Long story short, I'm unofficially the hacker at our office... Story time!

So I was hired three months ago to work for my current company, and after the three weeks of training I got assigned a project with an architect (who only works on the project very occasionally). I was tasked with revamping and implementing new features for an existing API, some of the code dated back to 2013. (important, keep this in mind)

So at one point I was testing the existing endpoints, because part of the project was automating tests using postman, and I saw something sketchy. So very sketchy. The method I was looking at took a POJO as an argument, extracted the ID of the user from it, looked the user up, and then updated the info of the looked up user with the POJO. So I tried sending a JSON with the info of my user, but the ID of another user. And voila, I overwrote his data.

Once I reported this (which took a while to be taken seriously because I was so new) I found out that this might be useful for sysadmins to have, so it wasn't completely horrible. However, the endpoint required no Auth to use. An anonymous curl request could overwrite any users data.

As this mess unfolded and we notified the higher ups, another architect jumped in to fix the mess and we found that you could also fetch the data of any user by knowing his ID, and overwrite his credit/debit cards. And well, the ID of the users were alphanumerical strings, which I thought would make it harder to abuse, but then realized all the IDs were sequentially generated... Again, these endpoints required no authentication.

So anyways. Panic ensued, systems people at HQ had to work that weekend, two hot fixes had to be delivered, and now they think I'm a hacker... I did go on to discover some other vulnerabilities, but nothing major.

It still amsues me they think I'm a hacker 😂😂 when I know about as much about hacking as the next guy at the office, but anyways, makes for a good story and I laugh every time I hear them call me a hacker. The whole thing was pretty amusing, they supposedly have security audits and QA, but for five years, these massive security holes went undetected... And our client is a massive company in my country... So, let's hope no one found it before I did.

devRant is awesome, but Disney also manages to light-up my day.
This is how Wall-E became a beloved member of our team, and helped me put a smile on my face throughout a very frustrating project.

It all started in a company, not so far far away from here, where management decided to open up development to a wider audience in the organization. Instead of continuing the good-old ping-pong between Business and IT...

'not meeting my expectations' - 'not stated in project requirements'
'stuff's not working - 'business is constantly misusing'
'why are they so difficult' - 'why don't they know what they really want'
'Ping, pong, plok... (business loses point) ping, pong'

... the company aimed to increase collaboration between the 2 worlds, and make development more agile.

The close collaboration on development projects is a journey of falling and getting back up again. Which can be energy draining, but to be honest there is also a lot of positive exposure to our team now.
The relevant part for this story is that de incentive of business teams throughout these projects was mainly to deliver 'something' that 'worked'. Where our team was also very keen on delivering functionality that is stable, scalable, properly documented etc. etc.
We managed to get the fundamentals in place, but because the whole idea was to be more agile or less strict throughout the process, we could not safeguard all best-practices were adhered to during each phase of a project. The ratio Business/IT was simply out of balance to control everything, and the whole idea was to go for a shorter development lifecycle.
One thing for sure, we went a lot faster from design through development to deployment, high-fives followed and everybody was happy (for some time).
Well almost everybody, because we knew our responsibility would not end after the collection of credits at deployment, but that an ongoing cycle of maintenance would follow. As expected, after the celebrations also complaints, new requirements and support requests on bug fixes were incoming.
Not too enthusiastic about constantly patching these projects, I proposed to halt new development and to initiate a proper cleaning of all these projects. With the image in mind of a small enthusiastic fellow, dedicated to clean a garbage-strewn wasteland for humanity, I deemed "Wall-E" a very suited project name. With Wall-E on board, focus for the next period was on completely restructuring these projects to make sure all could be properly maintained for the future.
I knew I was in for some support, so I fetched some cool wall papers to kick-start each day with a fresh set of Wall-E's on my monitors. Subsequently I created a Project Wall-E status report, included Wall-E in team-meetings and before I knew it Wall-E was the most frequently mentioned member of the team. I could not stop to chuckle when mails started to fly on whether "Wall-E completed project A" or if we could discuss "Wall-E's status next report-out". I am really happy we put in the effort with the whole team to properly deploy all functionality. Not only the project became a success, also the idea of associating frustrating activities with a beloved digital buddy landed well in our company. A colleagues already kickstarted 'project Doraemon', which is triggering a lot of fun content. Hope it may give you some inspiration, or at least motivate you to watch Wall-E!

