• 0 Posts
  • 58 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle



  • It would be better to our them on blast on social media since that sometimes gets the companies attention to try and fix PR.

    Works almost every time. I had a ticket with a vendor open at work for just about 3 months, and then only replies I’d gotten on the ticket was the “We’ve received your support request which we’ll promptly ignore!” autoresponse upon opening, and then another auto-response a month later saying the ticket was being assigned to another department. I’d replied to the ticket ~20 times asking for updates in that time.

    I finally got sick of essentially yelling into an empty room and called out the company, their marketing team, their support team, and their CEO on Twitter, making sure to @ each one of them in the message. I got a reply from their CEO and an actual human responded to the ticket less than an hour later.

    It’s shitty and a last resort, but it’s generally very effective.


  • I have a Hisense and had a similar experience. I was watching something fullscreen on an HDMI input, and then it suddenly switched inputs and showed a fullscreen firmware update prompt. I had no choice available other than to agree to update the firmware, no cancel button, couldn’t change inputs, nothing, the only choice was to update the firmware. So I unplugged the TV.

    About 10 seconds after I powered it back on, the exact same update prompt happened, still with no choice to decline it. I pulled power and booted it back up one more time just to be sure, met with the update prompt again.

    This made me very angry.

    The next time I powered it on, I had a packet capture running to see where it was phoning home. I created a firewall rule blocking all the hostnames it tried to connect to at startup, pulled the plug, and then booted it back up. No more update prompt, and it hasn’t happened again. Good thing they don’t download and pre-stage the new firmware, I guess.

    Let me know if you want the hostnames and I’ll PM them to you.


  • While on the topic, this isn’t how passwords work in systems.

    Passwords are stored as one way hashes. So it’s cryptoed only in one direction, it’s lossy, and can’t be recovered back to the original password.

    When you log on, your cleartext PW is hashed in ephemeral memory/storage and then the cleartext password is thrown away.

    That hash is compared to the hash in the DB. If the hash matches, then you have access. If it doesn’t, then your PW is incorrect.

    Oh my sweet Summer Child. This is definitely how it’s supposed to work, but there are plenty of services that just don’t know what the fuck they’re doing.

    Have you ever been on a site that has a stupid-low character limit for a password? There’s literally no reason to do that, all the hashes are going to end up the same size in the DB anyway regardless of the original string length. Even bcrypt’s max secret character limit is 70-something characters.

    Ever change a password and have it not work on the next login because they’re silently truncating it after a certain character limit? Ever get an email with an actual password in it?

    The only reason you would do things like this is if you’re storing/processing passwords in plaintext and not hashing it client-side first.

    I can think of 3 offenders of this off the top of my head. It’s a lot more common than you’d think.





  • tool@lemmy.worldtoProgrammer Humor@lemmy.mlC++ Moment
    link
    fedilink
    English
    arrow-up
    8
    ·
    7 months ago

    On Error Resume Next never before have more terrible words been spoken.

    Every time I’m reading a PowerShell script at work and see -ErrorAction SilentlyContinue I want to scream into a pillow and forcefully revert their commit.

    I’ve actually done it a few times, but I want to do it every time.









  • BTW, any authenticator app works when it tells you to use one. They all use a standard, so it doesn’t matter which one you use.

    Eh, it’s a little more nuanced than that, there’re more standards for MFA code generation than just TOTP.

    And even within the TOTP standard, there are options to adjust the code generation (timing, hash algorithm, # of characters in the generated code, etc.) that not all clients are going to support or will be user-configureable. Blizzard’s Battle.net MFA is a good example of that.

    If the code is just your basic 6-digit HMAC/SHA1 30-second code, yeah, odds are almost 100% that your client of choice will support it, but anything other than that I wouldn’t automatically assume that it’s going to work.


  • Bet it’ll be their own special flavor of Python that doesn’t play nice with literally any other packages or interpreters.

    It’s literally just Python and it says that it supports standard packages/modules. And Guido Van Rossum works at Microsoft now, there’s no way he would let them bastardize it, he would’ve quit before that happened.

    I don’t understand why people will find any reason to shit on anything while not even (seemingly) reading the article. If you did, I’m sorry, but it really doesn’t seem like you did.

    But yeah, fuck it, let’s rip it all out and just keep the VBA integration until the heat death of the universe.