WTF they're doing for a very reasonable thing to have at least one dedicated set of eyes for.

I never wanted to be a mobile dev.
I never will want to be a mobile dev.
And I certainly don't want to manage your HALF-FACE-FUCKED detached expo configs.

There's a reason I never intentionally involved myself in mobile. All the way down, it's just shitty cross-compilation, transpilation, dependency-hell, brittle-as-fuck build processes so we can foot-gun and mouth-gun react-native and expo and babel and whatever the fuck else cargo-culted horseshit into the wild.

And why? What's the actual fucking root cause? The biggest white elephant that ever fucking elephant-ed? It's because Apple and Google decided to never collaborate on a truly-native cross-platform SDK--where engineers could write native code that compiles to native binaries that's simply write-once, run-everywhere. They know they could have done that, and they didn't. So what'd they get back? Expo--a too-cleverly-designed backdoor/hack--more-or-less a way to circumvent the sane release process software has usually followed: code -> executable -> deploy. Or code -> deploy (for interpreted langs). Expo's like "keep your same executable, we're just gonna to do updates by injecting new code into it whenever we want". Didn't we learn anything with web? Shit gets messy real quick? Not to mention: HEY EXPO, WE WERE ALREADY BUILDING NATIVE APPS, YOU SHORT-SIGHTED FUCKS. THANKS FOR LURING OUR CTOs INTO FORCING EXPO DOWN OUR THROATS W/ THE IMPLICIT (BUT INCORRECT) TOO-GOOD-TO-BE-TRUE PROMISE THAT WE CAN HAVE WRITE-ONCE, RUN-ANYWHERE WITHOUT ANY BUY-IN OR COOPERATION FROM THE ACTUAL TARGET PLATFORMS.

And, we just, like, accept this? We all know it's garbage engineering. The principles we learned in the classroom aren't just academic abstractions--they actually yield real-world results--and eschewing them yields real-world failures. Expo is tightly-coupled to high-heaven, with leaky abstractions six-ways-to-christmas, chock-full of foot-guns, and fails the most basic test of quality: does it, "just work?"

Expo is fucking shameful and it should fucking die. Its promises are too bold, its land-mines too many, its future-proof-ness is alway, always, always questionable as fuck and a risk to every project that uses it.

You want a rant? This is my fucking venue, 'tis not? Well, then this is a piss and vinegar rant straight from my blood-red, beating fucking heart:

EXPO FUCKING SUCKS. AND IF YOU'RE A FAN, YOU FUCKING SUCK TOO.

Facebook publicly announced that it won't build a backdoor into its services for the intelligence agencies as for the latest requests to weaken/remove the encryption.

I can only imagine the intelligence agencies going like this now:

NSA director: Alright, as expected they said no so they won't have more damage to their public image, lets go for plan A 2.0!
NSA employee: Aaaand that is?
NSA director: Serve them a FISA court order requiring them to do this shit anyways but also serve a gag order so they can't tell legally.
NSA employee: Ahh, fair enough, I'll get that rolling. By the way, how did we do this with WhatsApp's encryption again?
NSA director: Oh that one was simple. There's a backup function which nearly everyone uses on either Android/iOS which does plaintext backups to Google Drive/iCloud.
NSA employee: Oh, okay. How do we access that data again?
NSA director: PRISM/XKeyScore!
NSA employee: Right, but then still the issue of how we even collect the encrypted messages from Facebo...
NSA director: PRISM/XKeyScore as well, don't worry about that.
NSA employee: But, how'd we justify this....?
NSA director: We probably never have to as these programs operate outside of the public view but otherwise just call terrorism/pedophelia... BAM, done.
NSA employee: Gotya, let's put this into motion!

I'm watching TV and I just heard something along the lines of "The files have been wiped from the server and there was no sign of a DDOS attack. Whoever erased those files had a backdoor.".

Today was my last day of work, tomorrow i have officially left that place. It's a weird feeling because i'm not certain about the future.
The job was certainly not bad, and after all i read on devrant i'm beginning to believe it was one of the better ones. A nice boss, always something to eat/drink nearby, a relaxed atmosphere, a tolerance for my occasionally odd behaviour and the chance to suggest frameworks. Why i would leave that place, you ask? Because of the thing not on the list, the code, that is the thing i work with all the time.

Most of the time i only had to make things work, testing/refactoring/etc. was cut because we had other things to do. You could argue that we had more time if we did refactor, and i suggested that, but the decision to do so was delayed because we didn't have enough time.