PS: I have been enjoying the posts, valuable learnings and fun experiences for some time now. Decided to also share a bit from my side, here goes my first rant!

After 10 years of thinking of getting into gamedev, I just joined a team game jam and it's going somewhere.

4 months ago I wrote a rant about how difficult it was for me to get into gamedev.

I guess I finally started because:
a) I'm not doing this alone
b) Another person takes care of the art

Regarding "a", computing, programming can be a very lonely task. I realized how much I missed the college years where I was paired up with other people to do something

There's something magical about being in a team.
You may not be a fan of your mates personalities. You may even hate their guts.

But working on something together, when everyone does the thing they should do, when things just flow... it's just magical.

When that happens, "all the bullshit goes away"™, and it's just you and your team sharing the same hope.

As for "b", I think I realized that, at least for my way of thinking, art (even in an initial, rudimentary state) is what ends up creating a game.

While I always tried to do it the other way around, first the game, then the art.

Maybe now I could dabble into pixel art and then use that as the thing that would define the game.

I was also an emotional mess for most of my 20s (and still kinda am, but not that much), so I guess that made getting into gamedev hard too.

Now, here's the negative part: the guy that does the art (and also codes) sucks balls at communicating and at git.

He takes a shitload of time to respond, doesn't address the things I state are important, doesn't join the damn trello, sometimes gives me some sass on his comments.
And he accidentally overwrote my changes on git three times.

The good thing is that he acknowledges his fuckups and fixes them.

I'm not really mad though. I'm almost 30, he's 20 or so.

When I was 20 I was a goddamn mess.
And it's just a week, and the pleasure of working with someone is far greater.

Not as much of a rant as a share of my exasperation you might breathe a bit more heavily out your nose at.

My work has dealt out new laptops to devs. Such shiny, very wow. They're also famously easy to use.
.
.
.
My arse.
.
.
.
I got the laptop, transferred the necessary files and settings over, then got to work. Delivered ticket i, delivered ticket j, delivered the tests (tests first *cough*) then delivered Mr Bullet to Mr Foot.

Day 4 of using the temporary passwords support gave me I thought it was time to get with department policy and change my myriad passwords to a single one. Maybe it's not as secure but oh hell, would having a single sign-on have saved me from this.

I went for my new machine's password first because why not? It's the one I'll use the most, and I definitely won't forget it. I didn't. (I didn't.) I plopped in my memorable password, including special characters, caps, and numbers, again (carefully typed) in the second password field, then nearly confirmed. Curiosity, you bastard.

There's a key icon by the password field and I still had milk teeth left to chew any and all new features with.
Naturally I click on it. I'm greeted by a window showing me a password generating tool. So many features, options for choosing length, character types, and tons of others but thinking back on it, I only remember those two. I had a cheeky peek at the different passwords generated by it, including playing with the length slider. My curiosity sated, I closed that window and confirmed that my password was in.

You probably know where this is going. I say probably to give room for those of you like me who certifiably. did. not.

Time to test my new password.
*Smacks the power button to log off*
Time to put it in (ooer)
*Smacks in the password*
I N C O R R E C T L O G I N D E T A I L S.

Whoops, typo probably.
Do it again.
I N C O R R E C T L O G I N D E T A I L S.

No u.
Try again.
I N C O R R E C T L O G I N D E T A I L S.

Try my previous password.
Well, SUCCESS... but actually, no.

Tried the previous previous password.
T O O M A N Y A T T E M P T S

Ahh fuck, I can't believe I've done this, but going to support is for pussies. I'll put this by the rest of the fire, I can work on my old laptop.

Day starts getting late, gotta go swimming soonish. Should probably solve the problem. Cue a whole 40 minutes trying my 15 or so different passwords and their permutations because oh heck I hope it's one of them.
I talk to a colleague because by now the "days since last incident" counter has been reset.

