Looks like Matrix just got educated on hiding administrative stuff behind a VPN, by the guy (or gal, but those don't exist on the internet) that hacked their production infrastructure. Coincidentally, it reminded me of that time when a dev wanted to educate me, a sysadmin, about VPN's 😄
https://devrant.com/rants/2030041

What I've learned from this incident are 2 things.. well mainly 2 things.

1. Never *ever* entrust developers with production access. Let DevOps take care of the glue that sticks dev and prod together.
2. Trust nobody's competence but your own. Matrix was advertised as "highly secure", and then they do a fuckup like this. Only trust yourself, and ensure that you're in control.

just found out a vulnerability in the website of the 3rd best high school in my country.

TL;DR: they had burried in some folders a c99 shell.

i am a begginer html/sql/php guy and really was looking into learning a bit here and there about them because i really like problem solving and found out ctfs mainly focus on this part of programming. i am a c++ programmer which does school contest like programming problems and i really enjoy them.

now back on topic.

with this urge to learn more web programming i said to myself what other method to learn better than real life sites! so i did just that. i first checked my school site. right click. inspect element. it seemed the site was made with wordpress. after looking more into the html code for the site i concluded all the images and files i could see on the site were from a folder on the server named 'wp-content/uploads'. i checked the folder. and here it got interesting. i did a get request on the site. saw the details. then i checked the site. bingo! there are 3 folders named '2017', '2018', '2019'. i said to myself: 'i am god.'
i could literally see all the announcements they have made from 2017-2019. and they were organised by month!!! my curiosity to see everything got me to the final destination.

with this adrenaline i thought about another site. in my city i have the 3rd most acclaimed high school in the country. what about checking their security?

so i typed the web address. looked around. again, right click, inspect element and looked around the source code. this time i was more lucky. this site is handmade!!! i was soooo happy because with my school's site i was restricted with what they have made with wordpress and i don't have much experience with it.

amd so i began looking what request the site made for the logos and other links. it seemed all the other links on the site were with this format: www.site.com/index.php?home. and i was very confused and still am. is this referencing some part of the site in the index.php file? is the whole site written inside the index.php file and with the question mark you just get to a part of the site? i don't really get it.

so nothing interesting inside the networking tab, just some stylesheets for the site's design i guess. i switched to the debugger tab and holy moly!! yes, it had that tree structure. very familiar. just like a project inside codeblocks or something familiar with it. and then it clicked me. there was the index.php file! and there was another folder from which i've seen nothing from the network tab. i finally got a lead!! i returned in the network tab, did a request to see the spgm folder and boooom a site appeared and i saw some files and folders from 2016. there was a spgm.js file and a spgm.php file. there was a contrib, flavors, gal and lang folders. then it once again clicked me! the lang folder was las updated this year in february. so i checked the folder and there were some files named lang with the extension named after their language and these files were last updated in 2016 so i left them alone. but there was this little snitch, this little 650K file named after the name of the school's site with the extension '.php' aaaaand it was last modified this year!!!! i was so excited! i thought i found a secret and different design of the site or something completely else! i clicked it and at first i was scared there was this black/red theme going on my screen and something was a little odd. there were no school announcements or event, nononoooo. this was still a tree structured view. at the top of the site it's written '!c99Shell v. 1.0...'

this was a big nono. i saw i could acces all kinds of folders. then i switched to the normal school website and tried to access a folder i have seen named userfiles and got a 403 forbidden error. wopsie. i then switched to the c99 shell website and tried to access the userfiles folder and my boy showed all of its contents. it was nakeeed naked. like very naked. and in the userfiles folder there were all, but i mean ALL files and folders they have on the server. there were a file with the salary of each job available in the school. some announcements. there was a list with all the students which failed classes. there were folders for contests they held. it was an absolute mess and i couldn't believe it.

i stopped and looked at the monitor. what have i done? just to learn some web programming i just leaked the server of the 3rd most famous high school in my country. image a black hat which would have seriously caused more damage. currently i am writing an email to the school to updrage their security because it is reaaaaly bad.

and the journy didn't end here. i 'hacked' the site 2 days ago and just now i thought about writing an email to the school. after i found i could access the WHOLE server i searched for the real attacker so if you want to knkw how this one went let me know in the comments.
sorry for the long post, but couldn't held it anymore

Welcome to post 2 of WHY WOULD I WANT TO WORK WITH YOU?, a saga of competence, empathy and me being dick, even tho I didn't want to be one.
This is a follow-up to: https://devrant.com/rants/2363374 It's title is: "Oh, you can post only every 2h. Didn't know that". I also didn't know that the rest of my rant would be put into a comment. For consistency tho, this time I am still splitting the story.