The first project i had to work on had around 100 files with nearly the same code, everything copy-pasted and changed slightly. Half of the files used format a and the other half used the newer format b. B used a function that concatenated strings to produce html. I made some suggestions on how to change this, but they got denied because they would take up too much time. Aat that point i started to understand the position my boss was in and how i had to word things in order to get my point across. This project never got changed and holds hundreds of sql- and xss-injection-vulnerabilities and misses access control up to today. But at least the new project is better, it's tomcat and hibernate on the backend and react in the frontend, communicating via rest. It took a few years to get there, but we made it.
To get back to code quality, it's not there. Some projects had 1000 LOC files that were only touched to add features, we wrote horrible hacks to work with the reactabular-module and duplicate code everywhere. I already ranted about my boss' use of ctrl-c&v and i think it is the biggest threat to code quality. That and the juniors who worked on a real project for the first time. And the fact that i was the only one who really knew git. At some point i had enough of working on those projects and quit.

I don't have much experience, but i'm certain my next job has a better workflow and i hope i don't have to fix that much bugs anymore.
In the end my experience was mostly positive though. I had nice coworkers, was often free to do things my way, got really into linux, all in all a good workplace if there wasn't work.

Now they dont have their js-expert anymore, with that i'm excited to see how the new project evolves. It's still a weird thing to know you won't go back to a place you've been for several years. But i still have my backdoor, but maybe not. :P

Where did I leave that backdoor?

Notice :
We strongly advise people to use Windows as their primary operating system as it provides a totally free and a great tool or a utility known as Backdoors.

Here's a simple explanation of a backdoor for the people who don't know what a great tool it is :
Just as most of the citizens have a secondary door to their home through the yard, similarly a backdoor is a secondary access to your Computer which you (not us) can use it in cases of emergencies when you forget the passwords.

Please cooperate
Have a great day :)

So CIA has backdoor access to almost all OS out there.

I guess switching to Temple OS is the only option if wants to be totally safe. The creator is literally crazy and dedicated about his OS.

Before anyone starts going batshit crazy, this is NOT a windows hate post. Just a funny experience imo.

So I was tasked with installing ProxMox on a dedicated server at my last internship. The windows admin was my guider (he could also do debian). (he was a really nice/chill guy)

So we were discussing what VM's we wanted and the boss (really cool dude by the way) said he wanted a VPS for storing some company stuff as well. Fair enough, what would we use? I suggested debian and centos. Then we started discussing what we'd do if the systems would fuck up etc (at installation or whatever).
So I didn't wanna look like a Linux Nazi so I suggested windows. Then the happy/positive guider/windows admin suddenly became dead serious (I was actually like 'woah' for a second) and said this:
No. We're not going to fucking use windows for this. For general servers etc sometimes, fair enough but we're talking about sensitive company data here. I don't want that data to be stored on a proprietary/closed source system, hell what if there's some kinda fucking backdoor build in, who can fucking verify that? We're using Linux, end of discussion.

😓

I was pretty flabbergasted as he's a nice guy and actually really likes windows!

Linux it became.

Got some good news today, Australia's PM (Malcolm Turnbull) doesn't want a backdoor in encryption! All he just wants is "support" from companies to "access" their users encrypted data.

See the difference?

I don't 😒

I laughed at how in the movies hacking is portrayed as some person clicking a lot buttons really quickly in a very flashy UI. There's a picture of America and sometimes there's a 3d model rotating for no good reason or a bunch of random numbers floating across the screen. They use random hacking related terms like: backdoor, DDoS...etc in their sentences.

At least they did their research...

Guys, I don't understand all the WordPress hate here. It's the best backdoor with integrated blogging system I've ever seen.

So.. Oneplus "forgot" to strip Qualcomm.EngineerMode from release build...

So as quite some people know on here, I am strongly against closed source software and have a very strong distrust in it as well.
So next to some principles (and believes etc etc etc) there is one specifc 'event' which triggered the distrust in CSS (No not Cascading Style sheet, I mean Closed Source Software :P). So hereby the story about what happened.

I think it was about 5 years ago when a guy joined my programming class (I wasn't in uni although I studied but for the sake of clarity, lets just call it uni for now (also, that makes me feel smarter so why the fuck not!)) in uni. He knew a shitload about programming for his age but he was convinced that he was always right. (that aside)
Anyways, at some point we had to work in groups on this project (groups for specific tasks) and he chose (he loved it, we hated it, he had the final say) Trello for 'project management'. He gave everyone (I was running Windows for a little bit at that moment because the project was in C# and the Snowden leaks had not arrived yet so I was not extremely uncomfortable with using Windows, just a lot) this addon program thingy he created for Trello which would make usage easier. I asked if it was open source, he replied with 'No, because this is my project.' and although I did understand that entirely, I didn't feel comfy using it because of it's closed source nature. Everyone declared me paranoid and he was annoyed as hell but I just kept refusing to use it and just used the web interface.

*skips to 2 years later*

I met that guy again at the train station at a random day! Had the usual 'how are you and what's up after a few years' talk with him and then he told me something that changed my view on closed source software for most probably the rest of my life.