"Hello there Ryan, would you kindly go on a voyage with me that I may retrace my steps and perhaps discover the source of this mystery?"

"A man chooses, a slave obeys. I choose... lmao ye sure m8, but I'm driving"

We went straight for the password generator, then the length slider, because who doesn't love sliding a slidey boi. Soon as we moved it my upside down frown turned back around. Down in the 'new password' and the 'confirm new password' IT WAS FUCKING AUTOCOMPLETING. The slidey boi was changing the number of asterisks in both bars as we moved it. Mystery solved, password generator arrested, shit's still fucked.

Bite the bullet, call support.
"Hi, I need my password resetting. I dun goofed"
*details tech support needs*
*It can be sorted but the tech is ages away*
Gotta be punctual for swimming, got two whole lengths to do and a sauna to sit in.
"I'm off soon, can it happen tomorrow?"
"Yeah no problem someone will be down in the morning."

Next day. Friday. 3 hours later, still no contact. Go to support room myself.
The guy really tries, goes through everything he can, gets informed that he needs a code from Derek. Where's Derek? Ah shet. He's on holiday.

There goes my weekend (looong weekend, bank holiday plus day flexi-time) where I could have shown off to my girlfriend the quality at which this laptop can play all our favourite animé, and probably get remind by her that my personal laptop has an i2350u with integrated graphics.

TODAY. (Part is unrelated, but still, ugh.)
Go to work. Ten minutes away realise I forgot my door pass.
Bollocks.
Go get a temporary pass (of shame).
Go to clock in. My fob was with my REAL pass.
What the wank.
Get to my desk, nobody notices my shame. I'm thirsty. I'll have the bottle from my drawer. But wait, what's this? No key that usually lives with my pass? Can't even unlock it?
No thanks.

Support might be able to cheer me up. Support is now for manly men too.
*Knock knock*
"Me again"
"Yeah give it here, I've got the code"
He fixes it, I reset my pass, sensibly change my other passwords.
Or I would, if the internet would work.

It connects, but no traffic? Ryan from earlier helps, we solve it after a while.

My passwords are now sorted, machine is okay, crisis resolved.

*THE END*

If you skipped the whole thing and were expecting a tl;dr, you just lost the game.

Otherwise, I absolve you of having lost the game.

Exactly at the char limit

Stupid pipeline bullshit.

Yeah i get it, it speeds up development/deployment time, but debugging this shit with secret variables/generated config and only viewable inside kubernetes after everything has been entered into the helm charts through Key Vaults in the pipeline just to see the docker image fail with "no such file found" or similar errors...

This means, a new commit, a new commit message, waiting for the docker build and push to finish, waiting for the release pipeline to trigger, a new helm chart release, waiting for kubernetes deployment and taking a look at the logs...

And another error which shouldn't happen.

Docker, fixes "it runs on my machine"
Kubernetes, fixes "it runs on my docker image"
Helm, fixes "it runs in my kubernetes cluster"

Why is this stuff always so unnecessarily hard to debug?!

I sure hope the devs appreciate my struggle with this... well guess what, they won't.

Anyways, weekend is near and my last day in this company is only four months away.

Second fecking time since January, I thought these things were meant to be "low maintenance"! (Though in fairness this time is sort of my fault, I may have accidentally edited the MacOS Python files instead of the downloaded ones)

TLDR;
How much do you earn for your skill set in your country vs your cost of living?
BONUS;
See how much I & others earn.

Recently I became aware of just how massive the gap in developers earnings are between countries. I'd love to calculate a fixed score for income vs cost of living.

I know this stuff is sensitive to some so if you prefer just post your score (avg income p/m after tax / cost of living).

I'm not shy so I'll go first:

MY RATES
Normal Rate (Long term): $23
Consulting / Short term: $30-$74
Pen Test: $1500 once off.
Pen Test Fixes: consulting rate.
Simple work/websites: min $400+
Family & Friends: Dev friends are usually free (when mutually beneficial). Family and others can fuck off, even if they can pay (I pass their info to dev friends with fair warning).

