Hey everyone,

First off, a Merry Christmas to everyone who celebrates, happy holidays to everyone, and happy almost-new-year!

Tim and I are very happy with the year devRant has had, and thinking back, there are a lot of 2017 highlights to recap. Here are just a few of the ones that come to mind (this list is not exhaustive and I'm definitley forgetting stuff!):

- We introduced the devRant supporter program (devRant++)! (https://devrant.com/rants/638594/...). Thank you so much to everyone who has embraced devRant++! This program has helped us significantly and it's made it possible for us to mantain our current infrustructure and not have to cut down on servers/sacrifice app performance and stability.
- We added avatar pets (https://devrant.com/rants/455860/...)
- We finally got the domain devrant.com thanks to @wiardvanrij (https://devrant.com/rants/938509/...)
- The first international devRant meetup (Dutch) with organized by @linuxxx and was a huge success (https://devrant.com/rants/937319/... + https://devrant.com/rants/935713/...)
- We reached 50,000 downloads on Android (https://devrant.com/rants/728421/...)
- We introduced notif tabs (https://devrant.com/rants/1037456/...), which make it easy to filter your in-app notifications by type
- @AlexDeLarge became the first devRant user to hit 50,000++ (https://devrant.com/rants/885432/...), and @linuxxx became the first to hit 75,000++
- We made an April Fools joke that got a lot of people mad at us and hopefully got some laughs too (https://devrant.com/rants/506740/...)
- We launched devDucks!! (https://devducks.com)
- We got rid of the drawer menu in our mobile apps and switched to a tab layout
- We added the ability to subscribe to any user's rants (https://devrant.com/rants/538170/...)
- Introduced the post type selector (https://devrant.com/rants/850978/...) (which will be used for filtering - more details below)
- Started a bug/feature tracker GitHub repo (https://github.com/devRant/devRant)
- We did our first ever live stream (https://youtube.com/watch/...)
- Added an awesome all-black theme (devRant++) (https://devrant.com/rants/850978/...)
- We created an "active discussions" screen within the app so you can easily find rants with booming discussions!
- Thanks to the suggestion of many community members, we added "scroll to bottom" functionality to rants with long comment threads to make those rants more usable
- We improved our app stability and set our personal record for uptime, and we also cut request times in half with some database cluster upgrades
- Awesome new community projects: https://devrant.com/projects (more will be added to the list soon, sorry for the delay!)
- A new landing page for web (https://devrant.com), that was the first phase of our web overhaul coming soon (see below)

Even after all of this stuff, Tim and I both know there is a ton of work to do going forward and we want to continue to make devRant as good as it can be. We rely on your feedback to make that happen and we encourage everyone to keep submitting and discussing ideas in the bug/feature tracker (https://github.com/devRant/devRant).

We only have a little bit of the roadmap right now, but here's some things 2018 will bring:

- A brand new devRant web app: we've heard the feedback loud and clear. This is our top priority right now, and we're happy to say the completely redesigned/overhauled devRant web experience is almost done and will be released in early 2018. We think everyone will really like it.

- Functionality to filter rants by type: this feature was always planned since we introduced notif types, and it will soon be implemented. The notif type filter will allow you to select the types of rants you want to see for any of the sorting methods.

- App stability and usability: we want to dedicate a little time to making sure we don't forget to fix some long-standing bugs with our iOS/Android apps. This includes UI issues, push notification problems on Android, any many other small but annoying problems. We know the stability and usability of devRant is very important to the community, so it's important for us to give it the attention it deserves.

- Improved profiles/avatars: we can't reveal a ton here yet, but we've got some pretty cool ideas that we think everyone will enjoy.

- Private messaging: we think a PM system can add a lot to the app and make it much more intuitive to reach out to people privately. However, Tim and I believe in only launching carefully developed features, so rest assured that a lot of thought will be going into the system to maximize privacy, provide settings that make it easy to turn off, and provide security features that make it very difficult for abuse to take place. We're also open to any ideas here, so just let us know what you might be thinking.

There will be many more additions, but those are just a few we have in mind right now.

We've had a great year, and we really can't thank every member of the devRant community enough. We've always gotten amazingly positive feedback from the community, and we really do appreciate it. One of the most awesome things is when some compliments the kindness of the devRant community itself, which we hear a lot. It really is such a welcoming community and we love seeing devs of all kind and geographic locations welcomed with open arms.