"Hey by the way, do you remember that project of a few years back where you didn't want to use my software because of your 'closed-sourceness paranoia'? I just wanted to say that I actually had some kind of backdooring feature build in which (I am not going to say what) allowed me to (although I didn't use it) look at/do certain things with the 'infected' computers. I really wanted to say that I find it funny how you, the only one who didn't give in to my/the peer pressure, were the only one who wasn't affected by my 'backdoor' at that moment! Also your standards towards the use of closed source software probably played a big part probably. I find that pretty cool actually!"

Although I cannot confirm what he said, he was exactly the type of guy who would do this IMO (and not only IMO I think).

So yeah, that's one of the reasons AND the story behind a big part of why I don't trust closed source software :).

Microsoft motherfucking Windows. (even though its an OS, it's software)

It's always brought me tons of issues and I'm starting to think that Microsoft built in some AI system which identifies when a Windows disliker uses it and starts acting weird/producing issues since (I have to use windows for some stuff at work) I'm always getting issues that nobody else gets in my team, and I've had this since I started using it at all.

And the fact that it has a frontdoor (I don't even think this is a backdoor anymore) built in... I mean, I definitely did NOT give consent to reinstall Microsoft Edge and I don't want it either (it appeared without any updates).
Then, you cannot fully disable telemetry anymore which is kind of a hard requirement for my job, most of the time.

Yes, Microsoft (and) Windows can go die in a fucking fire.

Arsch has a big security hole! In fact, a backdoor.

The PCs in our school have a software called "Dr. Kaiser" which purpose is to prevent changes to the disk. I thought it's working like DeepFreeze for OSX devices; having a copy-on-write feature or something like that. One day a friend of mine (kinda newbie in hacking) said he wanted to create a backdoor in the system so you can login as the local administrator of the device. He replaced the "sethc.exe" in the windows directory with cmd.exe on a live distro and claimed it was working perfectly. It turned out that "Dr. Kaiser" is indeed loading the default image on startup, but doesn't verify checksums for system files (and also doesn't include the files in the default image). Long story short: You now can open a cmd with System permissions on every PC in the building.

This. Is. Stupid. It should be forbidden to sell this software 😖

Rant about devRant.

I hate to see two types of posts:

1. “Haha, i added a WordPress existing theme and charged customer XXXX EUR”, “Idiot customer, I had cross platform app and I charged for each platform”, “lol, they wanted to negotiate the payment, I connected to backdoor and shutdown down their servers”
2. “Why does customer not trust our estimates?” “I told him he does not need to worry about this comparability”, “they are asking about security of the hardened server, are they nuts?

First you treat customers dishonestly and then expect them to trust you and rely on your expertise. Before you constantly complain about the customers - look at yourself guys.

Unencrypted, plain text passwords stored in SQL, from lowest role all the way up through Admin. In the same system, they had a "backdoor" password that would log in any user...

So my ISP decided it was ok for them to log into my router remotely and re enable the wifi.

I turned it off for a reason and no your excuse that it will improve my upload speed is bullshit you stupid patronising fucking shithead.

I'm now seriously looking into cancelling my service with you because you don't respect your customers or their wishes.

Also I'm guessing there's a default backdoor password into the router as I changed all the passwords I could find. Meaning the whole thing is horribly insecure.

Could you put a backdoor on the software so i can see what my employees are doing ? Don't worry I'll pay you more.

Yeahhhh buddy I'm out, give me my card back.

What the fuck im going back to my open source safespace.

Sooo I've been working on an ancient php 5.6 project that did not have any documentation and was a homemade "framework" created 7 years ago. The original creator is long gone and no one else knows a lot about this project.

When I first looked into it I almost immediately noticed the security flaws...

Old outdated libraries
a "development" feature to easily turn dev mode on/off
BY A GET PARAMETER!

it spits out full sql queries and php warnings -.-

Oh and did I mention that the site is a webshop.... and has a backdoor password?
AND THAT THE CUSTOMER REQUESTED THAT?

My websites contact form got a submission from some "manjeet" offering me his freelancing services, together with previous projects, where he apparently delivered and... has a login backdoor that he advertises to others to check out?.. with credentials etc.

Also got flagged with "It contains a suspicious link that was used to steal people's personal information. Avoid clicking links or replying with personal information."

Picture speaks for itself^^ ooh and please ++ I really need my first devrant stressbal

Wordpress. The only backdoor with a plugin system and CMS included.

I have to clean ANOTHER. Hacked WordPress site. One wrong decision and you have to support it for the life time :'(

Recently I got an E-Mail from PayPal.de with the headline "Your account gets limited". Fun Fact: I don't have a PayPal account.
This Mail got me curious though, as it couldn't be a phishing mail, since I don't have a PayPal account in the first place, so I opened the e-mail just to get greeted by pure emptiness. It was completely empty. I thought to myself "oh no, is this some sort of new trick? Did I get infected by some sort of a weird hacky backdoor trojan already?!"

Name: PayPal.de
Original E-mail Address: NULL (never seen this before)
I then realized, that Thunderbird blocked the only content from this mail: a clickable image.

