JFL I forgot to remove my testing admin accounts on apps for months

[AsiaCel]

So I worked on the company maintaining multiple apps, now add another.

The management was pushing us and forcing us to use AI to deliver code fast; the management uses AI to threat the devs to make them 'innovate'..boring shit like security right can be ignored yes? Devs are expected to be creative and flexible, design how the program works, leaving the boring stuff to AI.

I hardcoded the admin accounts into the code, without debug mode limitations for months!

That means users could access the admin account (thankfully the password is censored but that won't help if you get the memory)!

The account was auto filled too, so it means you can just click login and enter the app as admin.

I didn't knew about these vulnerabilities much when I was just returning to Android apps, plus the complexity of making it into an app bundle and annoying API shit (fuck you google maps for forcing me to use fingerprints)

It was when I finally checked the login function, I made it so the code is never added on production builds....I hope.

It's a small app, but it doesn't justify poor security.

Even more fun facts:

Many apps in the company straight up expose username/password with the POST APIs, solely relying on HTTPS to encrypt the data without even basic symmetrical encryption while using query params (putting username and password in URL)

Hey, at least my APIs have AES256 symmetrical encryption.

Many GET APIs are exposed (if you know the name, like GetListUsers; not exactly name) without credential check (meaning a low tier guest user can get the full list of users, in some old APIs you could even get the salt placed near the password)

My APIs used to have strict account, privilege checks, but I stopped caring because the new account DTO models do not expose passwords, basically following everyone else.

EF Core is also secure enough that you can't get items without the same tenant id as yours anyway.

But the most vulnerable APIs are not mine, so who cares?

I have warned others before, they just said: "eh won't happen". Now I agree with them — I'm one of them now.

They don't pay me enough to audit everyone's code and fix them.

I work, counting transportation, from 7:30am to 7:30pm. The density and mindfuckery of work really stresses you out (I'm always put to work on the flashy shit)

 

[Deleted Member 8090]

Must be Chinese

 

[AsiaCel]

Must be Chinese

The pajeet co worker made many of these APIs too.

They don't pay me enough to audit everyone's code and fix them.

 

[turbocuckcel_7000]

did they turn you into the load-bearing employee that holds the whole company afloat because it sucks to be that guy

 

[AsiaCel]

did they turn you into the load-bearing employee that holds the whole company afloat because it sucks to be that guy

Well, I don't handle the most important legacy stuff, but some are quite important like authorization app (jwt, encryption, across all platforms)

I tend to handle the flashy shit shown in conferences like unreal projects, android apps, etc. it's actually worrisome because I'm fucked if they crash during showoffs.

I give up on performance coding (Android)

Yes, I'm a slopcoder, yes I use AI code. Yes I used to value consistent code styling. For non-codecels, a listener is a piece of code that fires when something changes. For example: a doorbell code that fires every time the door opens. On one Android app involving drones, I handle more than...

incels.is

Making drone apps and coding in C++ sounds badass until you have to do it professionally.

 

[TooSomething]

did they turn you into the load-bearing employee that holds the whole company afloat because it sucks to be that guy

I used to be that guy.

Never be that guy.

Now they are still trying to put me in that position.
Ain't happening.

 

[turbocuckcel_7000]

Well, I don't handle the most important legacy stuff, but some are quite important like authorization app (jwt, encryption, across all platforms)

I tend to handle the flashy shit shown in conferences like unreal projects, android apps, etc. it's actually worrisome because I'm fucked if they crash during showoffs.

I give up on performance coding (Android)

Yes, I'm a slopcoder, yes I use AI code. Yes I used to value consistent code styling. For non-codecels, a listener is a piece of code that fires when something changes. For example: a doorbell code that fires every time the door opens. On one Android app involving drones, I handle more than...

incels.is

Making drone apps and coding in C++ sounds badass until you have to do it professionally.

tbh android is retarded and insane garbage even if you do very simple interface stuff, let alone get into the networking and scheduled tasks

View: https://www.reddit.com/r/androiddev/comments/9fc796/comment/e5vfqqh/

 

[turbocuckcel_7000]

I used to be that guy.

Never be that guy.

Now they are still trying to put me in that position.
Ain't happening.

it can always get worse, there was a guy who did his job but also did the hirings/firings because the managers were "friends" with him that is they made him do everything

 

[AsiaCel]

I used to be that guy.

Never be that guy.

Now they are still trying to put me in that position.
Ain't happening.

it can always get worse, there was a guy who did his job but also did the hirings/firings because the managers were "friends" with him that is they made him do everything

What you guys were put to do? Just give generic descriptions; don't dox yourselves.

If my apps didn't had to face conferences/shown in demos/in speeches, I would feel much more at ease; hence, I tell people I prefer them show a pre recorded video.

Given that the conference was few months ago, I assume I passed with flying colors. The VR devices have very low RAM, which always crashes on unreal 5. I coached the guys to show the exact configuration/save file (think about placing items in a Gmod map, then saving it).

These conferences are international professional events (ofc I'm not telling what they are for obvious OPSEC reasons), not a small talk with handful of people.

These are the scenarios I designed to use minimum RAM, but not guaranteed. I tried them in office a few times, but you never know.

Another I had to demonstrate to some pilots was the drone app; thankfully the only thing that happened was that the app could not start the mission. I've had a drone slammed into a tree once when we were testing the app (it was hilarous though, I was like YOOOOO), the propellers didn't get damaged.

