Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "hardcoded credentials"
-
I know that my coworker can't write a single fucking operable line of code. So I wrote a script that is called everytime someone pushes new commits. If the commits contain the username of my coworker, create a ticket in YouTrack with the Label "Rewrite", and assign it to the files changed.
So I had that running for a longer time, and my dumbfuck of coworker hardcoded the credentials of the server in a networking library. One of the credentials was his username. He then updated the copyright on the whole project(which adds a copyright in the top of every file), also in the included librarys(!). The script had a check if the files are related to the project or just librarys. In the end, he pushed all of that with another account(in fact, a reporter account), which had another name(and didn't even belong him). So the files didn't belong to the project, the script sees his username anyways, the script assigns a rewrite, and in the end, everyone in the team thinks I'm mad because I(the script with my account) assigned a rewrite to a HUGE library.
PS: It was great fun to remove these copyright notices.8 -
I hardcoded credentials into source code because I was too lazy to write the method to read them from the database properly.1
-
Google, please explain to me: Why the fuck would you create a hardcoded requirement in your libraries to use a plaintext json file with credentials to your API?
Credentials which give full access to all of the company email, addresses, cloud services, etc?
And why would you accompany this in your docs with example implementations which read as if they were an intern's first coding project — non psr compliant PHP, snippets of Go which won't compile due to type errors...
I'm starting to become convinced that the whole of the Google Cloud API was actually written by thirteen year old who found their parent's liquor cabinet.
Fuck this I'll build my own Google.1 -
Do you guys remember a few days ago that I was looking for someone with certain email address because he didn't receive his email because HE had an insecure mail server? I was sad, because I love new members. While my site has everything public, even api urls to api services without any auth, email confirmation off, hardcoded links to internal servers like retoor42 in repositories, still someone managed to think he hacked me: https://retoor.molodetz.nl/hi/.... That guy! Ironically I went even looking for him to give him credentials! Listing all members of my site is even possible because I have literally right under in my site a link to the most advanced api ever where you can list everything the site contains THAT I ALLOW YOU TOO. That hacker says "magic". I have the url to that "magic" literally on every page Einstein.
Don't let that guy found out what you can do with api.molodetz.nl without any protection..
Dear lord. It's probably the most public site with no secrets ever.
Also, the server runs with a small password and it's a pwned password. Ssh is on port 22. No security measurements are taken.
I can assure you, I know security and worked on cloud shit for three years at one of Dutch biggest cloud provides, kinda aws.
You won't be able to do anything I don't want you to with causing big damage.
Dear lord.3