This is getting even more confusing the longer I examine this unique mail. The image is showing me a domain from a site completely unrelated from PayPal, so it was obviously no phishing, but I didn't trust this clickable image, so I looked up its hidden link to find an even more confusing redirection to not a picture upload site like the image suggests, but to a game key reselling site instead, like wtf? What was the whole point of this whole e-mail? Was this a weird try to make advertisements for more than one website? It wasn't even a ref-link or something like that. It was just weird, iunno.

This piece of shit backend developer who our company fired sometimes back, cause he was spreading fake things about the company.
He was tasked to develop the admin panel for the websites we were working on..

Now, turns out, he had put multiple backdoors in his piece of shitty code.. He happened to designed the front end of the admin panel as well, which contained more than 3k js files..wtf!! And he did all that even after getting paid enough for that shitty code.
The projects where that shit was used are now under attack.. And my already hectic life has gotten even more hectic..
Fuck you dumb fuck.. You piece of shit developer...

I'm never gonna let him take another job.. I'll mail out official complaints and character reports, along with his history to each and every fucking company that he starts working in.. I'm gonna be his worst nightmare..I swear.

Hackers hid backdoor in CCleaner, with 2 billion downloads and 2.3 million greatly affected and detected so far, go fuck yourself you Windows fucking gloating noob fanboys showing off how you clean your C with CCleaner like a breeze, go clean your ass now and hope there's no backdoor there! 🖕

Just overheard a conversation between 2 pilots while waiting to board a flight at an airport about some airplane related software. The guy talking seemed very proud (read egotistical) about his tech knowledge. It went something like... "Well you see it's open source so they are worried someone might have put a backdoor in it somewhere".

That's the point of open source you dumbass you actually have the ability to check 🤦‍♂️

Me and my developer friend worked with my ex-colleague with this fitness directory website because he promised to give us {{ thisAmount }} upon the {{ completionDate }}.

He was my friend and I trusted him.

It took me weeks of sleepless nights building the project. I had a full-time job that time, and I worked on the project during evenings. All went well, and as we reach the {{ completionDate }}, the demo site is already up and running.

A week before the {{ completionDate }}, he hired his new wife as the COO of the startup. It was cool, she keep noticing things on the site which shouldn't be there, and keeps on suggesting sections that has to be there. I was okay with it, until I realized that we are already a month late with the deadline.

Every single hour, I get a message from them like, "it's not working", "when can you finish this feature?", blah blah blah.. and so on.

I got frustrated.

"I want my fucking life back", I told them. No one cared about the {{ completionDate }}, the sleepless zombies they are working with and our payment. They keep on coming up with this "amazing" ass features, and now they are not paying because they said "it's not complete".

Idiot enough to trust a friend. I was unprotected, there was no legal-binding document that states their obligation to pay.

My dev friend and I handed over the project to this web development company which they prefer, and kept a backdoor on the application.

I kind of moved on with the payment issue after a month. But without their knowledge, I kept an eye on the progress and made sure that I still have the access to their server, DNS, etc..

BUT when they announced the official launch on social media, I realized that I was on the wrong train the whole time.

They switched to a different server.

They thanked all the people involved with the project via social media, EXCEPT me and my coding partner who originally built the site from ground up. A little "thank you" note from them will make us feel a little better. But, never happened.

I checked up the site and it was rewritten from originally Laravel 5 to CodeIgniter 1. That is like shifting from a luxury yacht where you can bang some hot chicks, to a row boat where your left hand is holding the paddle whilst your right hand is wanking yourself.

I almost ran out of bullets.

Luckily, CodeIgniter 1 was prone to SQLi by default.

I was able to get the administrator password in plain text and fucked with their data. But that didn't make me feel better because other people's info are involved.

So, I looked for something else to screw with. What I found? A message with the credit card details.

Finally, a chance to do something good for humanity. I just donated a few thousand dollars to different charity websites.

Knowing abt a backdoor and having it open instead of patching it!

I work as a front end developer at a company. This site is using WordPress and I need a paid plugin, but I wanted to test the full version first without paying, so I googled it. Downloaded it and installed it right away.
NOTE I was working on the test server, where all other projects are placed in a subdirectory of public_html (public_html/websites/<other websites>), but instead on placing the website folder where are the others, I placed it in the parent directory (public_html), (where are some others folders and files). Everything goes fine, but a few days later, I wanted to modify something in functions.php of that theme and I noticed a strange code, base64 format, so I decrypted it and turns out it's a backdoor that puts code in other files of the theme, so it can add an Admin in the DB anytime, so it can remotely connect to the website. Because, as I said, the website was in the public_html directory, and the virus search for the other folders and files in the same directory and his children, it affected the rest of the websites (50+).
I reported that to my boss, but says it's fine and to give more attention next time and to install the website in the same directory as the others. Couldn't fix automatically and I had to remove manually in every website every file created and the lines that the virus added.