2018 will be an important year for devRant as we continue to grow and we will need to continue the momentum. We think the ideas we have right now and the ones that will come from community feedback going forward will allow us to make this a big year and continue to improve the devRant community.

Thanks everyone, and thanks for your amazing contributions to the devRant community!

Looking forward to 2018,
- David and Tim

About 18 months ago my non-technical Manager of Applications Development asked me to do the technical interviews for a .NET web developer position that needed to be filled. Because I don't believe in white board interviewing (that's another rant), but I do need to see if the prospective dev can actually code, for the initial interview I prepare a couple of coding problems on paper and ask that they solve them using any language or pseudo code they want. I tell them that after they're done we'll discuss their thought process. While they work the other interviewing dev and I silently do our own stuff.

About half way through the first round of technical interviews the aforementioned manager insisted we interview a dev from his previous company. This guy was top notch. Excellent. Will fit right in.

The manager's applicant comes in to interview and after some initial questions about his resume and experience I give him the first programming problem: a straightforward fizzbuzz (http://wiki.c2.com/?FizzBuzzTest). He looked as if the gamesters of Triskelion had dropped him into the arena. He demurs. Comments on the unexpectedness of the request. Explains that he has a little book he usually refers to to help him with such problems (can't make this stuff up). I again offer that he could use any language or pseudo code. We just want to see how he thinks. He decides he will do the fizzbuzz problem in SQL. My co-interviewer and I are surprised at this choice, but recover quickly and tell him to go ahead. Twenty minutes later he hands me a blank piece of paper. Of the 18 or so candidates we interview, he is the only one who cannot write a single line of code or pseudo code.

I receive an email from this applicant a couple of weeks after his interview. He has given the fizzbuzz problem some more thought. He writes that it occurs to him that the code could be placed into a function. That is the culmination of his cogitation over two weeks. We shake our heads and shortly thereafter attend the scheduled meeting to discuss the applicants.

At the meeting the manager asks about his former co-worker. I inartfully, though accurately, tell him that his candidate does not know how to code. He calls me irrational. After the requisite shocked silence of five people​ not knowing how to respond to this outburst we all sing Kumbaya and elect to hire someone else.

Interviews are fraught for both sides of the table. I use Fizzbuzz because if the applicant knows how to code it's an early win in the process and we all need that. And if the applicant can't solve it, cut bait and go home.

Fizzbuzz. Best. Interview. Question. Ever.

"There's more to it"
This is something that has been bugging me for a long time now, so <rant>.

Yesterday in one of my chats in Telegram I had a question from someone wanting to make their laptop completely bulletproof privacy respecting, yada yada.. down to the MAC address being randomized. Now I am a networking guy.. or at least I like to think I am.

So I told him, routers must block any MAC addresses from leaking out. So the MAC address is only relevant inside of the network you're in. IPv6 changes this and there is network discovery involved with fandroids and cryphones where WiFi remains turned on as you leave the house (price of convenience amirite?) - but I'll get back to that later.

Now for a laptop MAC address randomization isn't exactly relevant yet I'd say.. at least in something other than Windows where your privacy is right out the window anyway. MAC randomization while Nadella does the whole assfuck, sign me up! /s

So let's assume Linux. No MAC randomization, not necessary, privacy respecting nonetheless. MAC addresses do not leak outside of the network in traditional IPv4 networking. So what would you be worried about inside the network? A hacker inside Starbucks? This is the question I asked him, and argued that if you don't trust the network (and with a public hotspot I personally don't) you shouldn't connect to it in the first place. And since I recall MAC randomization being discussed on the ISC's dhcp-users mailing list a few months ago (http://isc-dhcp-users.2343191.n4.nabble.com/...), I linked that in as well. These are the hardcore networking guys, on the forum of one of the granddaddies of the internet. They make BIND which pretty much everyone uses. It's the de facto standard DNS server out there.

The reply to all of this was simply to the "don't connect to it if you don't trust it" - I guess that's all the privacy nut could argue with. And here we get to the topic of this rant. The almighty rebuttal "there's more to it than that!1! HTTPS doesn't require trust anymore!1!"

... An encrypted connection to a website meaning that you could connect to just about any hostile network. Are you fucking retarded? Ever heard of SSL stripping? Yeah HSTS solves that but only a handful of websites use it and it doesn't scale up properly, since it's pretty much a hardcoded list in web browsers. And you know what? Yes "there's more to it"! There's more to networking than just web browsing. There's 65 THOUSAND ports available on both TCP and UDP, and there you go narrow your understanding of networking to just 2 of them - 80 and 443. Yes there's a lot more to it. But not exactly the kind of thing you're arguing about.

