3 rants for the price of 1, isn't that a great deal!

1. HP, you braindead fucking morons!!!

So recently I disassembled this HP laptop of mine to unfuck it at the hardware level. Some issues with the hinge that I had to solve. So I had to disassemble not only the bottom of the laptop but also the display panel itself. Turns out that HP - being the certified enganeers they are - made the following fuckups, with probably many more that I didn't even notice yet.

- They used fucking glue to ensure that the bottom of the display frame stays connected to the panel. Cheap solution to what should've been "MAKE A FUCKING DECENT FRAME?!" but a royal pain in the ass to disassemble. Luckily I was careful and didn't damage the panel, but the chance of that happening was most certainly nonzero.
- They connected the ribbon cables for the keyboard in such a way that you have to reach all the way into the spacing between the keyboard and the motherboard to connect the bloody things. And some extra spacing on the ribbon cables to enable servicing with some room for actually connecting the bloody things easily.. as Carlos Mantos would say it - M-m-M, nonoNO!!!
- Oh and let's not forget an old flaw that I noticed ages ago in this turd. The CPU goes straight to 70°C during boot-up but turning on the fan.. again, M-m-M, nonoNO!!! Let's just get the bloody thing to overheat, freeze completely and force the user to power cycle the machine, right? That's gonna be a great way to make them satisfied, RIGHT?! NO MOTHERFUCKERS, AND I WILL DISCONNECT THE DATA LINES OF THIS FUCKING THING TO MAKE IT SPIN ALL THE TIME, AS IT SHOULD!!! Certified fucking braindead abominations of engineers!!!

Oh and not only that, this laptop is outperformed by a Raspberry Pi 3B in performance, thermals, price and product quality.. A FUCKING SINGLE BOARD COMPUTER!!! Isn't that a great joke. Someone here mentioned earlier that HP and Acer seem to have been competing for a long time to make the shittiest products possible, and boy they fucking do. If there's anything that makes both of those shitcompanies remarkable, that'd be it.

2. If I want to conduct a pentest, I don't want to have to relearn the bloody tool!

Recently I did a Burp Suite test to see how the devRant web app logs in, but due to my Burp Suite being the community edition, I couldn't save it. Fucking amazing, thanks PortSwigger! And I couldn't recreate the results anymore due to what I think is a change in the web app. But I'll get back to that later.

So I fired up bettercap (which works at lower network layers and can conduct ARP poisoning and DNS cache poisoning) with the intent to ARP poison my phone and get the results straight from the devRant Android app. I haven't used this tool since around 2017 due to the fact that I kinda lost interest in offensive security. When I fired it up again a few days ago in my PTbox (which is a VM somewhere else on the network) and today again in my newly recovered HP laptop, I noticed that both hosts now have an updated version of bettercap, in which the options completely changed. It's now got different command-line switches and some interactive mode. Needless to say, I have no idea how to use this bloody thing anymore and don't feel like learning it all over again for a single test. Maybe this is why users often dislike changes to the UI, and why some sysadmins refrain from updating their servers? When you have users of any kind, you should at all times honor their installations, give them time to change their individual configurations - tell them that they should! - in other words give them a grace time, and allow for backwards compatibility for as long as feasible.

3. devRant web app!!

As mentioned earlier I tried to scrape the web app's login flow with Burp Suite but every time that I try to log in with its proxy enabled, it doesn't open the login form but instead just makes a GET request to /feed/top/month?login=1 without ever allowing me to actually log in. This happens in both Chromium and Firefox, in Windows and Arch Linux. Clearly this is a change to the web app, and a very undesirable one. Especially considering that the login flow for the API isn't documented anywhere as far as I know.

So, can this update to the web app be rolled back, merged back to an older version of that login flow or can I at least know how I'm supposed to log in to this API in order to be able to start developing my own client?

Allright, I'm pissed.

Warning: more than 4k characters written by a non native english speaker ahead.

Legend:
Storytelling
> Short summary of the current situation
> "Something being said"
> (Something being thought)
* Actions *

-- Background --
In an attempt to reorganize my desktop I accidentally deleted a folder I called "development". In there I stored links to all my IDEs (Not sure how you call these in english), but also some workspaces like unity (Not much stuff there, processing (just some hobby stuff) AND Eclipse (FUCKING EVERYTHING RELATED TO SCHOOL WEB DEVELOPMENT). Now 3 days have passed and I realized this important folder was missing. Cleared that windows trash the instant I deleted the trash on my desktop.

> Shit, Regret

Install a file restore programm. Do every possible search. Nothing found.

> Big shit

Deadline was in like 3 days. Week was fucking rough so:
> "Screw this, the teacher nevet corrects the assignments and also fuck JSP"

Fast forward 2 months to last week. Teacher starts checking assignments.

> Fuck

* Sees pattern: Only students with missing or bad marks are checked. *

* Feels save *

Teacher approaching me while working on current projects.
* Doesn't feel save anymore *
> "Well, I'ld like to see your THAT programm"
> Well fuck
* Tells the truth *
> "Well that's unfortunate, but I must write a mark. Do you really have nothing to show?"
* Remember that I worked on the school pcs when I started *
> (Better than nothing. Gotta try it)
* Teacher checks programm, not pleased *

> (Fuck me, but at least it's over...)