GENERAL INFO
Experience: 9 years
Country: South Africa
Developer rareness in country: Very Rare (+-90 job openings per job seeker).
Middle class wage in country: $1550 p/m (can afford a new car, decent apartment & some luxuries like beer/eating out).
Employment type: Permanent though I can and do freelance occasionally.
Client Locality: Mostly local.
Developer Type: Web Developer (True web dev - I do anything web related from custom HTTP servers to sockets, services, advanced browser api's, apps & more).

STACKS / SKILLSETS

I'M PROFICIENT IN:
python, JavaScript, ASP classic, bash, php, html, css, sql, msql, elastic search, REST, SOAP, DOM, IIS, apache

I DABBLE WITH:
ASP.net, C++, ruby, GO, nginx, tesseract

MY SPECIALTIES:
application architecture, automation, integrations, db's, real time data, advanced browser apps/extensions (webRTC, canvas etc).

SUMMARY
Avg income p/m after tax: $2250
Cost of living (car+rent+food): $1200
Score: 1.85

*Note: For integrity when calculating my cost of living I excluded debt repayments and only kept my necessities which are transport, food & shelter.

I really hope you guy's post your results, it would be great to get an idea of which is really the worst / best country to be a developer in.

Below is a transcript from work Slack today. Only the names and some code are changed. It ended up causing a bit of drama. DevRanters, what do you take from this?

---

Delivery Lead:
Hey Gang. What's the blocker for FEATURE-123?

Dev1:
FEATURE-122 crashed on iOS app when viewing Feature Introduction page.

Teach Lead:
I've talked about this with Dev1 on a side channel.
And diagnosed the stack trace.
It looks like there is/was some bad handling of a List in the Feature Introduction view logic.
But this is confined to changes that Dev2 is still working on.
(It's not present in master)
Dev2, what's your current position on this?

Dev2:
I have tested at my end with Dev1 but it seems to be working fine

Tech Lead:
There is a race condition related to the use of someList.first()
My guess is that theres a Flow of those lists defined, with an initial value of emptyList
And that on your machine, that Flow is updating with a new value quickly enough that it doesn't matter.
But on Dev1's, for whatever reason, it doesn't get there in time, hits the empty list and falls over.
The logic that's performing the first() needs to gracefully handle empty lists as well.

Dev2:
Where is that logic called?

Tech Lead:
Here's the stack trace Dev1 provided in our conversation earlier:
Caused by: kotlin.NoSuchElementException: List is empty.
...
at 3 iosApp 0x00000000 kfun:kotlin.NoSuchElementException#<init>(kotlin.String?){} + 00
at 4 iosApp 0x0000000 kfun:kotlin.collections#first@kotlin.collections.List<0:0>(){0§<kotlin.Any?>}0:0 + 000
...
at 9 iosApp 0x0000000 kfun:kotlin.coroutines.native.internal.BaseContinuationImpl#resumeWith(kotlin.Result<kotlin.Any?>){} + 0000

This line:
kfun:kotlin.collections#first@kotlin.collections.List<0:0>()
...says that it's first() being called on an empty list.

Dev1:
FYI: Dev3/Dev4/myself are seeing the same issue with the same stack-trace above.

Tech Lead:
So Dev2, have you introduced such a call?
Because I checked master branch and there isn't one, in that version of the file.
Ok, I'll check your working branch Dev2
...
Yes you have here:
var processed1 = someList.first()
var processed2 = someList.first()
...
Lines 123, 124.
Solution looks really straightforward guys.

Dev2:
Okay, I will fix that and push the change

Tech Lead:
Check if someList is empty and allow for generating / handling null processedValues in the view.

Now; I'm going to be straight with you here.
This issue has been discussed over several hours today.
I expect that either one of you could have gone through the process I did in the last 10 minutes above, and resolved it in the same way :point_up:

Dev2:
I went on a break and it's not reproducible on my machine

Tech Lead:
I didn't reproduce it on mine either.

Dev1:
Dev2 and myself are now on sharing screen to sort this issue out. Hope to update back later.