Enjoy your cheap-ass Xiaomeme phone where the "phone" part means phoning home to China, and raging about the Google apps on there. Then try to solve problems that aren't actually problems and pretty vital network components, just because it's an identifier.

</rant>

P.S. I do care a lot about privacy. My web and mail servers for example do not know where my visitors are coming from. All they see is some reverse proxies that they think is the whole internet. So yes I care about my own and others' privacy. But you know.. I'm old-fashioned. I like to solve problems with actual solutions.

This is a proposal for an entirely free and open source rant like site/app.

devrant today has a couple of problems that I hate:
* Posts in the wrong categories (usually by new users)
* Low effort posts in the "recent" feed
* Good posts in the "algo" feed that are too old
* Longtime bugs
* No official code format in comments, ffs.
* Unimplemented features (like inability to search posts in android, or inability to mute posts in web desktop)
* Lack of admin involvement with the community

but it also has some aspects that I like a lot:
* Admins aren't trigger happy to suspend/ban you
* The avatars are awesome and help to associate users to faces
* The ++ system is good enough
* The community isn't too big so you know pretty much everyone
* There's a lot of variety in the roles and techonologies used by users
* Experienced ranters are usually smart
* Super simple UI
* The comments have only one level (as opposed to reddit comment trees)

This project should try to reimplement the good things while fixing the bad things.

I wrote two posts about a possible manifesto, and an implementation proposal and plan.
https://rantcourse.ddns.net/t/...
https://rantcourse.ddns.net/t/...

I think the ideas outlined there are very aligned to concerns of privacy and freedom users here vouch for.

This project is not meant to **purposefully** replace/kill/make users abandon devrant. People can continue using devrant as much as they want.

I'm hosting a discourse site on a 5$ linode machine to discuss these things. I don't know if it's better than just github.

If you feel that you would like to just use github issues, let me know. I'll create a github org tomorrow, and probably setup gitter for more dynamic discussion.

just found out a vulnerability in the website of the 3rd best high school in my country.

TL;DR: they had burried in some folders a c99 shell.

i am a begginer html/sql/php guy and really was looking into learning a bit here and there about them because i really like problem solving and found out ctfs mainly focus on this part of programming. i am a c++ programmer which does school contest like programming problems and i really enjoy them.

now back on topic.

with this urge to learn more web programming i said to myself what other method to learn better than real life sites! so i did just that. i first checked my school site. right click. inspect element. it seemed the site was made with wordpress. after looking more into the html code for the site i concluded all the images and files i could see on the site were from a folder on the server named 'wp-content/uploads'. i checked the folder. and here it got interesting. i did a get request on the site. saw the details. then i checked the site. bingo! there are 3 folders named '2017', '2018', '2019'. i said to myself: 'i am god.'
i could literally see all the announcements they have made from 2017-2019. and they were organised by month!!! my curiosity to see everything got me to the final destination.

with this adrenaline i thought about another site. in my city i have the 3rd most acclaimed high school in the country. what about checking their security?

so i typed the web address. looked around. again, right click, inspect element and looked around the source code. this time i was more lucky. this site is handmade!!! i was soooo happy because with my school's site i was restricted with what they have made with wordpress and i don't have much experience with it.

amd so i began looking what request the site made for the logos and other links. it seemed all the other links on the site were with this format: www.site.com/index.php?home. and i was very confused and still am. is this referencing some part of the site in the index.php file? is the whole site written inside the index.php file and with the question mark you just get to a part of the site? i don't really get it.

so nothing interesting inside the networking tab, just some stylesheets for the site's design i guess. i switched to the debugger tab and holy moly!! yes, it had that tree structure. very familiar. just like a project inside codeblocks or something familiar with it. and then it clicked me. there was the index.php file! and there was another folder from which i've seen nothing from the network tab. i finally got a lead!! i returned in the network tab, did a request to see the spgm folder and boooom a site appeared and i saw some files and folders from 2016. there was a spgm.js file and a spgm.php file. there was a contrib, flavors, gal and lang folders. then it once again clicked me! the lang folder was las updated this year in february. so i checked the folder and there were some files named lang with the extension named after their language and these files were last updated in 2016 so i left them alone. but there was this little snitch, this little 650K file named after the name of the school's site with the extension '.php' aaaaand it was last modified this year!!!! i was so excited! i thought i found a secret and different design of the site or something completely else! i clicked it and at first i was scared there was this black/red theme going on my screen and something was a little odd. there were no school announcements or event, nononoooo. this was still a tree structured view. at the top of the site it's written '!c99Shell v. 1.0...'