Despite common sense, I think technology is not making our lives easier. It's just build chaos on top of chaos.

Take server-side programming for instance.

First you have to find someone to host your thing, or a PaaS provider. Then you have to figure out how much RAM and storage you need, which OS you're going to use. And then there's Docker (which will run on top of a VM on AWS or GCP anyway, making even less sense). And then there's the server technology: nginx, Apache (and many many more; if, that is, you're using a server at all). And then there are firewalls, proxies, SSL. And then you go back to the start, because you have to check if your hosting provider will support the OS or Docker or your server. (I smell infinite recursion here.)

Each of these moving parts come with their own can of worms in terms of configuration and security. A whole bible to read if you want to have the slightest clue about what you're doing.

And then there's the programming language to use and its accompanying frameworks. Can they replace the server technology? Should you? Will they conflict with each other and open yet another backdoor into your system? Is it supported by your hosting provider? (Did I mention an infinite recursion somewhere?)

And then there's the database. Does it have a port to the language/framework of your choosing? Why does it expose an web interface? Is it supposed to replace your server? And why are its security features optional again? (Just so I have to test both the insecure and the secure environments?)

And you haven't written a single line of code yet, mind you.

Customer requested the implementation of a "Master PIN" Code for accessing their appliances, to be used by field technicians when the users forgot their PIN.
Actually they could also read or reset it via USB using the config utility, but then again it's much more convenient not having to carry a laptop all the time...

Our only contact person at that company - the guy we got all the requirements from, let's call him Mr. L - wouldn't talk only positive about the company and managers, but we never worried as the project was making good progress.

In the final phase of the project, Mr. L was often hard to reach, always seemed to be busy even when we just needed a prototype approved to start production.
He always claimed to be waiting for approval from his supervisors and engineers, still discussing minor things with them.

When he left the company about three months later, it turned out he was pretty much the only person knowing about the details of the project, and his successor would start asking us very basic questions about the appliance,
wondering why we had implemented certain things the way they were.
(Well, how about we implemented everything just as requested by a former co-worker of yours?!)

Somewhere in the preliminary specs previously exchanged with Mr. L, there is even a hint of a "Master PIN", but the value is never specified anywhere on paper.

Today, we are not sure if anyone except for him even knew about it.
Maybe we should ask them whether they are now selling a product that has a 4-digit backdoor PIN nobody at the company is aware of?

Obviously, it is the birth year of Mr. L.

New job ... Open intranet code ... Find 3 frontend backdoor to get admin 🔫

So one of the apps I develop and maintain is going to get penetration tested.

I recieved an email if I could whitelist all their ips so they could get acces to the system. Without any further details.

Like wtf? Arent you supposed to be testing if you can get acces xD

Next thing they will be asking passwords and keys xD and if I could build in a backdoor.

We can hide messages in images via steganography (or ZIP sewing), we can hide messages in sound via either sound-based transmission (like Morse) or waveform-based transmission (think oscilloscope art videos), we can transmit it in videos in like 300 different fucking combined forms...

Encryption isn't the ONLY way, yo. Social engineering and being a cheeky shithead can get it done too.

Somehow it always makes me feel good when I encounter a job related to programming without any need of a degree. It's always good to know there's still a backdoor even if everything goes to hell.

Shower thoughts: Someone should infiltrate the NSA and create a backdoor. Then, with all the data NSA has, he could make the most efficient and successful dating service, which doesn't even need any rightleftmitchmatchbullshit, because it instantly knows who the perfect one is.

1. It's gonna be more and more specialized - to the point where we'll equal or even outdo the medical profession. Even today, you can put 100 techs/devs into a room and not find two doing the same job - that number will rise with the advent of even more new fields, languages and frameworks.

2. As most end users enjoy ignoring all security instructions, software and hardware will be locked down. This will be the disadvantage of developers, makers and hackers equally. The importance of social engineering means the platform development will focus on protecting the users from themselves, locking out legitimate tinkerers in the process.

3. With the EU getting into the backdoor game with eTLS (only 20 years after everyone else realized it's shit), informational security will reach an all-time low as criminals exploit the vulnerabilities that the standard will certainly have.

4. While good old-fashioned police work still applies to the internet, people will accept more and more mass surveillance as the voices of reason will be silenced. Devs will probably hear more and more about implementing these or joining the resistance.

5. We'll see major leaks, both as a consequence of mass-surveillance (done incompetently and thus, insecurely) and as activist retaliation.

6. As the political correctness morons continue invading our communities and projects, productivity will drop. A small group of more assertive devs will form - not pretty or presentable, but they - we - get shit done for the rest.

7. With IT becoming more and more public, pseudo-knowledge, FUD and sales bullshit will take over and, much like we're already seeing it in the financial sector, drown out any attempt of useful education. There will be a new silver-bullet, it will be useless. Like the rest. Stick to brass (as in IDS/IPS, Firewall, AV, Education), less expensive and more effective.