Tech Lead:
<Screen shot of diff with changed code>
:point_up: That change should do it.

Dev2:
Already have pushed the change.

Tech Lead:
...just seen it, is good - same approach :ok_hand:
Dev1 please let us know when tested on your machine.

Dev1:
That does it. It fixes the issues. Thank you, Dev2. I will pick it off from here.

Tech Lead:
Glad to hear it guys.

Dev1:
I have to say this that it is not because we are not working on the issue - Dev2 and myself (together with Dev3/Dev4) have been on this issue all this morning. It just difficult to connect the dot when it wasn't reproducable on Dev2's machine. I brought the issue up because I wanted to switch to working on other tickets while waiting for this to resolve. Still thank you largely for Dev2's work and your keen eyes that spot and resolve the issue quickly.

Tech Lead:
Noted Dev1.
I think the take-away has to be to read the stack-trace carefully... don't worry - we've all been guilty of not reading the error in full, at some point.
The stack trace said that the 'first' element is being referenced from an empty list - that's just logically impossible, right?
Looking for that call to first, we saw it wasn't in the code before, and is after (two of them, in fact).
So then we ask ourselves, how can we deal with an empty list - and then solution almost presents itself.
It didn't really take reproduction of the error to resolve.
Maybe working with a new tech stack creates an anxiety that every issue faced will have a complex solution related to that stack; but I think you'll agree, this particular issue really just required a deep breath and your trusty 'debugging skills 101'... don't lose them! :smiling_face:

Dear app, if you say that your update is for bug fixes, you better fix all those bugs instead of releasing and releasing an update with the same bugs still there. Better look into the UI/UX issues too. Your app looks horrible! Last time I was involved in it, everything is looking so fine I haven't had a bad review for a long time. Hope you can read this. #ktnxbye

As someone who has been developing a game (not even close to 20% done) and dealing with bug reports, I'm pissed off by this one report from a game I play, which I'll just shamelessly copy-paste it here for y'all to read and rant
"Title: [sic]lag never fixed
[sic]i dont wanna report lag doesnt mean there's no lag ,
the LAG is real, and is getting worse and worse everyday, vespa please fix the problem,
i used to think i could bear this lag, but i cant ,i just cant, after 5+ times game crashing everyday,my patient is losing . you say u are fixing it every maintenance,but what is this BXXX SXXX?all i could see it you are trying your best to grab money from my wallet(well u FXXXING successed),and the promise you made to fix the lag never ever ..........
sorry for my bad Chiglish, but./......"

I'm not a developer of the game, but this pisses me off. The guy wants fixes on the "lag"; which lag?? latency?? FPS?? random freezes??; while giving absolutely ZERO details on the "lag" AND accusing the company of stealing money without doing sh-t, which is not true as far as I can tell in-game. So, I instinctively waltzed in and ranted at how sh-t the report is in detail, and accused him of inhibiting the game's development because of his sh-t report, and he replied with this (I told him I'm a game dev in the reply I mentioned):
"[sic]as a person who made this game should know what lag is just like u know what fuk is as a human being,and i said game crash ,thats the best way i could explain as a normal player not like you an arrogant indie game dev!and if u cant understand what course the game crash,as a player like me how could i know, thats the reason im asking for help here,and i hope they dont have such indie game dev like you who doesnt know lag(game crash)"

M-th-rf-ck-r. For the first time, I see true ignorance. While writing this, I'm typing my next reply for the m-th-rf-ck-r that lacks common sense on reporting a bug. For f-ck sake if I found him I'll put a bullet through his head.

As a follow-up to my last rant, I figured out the SQL (well, WQL) query that would get me what I wanted: a collection of machines that had an error on a deployment.

I also figured out how to automate fixing the error'd machines and turning all of my possible fixes into one script that would also auto-deploy to the collection that was made with the query.

My senior coworker is impressed. He has been doing it manually for years and I was hired partially to take the load off of him. They're putting me on some more challenging projects and it's nice to be a better part of the team.

Not much of a rant, or even much of a developer thing, but I hope this bit of positivity makes for a lighter read in your Algo.