A wise person once wrote in their book: "People judge other people by two things: Empathy and competence." This may not be an accurate quote, but it carries the same message. Also, I don't really remember who was the author. I only know they were probably quite wise. Anyway, I just wanted to share that sentence. Have a moment and think about it. Or don't. Here's my story:

A was a software house that looked pretty promising. They were elegant, their page and offer looked nice. Well, unless you consider the fact that they offered me internship. Unpaid. But I decided to meet with them anyway, since I had hope that I could negotiate some sort of paid internship or a job contract even. I did my homework after all, and I was confident I am able to keep up with their requirements. I arrived a little bit... no, way to early. One damn hour. Whatever, I waited. I was greeted by a woman. We had a cultural conversation, she had a list of 12 questions I needed to answer, as a form of a test. We begun. First question: How do you change a value in Oracle Database? "Wait a minute", I thought, "What kind of question is that?". Why in seven hells would you want your frontend developer to know how to handle oracle db? Well, I gave my answer, I did lick some of that SQL in my life. Next question: Java stuff. The bloody gal didn't even care to check what position I am applying to before the interview! At this point I didn't really have very high hopes. A shame on them forever.

The story of B and C is connected and a little bit more complicated. More on that in part 2. B stands for Bank. A big corporation then, by definition. A person I know decided called me that day and told me they're hiring, that he referred me and that they would like to arrange a meeting. And so we did. It was couple of days before Christmas. C was a software house again. Or a startup. Idk really. Their website wasn't finished so I couldn't read anything useful up on them. They didn't tell me much about themselves either. They also started with "unpaid internship".

In C, they would greet me and instantly sit me down next to a mac laptop and told me, "hey, do this stuff in python". What the fuck, not again... I told them that I am frontend dev, they guy said "it's no problem, you said you know python, it's a simple task". And yeah, I did host some apps in Flask and I did use psycopg2. It was in my CV. But never, ever, have I mentioned knowing heuristics nor statistics. I'm no data scientist, monsieur. Whatever, I tried, I failed a little bit, I told them that maybe if I did want to spend half of my day there I would finish this task, but back then I was way too nervous to focus and code. I told them what should be done in code and that I just was unable to code this at the very moment. They nodded, we said goodbye and I was sure not to hear from them ever again.

In B, I was greeted by a senior frontend dev. He told me the recruiter is sick and he couldn't come, so we're talking alone. I can buy it. We sat down in said meeting room, and he asked me if I wanted a drink. No thx, I had digested so much caffeine during last 24h, next dose could be an overdose. And then, he took out my resume printed in paper. With notes on it. With some stuff encircled. That bloody bastard did his homework. We spent over an hour, just talking in friendly atmosphere. It was an interview, but it was a conversation also. We shared our experiences, opinions and it went just perfect.

On December 20, I was heading home for Christmas. My situation looked like this: A called me they could offer me only unpaid internship. I was getting kinda bored of rice and debts, tbh. I gracefully rejected their generous offer. B didn't give me feedback yet(it was a most recent interview, so I didn't expect any message until after Christmas anyway). C told me that they could give me internship, but I managed to convince them to make it paid internship. After three months of very bad times, things were starting to get better.

On part III we will explore further events of my very recent past. That post will be same amount of storytelling and possibly a lesson for those who seek an employer and for those who seek an employee.

Hello, Hi! Friendly neighbourhood noob here!

What’s he stuck on today you ask? React and Firebase!

Did he try? Yes he did! Only a little hitch this time.

Really? Little?
...It’s all relative... like the truth!

Anyway PLEASE someone look at my StackOverflow question!!

https://stackoverflow.com/questions...

Firebase and react are awesome tbh. But I cant figure this out!

Thank you!!

this aint working for some reason. unless im missing something then im completely stumped.

https://gyazo.com/37598c63be6af4702...

can someone please tell me what’s wrong?

It’s an array of objects that im trying to turn into options for a selector with the id prop being the value and the name prop being the actual text but it keeps saying select.add or appendCHild isn’t a function. now im lost.

god i hate tests, i know they are needed but damn