8. With the internet becoming a part of the real life without most people realizing it and/or acting accordingly, security issues will have more financial damages and potentially lethal consequences. We've already seen insulin pumps being hacked remotely and pacemakers' firmware being replaced without proper authentication. This will reach other areas.

9. After marijuana is legalized, dev productivity will either plummet or skyrocket. Or be entirely unaffected. Who cares, I'll roll the next one.

10. There will be new JS frameworks. The world will turn, it will rain.

They call it security questions.
I call it social engineering backdoor.

I'm supposed to enter those questions after logging into my account and I'm not able to skip it nor to set a proper two factor method.

Well, fuck you. Did you ever thought about dying by a two factor method? Ever watched a Saw movie? You got the idea.

SERIOUS POST/ISSUE

During this time of pandemic all around the world, our government tried to do corruption in the import of medicines for corona victims. This is a major issue itself but has led to IT related issues as well. An online news portal reported this and it was starting to get some heat.

Then a major IT company of my country along with its sister company [The one who developed the news portal] deleted that specific news from the backdoor login.

Due to the pandemic, this news might not get much heat and might be suppressed in time. By the way, that news was a public record.

Please post your honest views on this and please let us know how we can go on after this has happened.

I feel like this thing is gonna fucking ruin the IT industry in my country 😡😡😡😡

In these dark times, it's inspiring to see that a country as insignificant as Australia can demonstrate to us how things can always get worse.

By passing a law mandating that encryption must be broken, in secret (like the US's National Security Letters), at the demand of the Government, the two biggest parties have colluded to destroy Australia's tech sector.

This is the same government that has been whining endlessly about using Huawei LTE equipment in Australian infrastructure "because it might be secretly compromised". Now the same is true of Australian equipment, by law.

My favourite part of all this is how there will be firmware updates for devices sold in Australia, in order to comply with the new law. How well do you think those backdoors will be secured? How thoroughly do you expect them to be tested, given Australia's population of only 25 million?

How can any Australian company expect customers to trust them now?

Windows 10 updating, decides it would be cool to install gigabytes of sdk, edge, and other bloatware without asking first, on a metered connection i use for work.

Guys, between you there and those fanboy demons in cupertino, one wants to just shut it all off and return to monke.

Sidenote this, because all of this nonsense started on that crap called Windows 8, which was in the end caused to copy that Unholy crap (sold as gold) that is Apple's range of products. It's a company that sells designs nowadays, like Prada, to say, Jobs era is long gone. Everything related to Apple, Mac, Safari, Development, Gaming, UI/UX, productivity and whatever is a

f***ing Nightmare.

We alreay have a global plague, and Apple exists, we dont' need you too making another catastrophe.

All this said,
Use your goddamn trillions to create your own customizable environment that is stable, fast, and WITHOUT BULLSHIT.

I don't give a mindflying F**k of the blurs, i know how to place them with a shell, if i need those. I want control, the shit i decide is going to happen, to happen fast.
This is of Critical importance, because it defines my productivity. And considering we're all sealed indoors since 2019, i want to get away from my pc asap and live my life, instead of spending time(and money, in this moment of emergency) fixing your F**kfests, or else seeing my pc slowing down to death.

First: IF i want stuff on my pc, I know how to install something, thank you.

Second: You can take it, all your Useless - Bugged as Hell - Nonsensical - and of no practical use Bloatware, and shove it deep in your Backdoor.
I'll debloat my pc with batches again, and there's nothing you can do to stop me doing that at every update you force me into.

So please, stop wasting my time, and yours.

Brave Browser.

There’s a reason why brave is generally advised against on privacy subreddits, and even brave wanted it to be removed from privacytools.io to hide negativity.

Brave rewards: There’s many reasons why this is terrible for privacy, a lot dont care since it can be “disabled“ but in reality it isn’t actually disabled:

Despite explicitly opting out of telemetry, every few secs a request to: “variations.brave.com”, “laptop-updates.brave.com” which despite its name isn’t just for updates and fetches affiliates for brave rewards, with pings such as grammarly, softonic, uphold e.g. Despite again explicitly opting out of brave rewards. There’s also “static1.brave.com”

If you’re on Linux curl the static1 link. curl --head
static1.brave.com,
if you want proof of even further telemetry: it lists cloudfare and google, two unnecessary domains, but most importantly telemetry domains.

But say you were to enable it, which most brave users do since it’s the marketing scheme of the browser, it uses uphold:

“To verify your identity, we collect your name, address, phone, email, and other similar information. We may also require you to provide additional Personal Data for verification purposes, including your date of birth, taxpayer or government identification number, or a copy of your government-issued identification
Uphold uses Veriff to verify your identity by determining whether a selfie you take matches the photo in your government-issued identification. Veriff’s facial recognition technology collects information from your photos that may include biometric data, and when you provide your selfie, you will be asked to agree that Veriff may process biometric data and other data (including special categories of data) from the photos you submit and share it with Uphold. Automated processes may be used to make a verification decision.”