> Nope

* Teacher calls me over *
> "With the mark I had to write today you can't reach that good mark even with a good examination, what are we gonna do about this?"

> "Well, there were other assignments that were never checked. Could we replace that mark with one of those?"

* Teacher agrees *
> (Srly bless this guy for that support)

My best choice was an Android app we had to develop during December in pairs. I did the front end (90% of the whole work) and my partner the backend (10 %). I also did 30 % of these 10 %, because I had to review the shit he wasn't able to debug himself.

> brainlogic.exe provided by windows vista

This distribution was partly my fault since I overestimated the work needed for the backend, but also the fault of that fucker. I mean, he didn't tell me the professor already provided 90 % of the backend...

Rest of the week was really busy (always 1 or 2 things to study for each day, workout and family stuff).

Yesterday (It's past 12 already) I arrived at ~9 pm in the dorm I could finally start reviewing my code.
Internet gets shut down at 10 pm.
Gotta hurry.

* Opens project *
* Sees half a year old code *
* Fights urge to puke *
> (Alright I gotta do this. For the mark!)
* waits for gradle to index files *
* Remembers the fact that I haven't opened Android Studio in the last 2 months *

For those who don't develop with android studio: This is an equivalent to ~10k windows updates waiting to be installed

> (Well, gotta work with this kinda old version)

"gradle sync failed"
> ( Ok, just restart it. You're fine )
* Android Studio doesn't react anymore and/or renders *
* Waits 5 min *
* Restarts laptop *
* Android Studio is reacting again*
"gradle is synching"
9:45 pm: gradle is done and I can finally compile my app

> FML

* Sees App launched on phone *
* Almost pukes again *

> (This was the assigment for the UX chapter, so design doesn't matter)

UX is decent. Proceeds with testing stuff. Save paths work, but some bugs can be caused by going of it

* fixes as much as possible *

* Takes quick look at backend *

Date date = new Date (GregorianCalender.getInstance().getTimeInMillis());

C'mon, I asked you to be the backend. You got 90% of the methods already written by the teacher and had 2 months to write the interfaces to my Front end AND you come up with shits like that.

Note: this example is a minor example of brainlogic.exe

I did what I could to make improve my situation. Hopefully he doesn't discover the bugs. And If it's a backend bug then I could't care less, since that was not my job!

Wish me luck for today!

Several rants ago I promised to drop a bombshell about Android. What took me so long was my research.

I wanted to measure the extent of Google’s background data mining. I put Android at a significant disadvantage — it was Redmi 6, a device with a 5-year-old half-dead battery that was heavily used by my partner. The only change was me installing Lineage OS + microG — a private, degoogled combo that has no quality of life ramifications. Google Play Store opens, apps download. MicroG emulates Google Play Services — maps, banking and other Play Services-dependent apps work flawlessly. This made a huge difference.

Before degoogling, this phone lasted one day tops on standby. Now, with Wi-Fi connection enabled, apps auto-update working (one game I had installed auto-updated during the test), and no battery saver engaged, I was able to pull ELEVEN DAYS on full charge. Battery saver promised even more uptime, but I considered that cheating.

Modern phones have modern screens that drain battery quickly. Yet, they also have 4000+ mAh batteries. If your Android smartphone performs worse than mine in a test like this that doesn't use screen, kiss your privacy goodbye.

More than 3GB ram is useless on android phones. Change my mind.

I bought cheap lg g5. It has 4gb ram (my old phone had 1gb ram). I have opened chrome with 4 tabs, an AAA game, devRant, Instagram, a vpn app, android settings and I'm listening music. There is still free 1,2 gb ram. Also this is not my everyday usage. I use maximum 3 apps at same time.

So I'm pretty sure that when I went all in to Apple's Siri shitfest and turned on "Hey, Siri" that I had to accept some kind of privacy notice or some shit. Essentially, being an iPhone user and turning on that service, I've agreed to allow them to listen to me.

But what about the guy who sits next to me? Are his rights to privacy being infringed because my phone can also hear him? If so, who is the one infringing? Me or Apple?

Apple is just an example, but imagine if someone has an Echo in an office or a Google Home. Or what if you're unknowingly standing next to someone with a Google or Apple device that's always listening?

I know my old Android phone had picked up people at the grocery store before. I never turned on "Ok Google" but I used the speech to text of the keyboard a few times. When people showed how you could go see what Google had "heard", I was surprised to find how many OTHER people it picked up.

Anyway, just some thinking.

A non-relationship database system with drag and drop + business process flows. It was fun at first, but like my Android phone, it slowed the **** down so much that it affected business operations. Must have been their evil plan all along.

Android + servers
Hey guys
So cause I barely have time to code I mounted a server with my old cellphone, so I can advance one of my projects at work (it's a helper with stuff like tables and calculators for work [CNC machine] )
The cell phone is a meizu m2 with android 6 (don't buy one, has lots of stupid bugs)
My problem: android terminates the server and a app I use to copy files from Dropbox to the server folder (only work arround the home rooter)
F king meizu bugs : resets lots of definitions to default, like I give permition to the server app to always be on and it changes back to default when I turn off the screen.
So when I turn of the screen the server goes down
Solutions to keep the server always awake?
Also better solution to change /upload the files without Dropbox as an intermediary
Btw the app that syncs also turns off every fucking time (so no updates till I get home)