Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
Dev: Can you please tell me why you changed this?
Me: Because we need to handle permissions in the app. The quickest way of doing it, according to the docs, is [insert change log here]
Dev: But we can just check for the user's token.
Me: That's not exactly a permission, because...
Dev: I was only showing the information related to the user according to their token.
Me: I understand. But that means you're filtering data, not authorising users to access it. If a user is logged in, but changes query parameters, they can still access data they shouldn't be able to.
Dev: Whatevs.
Le me then proceeds to try to push my changes (that took the whole day to implement), gets a "you need to pull first" message from git, doesn't understand why, logs onto GitHub and realises dev has implemented their "permissions".
I was the one responsible for making those changes. Le dev was meant to be doing other things.
How do I even begin to explain?7 -
Embarrassing moment:
Needed to deliver apk urgent urgently for push notification testing. I was unable to receive push token. Code is right in every way. Couldn't figured out in 15min. Lead comes to my seat and asks what's issue. And hey suddenly I figured it out. It was my wifi closed.. Bullshit 😬😠4 -
So after 6 months of asking for production API token we've finally received it. It got physically delivered by a courier, passed as a text file on a CD. We didn't have a CD drive. Now we do. Because security. Only it turned out to be encrypted with our old public key so they had to redo the whole process. With our current public key. That they couldn't just download, because security, and demanded it to be passed in the fucking same way first. Luckily our hardware guy anticipated this and the CD drives he got can burn as well. So another two weeks passed and finally we got a visit from the courier again. But wait! The file was signed by two people and the signatures weren't trusted, both fingerprints I had to verify by phone, because security, and one of them was on vacation... until today when they finally called back and I could overwrite that fucking token and push to staging environment before the final push to prod.
Only for some reason I couldn't commit. Because the production token was exactly the same as the fucking test token so there was *nothing to commit!*
BECAUSE FUCKING SECURITY!5 -
Me:
* Builds Project and Hosts it *
* thinking * : * ' I don't really need to push to Master, I'll just push it to the deployed branch *
Me: * tests project from host *
Me: * sees a bug, fixes it and rebuilds the project, hosts it and pushes code to deployed branch *
4Hrs Later:
Colleague: Dude did you see the Typos you made? Fix them!
Me: In my defence, I wrote this at 4am in the morning, did not sleep for 2 days.
Colleague: Don't Care, fix it.
Me: *Creates Hotfix Branch from Master*
* INSTALLS DEPENDANCIES AND FINDS OUT A NEW VERSION IS OUT AND UPDATES THAT AS WELL *
* Runs Project and finds out it's not the hosted version. *
* Merges Deployed Brunch to Hotfix Brunch and this happens *
Error Message: Unexpected token
620 Merge Conflicts
🤦🏽♂️🤦🏽♂️🤦🏽♂️
2 -
Trying to switch my job. Applied for a well known company. Gave an interview today. I don't fucking get the obsession of these developer recruiters so fixated on data structures and algorithms. I know it's a massive part of computer science but guess there is no fucking room left to innovate in there. There are legitimate researcher teams working for implementation of these barebones inside system foundations. No general software developer gives a fuck about this piece of shit discipline of study. You wanna know why they propagate this as the panacea to test people because it's fucking easy. Give a project to somebody as interview procedure, it'll take time to bring out an interesting problem and an interesting solution to that. Sorry to say but all these data structure enthusiasts are nothing better than board game enthusiasts.
Also why can't you refer existing solutions to create your solution. I've seen some good problems which actually require you to think. But again those are heavy and can't be tested so you're left with reversing a fucking linked list with O(1) auxillary space. Fuck me ig.
Moreover, what the fuck is wrong with the moral policing internet crowd. Its so sad. I've hardly seen anybody rant about this piece of shit system put in place to push the absolute dead-end nutcases up the ladder. Every other search for it returns a Quora link with some Indian guy complaining about his interviews and in the comments you have the same scholars sitting in their data structure throne imparting knowledge about how data structure holds the fabric of reality together.
I don't hate data structures and algorithms as a subject. It is cool and quite extensive but once you try to make that as a metric of all the knowledge in the world, you've lost my drift. Maybe I'm just angry with the state of things. Maybe I'm just angry with token Quora crowd.3 -
Working for a startup building a device / app that let you answer your landline phone on your mobile, and get notifications of missed calls etc.
While developing I purposely didn't secure the endpoint that controlled push notifications.
I waited for the boss to sign up, went to the DB and stole his token. From time to time i'd send a request telling him he missed a call from his wife or son.
... then kicked back and watched the madness and frustration ensue. -
What the hell kind of tool is Gitlab? I just want to automatically backmerge hotfixes from master to development. Even fucking Bitbucket had a checkbox to enable this. But not Gitlab, no, you better create a pipeline job in your already unreadable, overcrowded pipeline yml, but oh, the checked out repo in the pipeline is a detached head and you cant push with the user that checks out there. So what, just use a project acess token which revokes after a year breaking your task and then switch origin amd branch manually. But your token-user can't push to protected branches, so create a merge request instead, which requires approvals, making the automated step no longer automated.
But dont worry, you can just use the gitlab api to overwrite the approval rules for this MR so it requires 0 approvals. But to do so you must allow everyone to be able to overwrite approval rules therefor compromising security.
And so you made a feature that should effectively be a checkbox a 40+ line CI job which compromises your repo security.
which nuthead of an architect is responsible for the way gitlab (and its CI) is designed?4 -
VSCode doesn't request permission to edit github workflow files by default. Because it's an OAuth app and not a token, I can't grant it scopes that it did not request. I am forced to use SSH or a personal token instead of VSCode's built-in Github authentication, but because there's no convenient way to have VSCode forget that it authenticated a repo, I am also forced to checkout my own repo again and push the changes across.