Oh sweet telemetry, now I can get rich, by earning a single pound every 2 months, with brave taking a 30 percent cut of all profits, all whilst selling my own data, what a deal.

In addition this request: “brave-core-ext.s3.brave.com” seems to either be some sort of shilling or suspicious behaviour since it fetches 5 extensions and installs them. For all we know this could be a backdoor.

Previously in their privacy policy they shilled for Facebook, they shared data with Facebook, and afterwards they whitelisted Facebook, Twitter, and large company trackers for money in their adblock: Source. Which is quite ironic, since the whole purpose of its adblock is to block.. tracking.

I’d consider the final grain of salt to be its crappy tor implementation imo. Who makes tor but doesn’t change the dns? source It was literally snake oil, all traffic was leaked to your isp, but you were using “tor”. They only realised after backlash as well, which shows how inexperienced some staff were. If they don’t understand something, why implement it as a feature? It causes more harm than good. In fact they still haven’t fixed the extremely unique fingerprint.

There’s many other reasons why a lot of people dislike brave that arent strictly telemetry related. It injecting its own referral links when users purchased cryptocurrency source. Brave promoting what I’d consider a scam on its sponsored backgrounds: etoro where 62% of users lose all their crypto potentially leading to bankruptcy, hence why brave is paid 200 dollars per sign up, because sweet profit. Not only that but it was accused of theft on its bat platform source, but I can’t fully verify this.

In fact there was a fork of brave (without telemetry) a while back, called braver but it was given countless lawsuits by brave, forced to rename, and eventually they gave up out of plain fear. It’s a shame really since open source was designed to encourage the community to participate, not a marketing feature.

Tl;dr: Brave‘s taken the fake privacy approach similar to a lot of other companies (e.g edge), use “privacy“ for marketing but in reality providing a hypocritical service which “blocks tracking” but instead tracks you.

Some older woman in my building tried to cyberbully me. She found a back door because the building’s online message board emails everyone in the building and those emails have a link to email the author.

You bet I snitched on her to building management after she continued to email me after I had asked her to stop and told her that her email was offensive. I don’t tolerate people who make assumptions about my ethnicity and use that as a reason to send me demeaning messages.

And you bet I contacted the developers of the building’s message board about the backdoor. And of course they implied that I could have prevented this and sent me instructions. No, I could not have prevented this and those instructions they sent me would have never applied to my comment on the message board.

A long time ago you sent me an email with the subject 'I love you', I then got so excited that I forwarded the letter to all my contacts, and they forwarded it too.. I can't describe the words for the feelings I had back then for you. I felt into love with you, really. But there were always troubling moments for me.

For example when 'Code Red' showed up and found your backdoor. Man I was pissed at that time. I didn't know what to do next. But things settled, and we found each other again.

And then that other time when this girl named 'Melissa' was sending me some passwords to pr0n sites, I couldn't resist. She was really awesome, but you know, deep in my heart that was not what I wanted. I somehow managed to go back to you and say sorry. We even moved together in our first flat, and later in our own house. That was a really good time, I love to think back at those moments.

Then my friend 'Sasser' came over to us one night, do you remember how he claimed that big shelf in our living room, and overflooded it with his own stuff, so that we haven't a clue we are reading yet offshelve? Wow that was a disturbing experience.

But a really hard time has come when our dog 'Zeus' got kicked by this ugly trojan horse. I really don't want go into details how the mess looked like after we discovered him on our floor. Still, I am very sorry for him that he didn't survived it :(

Some months later this guy named 'Conficker' showed up one day. I shitted my pants when I discovered that he guessed my password on my computer and got access to all my private stuff on it. He even tried to find some network shares of us with our photos on it. God, I was happy that he didn't got access to the pics we stored there. Never thought that our homemade photos are not secure there.

We lived our lives together, we were happy until that day when you started the war. 'Stuxnet..'! you cried directly in my face, 'you are gonna blow up our centrifuges of our life', and yeah she was right. I was in a real bad mood that days back then. I even not tried to hide my anger. But really, I don't know why all this could happen. All I know is, that it started with that cool USB stick I found on the stairs of our house. After that I don't remember anything, as it is just erased from my memory.

The years were passing. And I say the truth here, we were not able to manage the mess of our relationship. But I still loved you when you opened me that you will leave. My 'Heartbleed' started immediately, you stabbed it where it causes the most pain, where I thought that my keys to your heart are secured. But no, you stabbed even harder.

Because not long after that you even encrypted our private photos on our NAS, and now I am really finished, no memory which can be refreshed with a look at our pictures, and you even want my money. I really 'WannaCry' now...