 

[nazianime]

I hate phone apps. I prefer normal websites instead. Don’t the apps for services have a bunch of spy shit so they can scrape you and sell your data?

 

[turbocuckcel_7000]

What you guys were put to do? Just give generic descriptions; don't dox yourselves.

If my apps didn't had to face conferences/shown in demos/in speeches, I would feel much more at ease; hence, I tell people I prefer them show a pre recorded video.

Given that the conference was few months ago, I assume I passed with flying colors. The VR devices have very low RAM, which always crashes on unreal 5. I coached the guys to show the exact configuration/save file (think about placing items in a Gmod map, then saving it).

These conferences are international professional events (ofc I'm not telling what they are for obvious OPSEC reasons), not a small talk with handful of people.

These are the scenarios I designed to use minimum RAM, but not guaranteed. I tried them in office a few times, but you never know.

Another I had to demonstrate to some pilots was the drone app; thankfully the only thing that happened was that the app could not start the mission. I've had a drone slammed into a tree once when we were testing the app (it was hilarous though, I was like YOOOOO), the propellers didn't get damaged.

some app store mobile app garbage, disposable stuff that would probably never be competitive with everything else on the market, and like in all small companies you have to do all the work on the project

 

[turbocuckcel_7000]

I hate phone apps. I prefer normal websites instead. Don’t the apps for services have a bunch of spy shit so they can scrape you and sell your data?

no shit, and now there is a new trend of websites for various services shutting down in favor of mobile apps

 

[AsiaCel]

some app store mobile app garbage, disposable stuff that would probably never be competitive with everything else on the market, and like in all small companies you have to do all the work on the project

If these apps are glorified web apps on mobile, then at least it's not like my highly dynamic drone apps.

 

[TooSomething]

What you guys were put to do? Just give generic descriptions; don't dox yourselves.

If my apps didn't had to face conferences/shown in demos/in speeches, I would feel much more at ease; hence, I tell people I prefer them show a pre recorded video.

Given that the conference was few months ago, I assume I passed with flying colors. The VR devices have very low RAM, which always crashes on unreal 5. I coached the guys to show the exact configuration/save file (think about placing items in a Gmod map, then saving it).

These conferences are international professional events (ofc I'm not telling what they are for obvious OPSEC reasons), not a small talk with handful of people.

These are the scenarios I designed to use minimum RAM, but not guaranteed. I tried them in office a few times, but you never know.

Another I had to demonstrate to some pilots was the drone app; thankfully the only thing that happened was that the app could not start the mission. I've had a drone slammed into a tree once when we were testing the app (it was hilarous though, I was like YOOOOO), the propellers didn't get damaged.

I am working as a turner / lathe operator.

In my case I was suddenly moved to other machines because the guy who used to operate them resigned and they needed a replacement for him.

Without me they'd have to sell those machines because nobody was capable of operating them.

I had to learn at light speed to operate them and program them.

I used to operate three of our largest and most expensive machines, all by myself. With these machines we are making the majority of our money.

Nobody else even wanted to do my job.

I was given all kinds of jobs, even beyond my expertise because there was nobody there to do it.

 

[Rapistcel]

The pajeet co worker made many of these APIs too.

They don't pay me enough to audit everyone's code and fix them.

There are many pajeets living where you live?

 

[turbocuckcel_7000]

If these apps are glorified web apps on mobile, then at least it's not like my highly dynamic drone apps.

maybe, i was still tasked to make the apps update at an incredibly high rate, which means i had to fight the operating system, battery optimization, whitelisting where maximum performance is reserved only for large corporate apps like facebook and instagram.
i had to try like 50 different ways to schedule a future task, including that CompletableFuture garbage.
then there's all the database management. all the deployment. patching of a live app. designing the UI and making it work on 50 different devices including tablets and fucking samsung fold phones.
all this for pocket change.

 

[turbocuckcel_7000]

in general tho you will always have this problem in small companies where whatever app you're working on will turn into some kind of swiss army knife, cos the bosses have no idea what the fuck they're doing and just ask their slaves to do something new out of boredom

 

[AsiaCel]

maybe, i was still tasked to make the apps update at an incredibly high rate, which means i had to fight the operating system, battery optimization, whitelisting where maximum performance is reserved only for large corporate apps like facebook and instagram.
i had to try like 50 different ways to schedule a future task, including that CompletableFuture garbage.
then there's all the database management. all the deployment. patching of a live app. designing the UI and making it work on 50 different devices including tablets and fucking samsung fold phones.
all this for pocket change.

Let me guess...Small company?

 

[AsiaCel]

tbh android is retarded and insane garbage even if you do very simple interface stuff, let alone get into the networking and scheduled tasks


View attachment 1679213


View: https://www.reddit.com/r/androiddev/comments/9fc796/comment/e5vfqqh/

Yeah, android UI design sucks. ConstraintLayout is marketed as the modern, least terrible layout, but it's still shit.

So much so that I gave up on one of my activities layout and I just forced the user to go into portrait mode because I can't figure out how not to make a button not hide itself, and management disallowed scrollView.

If I had a say in UI design, I would just make it look like 1990s HTML websites, lol. A scrollView with buttons every row, old-school bold cneter text. No issues with stupid "modern" looking layout. Fuck frontend.

Not joking. My colleagues always complain about my UI being "old".

My auth asp.net app is exactly like that. Logo on top, and rows with button in each.