If you want your product to Just Work, then Just Use Open Processes that are easy to hook into, interrupt or partially replace. Nobody can think of everything. Not even Apple's or Microsoft's mighty designers. What everyone can do is to provide graceful failure modes and offer partial strategies. -
Againg symfony shitty:
look - I want to validate csrf. I found docs how to do it.
https://symfony.com/doc/2.8/...
"if ($this->isCsrfTokenValid('token_id', $submittedToken)) {
// ... do something, like deleting an object
}"
But how the fuck should I know what is token_id from this stupid writing?
I have debugged their code to find it out. What a fucking waste of time !!! Free shit. Companies could probably pay small fee for the symfony if they could find people who do better job. Because by paying salaries for finding such shit costs them anyway.
And there was a htmls where the token was:
<form name="form" method="post" action="/admin/policy/47/push-im-xml">
<button class="btn btn-xs btn-info" type="submit">Push IM XML to GA</button>
<input type="hidden" id="form__token" name="form[_token]" value="LDVrl52CYtbT-kDudsjzrNAdJuIyFZhafsgk9QDnWGs"></form>
Guess what was token_id : form
:D whf. How the fuck could I know? I have tried various ways before debugging liek form_token, form[_token], _token
Who could fucking think its 'form' ?!!!! Wth. This is a joke.9 -
I logged into BitBucket, opened my repo, and clicked on my Trello board. Why did I have to log into my Trello board? Trello is now connected to your Atlassian account, I got an email about it. It's the same username/password. It exists. They know it does, because they're the ones that told me. Create a token and pass it to Trello for me so that I don't have to log in. It isn't all that difficult. I can hear you now: "What if they have a different Trello account they want to log into because...{reasons}?" Then you can have a handy little "Switch Account" button or something that will log them out, log them into their new account, and display that data. One button push for them, no buttons for the rest of us.2
-
Almost finished with latest preprocessor.
Why am I always working on preprocessors tho? Shit...
Anyway, almost finished ok.
Idea is, basically, that inside a C source or header you can write a perl subroutine instead of `#define ...`.
The mechanism is rather simple:
```C (wat?)
macro mymacro($expr) {
· // perl code goes here
· return "$expr;"
};
```
`$expr` is just a string holding whatever block of code comes after an invocation of `mymacro`. You can use the builtins `tokenshift` and `tokenpop` on a string to get the first and last token, respectively, and then `tokensplit` gives you *all* the tokens.
Whatever string you return is what the expression you received is replaced by:
- You can just give back the expression as-is to get the exact same thing you wrote -- so `mymacro char* wat;` gives you `char* wat;`.
- But if you return a galaxy's worth of C code, then bam. Macro expanded into it, just like that. It's a perl subroutine, so let your imagination fly. Wanna run some scripts at (pre)compile time? Then you can.
- If you return an empty string, then puff. No code. Input consumed.
- If you give the name of another macro (eg "another_macro $expr;"), the expansion recurses.
- If you return the name of the currently executing macro, no recursion happens. This lets you wrap C keywords without (too much) fear.
It's kind of cool because a separate perl module is built from the macros themselves. So then you can include those in another C file. Syntax is basically more perl because why not:
```C (yes)
package mypkg;
· use lib "path/to/myshit/";
· use pm funk qw(mymacro);
```
The `lib` bit actually translates to `-I(path)` for gcc. But for some reason the way you add an include path in perl is `use lib "path"`, so yep. I get it's confusing but just go with the ::~ f l o w ~:: ok.
Then the `pm` stuff is not valid perl (i think), but I took the easy way out and invented it to ensure there is a way to say "OK I don't give a single shit about the C stuff, just give me these qw()'d funky macros from this file." If you simply `use funk qw(mymacro)` then you also get an `#include "funk.h"`.
Speaking of which, headers are automatically generated. Yeah, fuck you, I added `public` to C, bite me. It's actually quite sexy as I defined it using the preprocessor:
```C (yes but actually perl)
macro public($expr) {
· my $dst=cmamout()->{export};\
· tokentidy $expr;
· push @$dst,$expr;
· return "$expr;";
};
```
Where `cmamout()` is a hash from which the output is generated. Oh, and `tokentidy` is just a random builtin that cleans up extra whitespace, don't mind it.
So now the bad stuff: I have to fix a few things. For instance, notice how I had to escape a new line there? Yeah. It's called dumb fix to shit parsing, of course.
But overall I'm quite satisfied with this. And the reason why may not be so obvious so I'ma spill it out: backticks, motherfucker.
That's right. Have a source emitter written in an esoteric language?
```C (yes really but not really)
macro bashit($expr) {
· my ($exe,@args)=tokensplit $expr;
· return `$exe @args`;
};
```
So now you can fork off into parallel dimensions; what can I say pass the pipe brother.
MAMmoth in the room is yes, this depends on MAM. What is MAM? MAMMI. It's the original name of my infamous picture of an ouroboros eating it's own ass while stuck in limbo contemplating terrible life decisions of a build tool, avtomat (go ARSLASH <AR/> [habibi]).
So what's the deal with that? avtomat is a good build tool _for me_, not... ugh, you. I made it for *myself* baby things are not going to work out between us I'm sorry. MAM just does lots of things I wanted build tools to do in the __EXACT__ way I wanted them done. I'd say you should go use it too maybe, but actually don't and you shouldn't because I broke main some weeks ago to fix some other shit and then implement this. Yeah, pretty stupid, but what the hell. I'm the only user after all!
In conclusion, I am fully expecting to receive my mad props and street cred in the mail along with your marriage proposals en masse, effective immediately.
Further reading: https://youtube.com/watch/...5
Top Tags
Weekly Rant
View