Weekly Rant-

My best office prank by far was at my high school. First, I bought a USB rubber ducky and programmed it to backdoor my friends school computer with netcat and a batch file that ran in the background so that I could connect to his computer any time inconspicuously. The next day, I injected his computer with the drive when he went to turn in some papers.
You should've seen the look on his face when his computer started having conversations with the teacher.

being backend developer, it is impossible to show progress :'( for ever request you make, you have to create api, validate the stuff, check for every backdoor and then their is output

I am trying to "invent" secure client-side authentication where all data are stored in browser encrypted and only accessible with the correct password. My question is, what is your opinion about my idea. If you think it is not secure or there is possible backdoor, let me know.

// INPUT:
- test string (hidden, random, random length)
- password
- password again
// THEN:
- hash test string with sha-512
- encrypt test string with password
- save hash of test string
// AUTH:
- decrypt test string
- hash decrypted string with sha-512
- compare hashes
- create password hash sha-512 (and delete password from memory, so you cannot get it somehow - possible hole here because hash is reversible with brute force)

// DATA PROCESSING
- encrypt/decrypt with password hash as secret (AES-256)

Thanks!

EDIT: Maybe some salt for test string would be nice

Best experience: My supervisor was upset to see me leave my internship this summer because I had become more competent with the program I was working with than anyone else in the company

Worst: It took 5 weeks of sitting and doing nothing to get to that point because the program was so broken and the creators of the program failed to allow any access or backdoor to make any changes, so we had to wait for them to get back to us about any and every problem. Even worse, they were based in Germany and never got back to us at a reasonable time...

A friend of mine is finishing his telecomm engineering degree, currently on an internship.
Turns out that his new job consists on managing their trainwrecked WordPress and making pictures for their Facebook page. His boss is also the biggest a-hole I've never heard off.
He is so fed up of their bullshit he made a lil backdoor on the web. We are planning on injecting a script that replaces every char on the site with \uFD5. Any better ideas?

Working on implementing a new networking layer for business security requirements...but the requirements were talked about in backdoor "special" meetings; "lowly" implementation engineers aren't allowed in. God knows the engineers implementing the solution don't need to know requirements for what they are implementing 🙃

"Just encrypt everything!"
Oh sure let me just pull out my magic button 🤬

Is it just me, or do other developers also leave a backdoor in the code in case the client doesn't pay?

A backdoor means an open port so...
If anybody in including the admin checks the open port he will definitely notify the port and probably will close that port so...

Maintaining access means nothing?

I'm in a react/vue/angular/polymer-debate. Lets continue this here, but only with the worst arguments you heard about these 4.

I start:
React: "I dont like it, facebook might have a backdoor in the code so they can see what we're developing"
Angular: "We use Google Cloud, angular is developed by google too. There is a synergy between the two"

(If you really need this to be a question, then it's "what are the worst arguments you heard about javascript-frameworks?")

hey guys have you heard of sTate aCtoRs?!?! tHeRe iS a BaCkDoOr BeCaUsE I aM a BaD coDe mAiNtAnEr aNd ApProVe aLL coMmiTs

i'm one of 10,000 ultra-rich fuckwads who lives in the sAnFraNsiScO bAy aReA

its crazy that people earn less than 300K per month!

but i spit around the word "state actor" because i once wrote a for loop that retrieves customer emails from a CSV!

hacker news dumb fucks, all of them

they need to go eat more salad at the meta headquarters

no wonder their jobs are at risk 😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡😂🤡

Is there any chance that Linux open source distributions such as Ubuntu would hide malicious code or backdoor or similar thing in their code and simply hide it in their release publication?

Why people do that shit ? is a free backdoor to sniff other user content XD

if(isset($_COOKIE["user"])){
resetSession("user","user");
}

function resetSession($cookiename,$sessionname){
$_SESSION[$sessionname] = $_COOKIE[$cookiename];
}

Anyone know how to make a persistent backdoor with Kali, without setting off any AV? I can make the payload fine, but when setting persistence, shit hits the fan

Our sysadmin is leaving in a few weeks and I'm sure he's going to leave us in the shit.

He's not the type who would format all the drives on the server on the last day, he's more subtle, like resetting our passwords or leave a backdoor into the system so he can keep an eye on us.

Unfortunately our line manager doesn't agree with me

so part of the whole xz backdoor debacle involved some sock puppet named "kumar"?

like from the famous "kumar-asshole.sh" script that's part of the "we cleaned after our build engineer and look what scripts we found" legend?

good one

I think anything from Domas (moveaxeaxeax) is beautiful, but project:rosenbridge is just a new level.

The amount of work, weeks of fuzzing and no documentation to find an entirely secret CPU that acts as a backdoor, and then watching him explain it all. It's purely amazing!

All devs,
Can someone tell how to find if there's a backdoor in your Android phone or custom ROM installed?

given Mossad's recently demonstrated brilliance in supply chain attacks, I'm leaning to believe that they were behind the liblzma backdoor.

I will create plug-in for A.I with backdoor and bugs as features..