this was a big nono. i saw i could acces all kinds of folders. then i switched to the normal school website and tried to access a folder i have seen named userfiles and got a 403 forbidden error. wopsie. i then switched to the c99 shell website and tried to access the userfiles folder and my boy showed all of its contents. it was nakeeed naked. like very naked. and in the userfiles folder there were all, but i mean ALL files and folders they have on the server. there were a file with the salary of each job available in the school. some announcements. there was a list with all the students which failed classes. there were folders for contests they held. it was an absolute mess and i couldn't believe it.

i stopped and looked at the monitor. what have i done? just to learn some web programming i just leaked the server of the 3rd most famous high school in my country. image a black hat which would have seriously caused more damage. currently i am writing an email to the school to updrage their security because it is reaaaaly bad.

and the journy didn't end here. i 'hacked' the site 2 days ago and just now i thought about writing an email to the school. after i found i could access the WHOLE server i searched for the real attacker so if you want to knkw how this one went let me know in the comments.
sorry for the long post, but couldn't held it anymore

Took a web accessibility course somewhat recently. Here’s the list of typical accessibility problems according to those who use assistive technologies, from the most common to the least common:

1. CAPTCHA
2. Buttons and links that don’t work
3. Lacking/incorrect alt attribute
4. No input labels
5. Sudden layout shifts/content changes
6. Lacking/wrong headings
7. No keyboard access
8. Too many links
9. No skip link in header (https://en.wikipedia.org/wiki/...)
10. Lacking/broken search
11. Complicated and/or long forms
12. No closed captions for videos
13. Bad grammar
14. Bad contrast
15. Custom checkboxes
16. Custom dropdowns
17. Font size

I never knew CAPTCHA was THE worst offender. I also never knew that font size was perhaps the least problematic aspect.

My Tutorials.
Hey guys.
Since I already got fired I don't have problems start uploading my tutorials at the middle of next month...
First... Where should I put them? I'll Make a written tutorial, and Video tutorials, so I need a good cheap web provider and some places like Instructables, but I would like the possibility of gaining some money with some of the stuff.
Btw, Already have one... Maby some can help?

I have an unmounted HDD (3 pins or 4 pins, must work: With no driver and no extras... I know it's possible, just can't find the Information. Then I'll make a video on how to make the same thing with chips (not MCUs) and finally with MCUs). Since there isn't much information around there about this, would be a great 3/4 video tutorial.
I know I can make it work without the board or drivers since I already saw two Indians doing it on youtube, just couldn't understand them and the video quality is shit.
Shit will probably my first Video, but I need to find ways first.

References: https://youtube.com/watch/...

One of the tools I already made: https://youtube.com/watch/...

The problem is using a 300w power supply for tools that require so low power.

Web browsers removed FTP support in 2021 arguing that it is "insecure".

The purpose of FTP is not privacy to begin with but simplicity and compatibility, given that it is widely established. Any FTP user should be aware that sharing files over FTP is not private. For non-private data, that is perfectly acceptable. FTP may be used on the local network to bypass MTP (problems with MTP: https://devrant.com/rants/6198095/... ) for file transfers between a smartphone and a Windows/Linux computer.

A more reasonable approach than eliminating FTP altogether would have been showing a notice to the user that data accessed through FTP is not private. It is not intended for private file sharing in the first place.

A comparable argument was used by YouTube in mid-2021 to memory-hole all unlisted videos of 2016 and earlier except where channel owners intervened. They implied that URLs generated before January 1st, 2017, were generated using an "unsafe" algorithm ( https://blog.youtube/news-and-event... ).

Besides the fact that Google informed its users four years late about a security issue if this reason were true (hint: it almost certainly isn't), unlisted videos were never intended for "protecting privacy" anyway, given that anyone can access them without providing credentials. Any channel owner who does not want their videos to be seen sets them to "private" or deletes them. "Unlisted" was never intended for privacy.

> "In 2017, we rolled out a security update to the system that generates new YouTube Unlisted links"

It is unlikely that they rolled out a security update exactly on new years' day (2017-01-01). This means some early 2017 unlisted videos would still have the "insecure URLs". Or, likelier than not, this story was made up to sound just-so plausible enough so people believe it.