Since I was little I was fascinated by club light shows I saw on TV shows. I just couldn't find out how they made light react to sound, which were two completely unrelated things to me back then. But I wasn't dumb and somehow figured out that if I hooked some low energy fairy lights to my amp and turned the bass up, they would lightup to the beat.
3 fried fairy lights and angry parents for to loud music later I swore to myself that I would someday build something that could light up my whole room and react to the music I was playing.

I started coding about the age 13 (turned 20 a month ago) with some old school bat scripts. But I wanted something that would generate a .exe so I googled and ended up installing Visual Studio Express (again angry parents for installing without asking) and started copying my first VB.Net program together. From there no one could stop me. I wanted to archive something with an application and googled until I found what I needed and learned to code this way.
I learned writing decent vb.net code and itvwas about this time I came into contact with IRC. I lurked arround there and this is were I came into contact with Linix servers, because I wanted to code IRC (eggdrop) bots, so I learned TCL and got used to Linux. Time passed and I ended uo being a Global OP on some network back then.

I did go further, coded Minecraft Mods, thus Java, changed back to C#, learned PHP and started setting things up on my VPS, Mails server, web server, etc.

Nowadays I work as a Systemadmin / Developer Hybrid, earning my first real money doing what I love to do and guess what? In the meantime I proved myself I can accomplish what I wanted as kid. I bought some Club LED DMX capital lights and programmed a controller for them which can control them in C#, but in a way I can run it on my raspi using mono. I also coded a client which runs on windows which uses some native libraries to calculate the dominant color of the shown picture in realtime (Handels 24fps 1080p) and uses the lights as ambient light, like you see them behind TVs sometimes.
The same app uses Bass.NET and an algorithm to dedect a beat in realtime and switches the light colors. Exactly what I wanted as akid, but better.

I can even control the lights via the new Google Assistant and/or Tasker.

Feels fcking good.

Some of my work lies on github among other, mostly trash: https://github.com/Kimmax - didn't updated there in a while tho.

I plan on writing a new free opensource plugin based modular home automatication server and pretty sure could use some helping hands..

I don't know why I wrote all this, just felt like it.
Also: first Rant

Please don't kill me for errors in the text, I'm to lazy to read through it again right now :P

Continuation from :
https://devrant.io/rants/835693/...

Hi everybody! I am sorry that as a first time poster I am building 2 long stories, but I really like the idea of connecting with other people here!

Well, as I was mentioning before, I got a job in Android development and had a blast with it. Me and the developer clicked and would spend our time discussing PHP, the move to other stacks (I was making him love the idea of Django or Spring Java) games, bands and cool stuff like that. This dude was my hero, his own stack was developed in a similar MVC fashion that he had implemented from scratch before for many projects. It was through him that I learned how to use my own code (rather than frameworks and other libraries) to build what I wanted. I seriously thought that I had it made with a position that respected me and placed me in the lead mobile development position of the company. Then it happened. He had taken 2 weeks of unauthorized leave, which was ok since he was best friends with the owner of the company, those 2 along another asshole started it so they could do whatever they wanted. And I could not make much progress without him being there since there were things that he needed to do, that I was not allowed, for me to continue. When he came back I was quickly rushed to the owner of the company's office to discuss my lack of progress. The lead developer was livid, as if he knew that he had fucked up. He blamed the whole thing on me (literally told the owner that it was my fault before I was summoned) and that we lost 2 weeks of business time because I did not had the initiative to make progress on my own. I felt absolutely horrible, someone that I had trusted and befriended doing something like that, I really felt like shit. I had mad respect and love for this guy. It got heated, I showed the owner the text messages in which I showed him my pleas to led me finish the parts that were needed while he was away. Funny enough, he acted betrayed. After that it was 3 months of barely talking to one another except for work related stuff. He got cold and would barely let me touch the internal code that he was developing. It was painful. The owner kept complaining about progress and demanded that I do a document scanner for the company, which was to be attached to their mobile application. Not only that but it had to be done with OpenCV. Now, CV is great, but it is its own area, it takes a while to be able to develop something nice with it that is efficient and not a shitstorm.
I had two weeks.
Finished in one. After burning my brain and ensuring that the c++ code was not giving issues and the project was steady I turned it in...to their dismay. And I say so because I felt that they gave me such a huge project with the intention of firing me if it was not done. After that it was constant shit from the owner and the lead developer. I was asked then to port the code to the IOS version. I had some knowledge of it already so I started working on it. Progress was fast since the initial idea was already there and I really love working on Apple devices. And when I was 70% done the owner decided to cut me loose. At first he cited things such as lack of funding and him being unable to pay my salary. I was fine with that even though I knew it was not true. So at the time I just nodded and thanked the company for my time there. Before I left, he decided to blame it on me, stating that if they were not producing money that it was perhaps my fault. I lost my shit, and started using my military voice to explain to him how a software company is normally ran. Then I stormed out.
It was known to me, that the lead developer had actually argued against me being laid off. And that he was upset about it, we made amends, but the fact remains that I was laid off because the owner did not think of me as an asset, regardless of how many times I worked alongside the lead developer or how valuable I was actually to the company, their infrastructure did get better while we worked together, so I just assumed that he never actually did any mention of my value.

I lasted 2 months without a job, feeling horribly shitty because my wife had to work harder to ensure our stability whilst I was without any sort of salary. At this time I had already my degree, so all I had to do was look better. In the meantime I decided to study more about other technologies. I learn React, and got way better at JS and Node that I thought I could and was finally able to get another job as a full stack developer for another company.
I have been here since 2 months. It has been weird, we do classic ASP, which is completely pointless at this time, but meh. At this time though, I just don't really have the same motivation. Its really hard for me to trust the people that I work with and would like to connect with more developers.

Follow up to: https://devrant.com/rants/5047721/....

1- The attacker just copy pasted its JWT session token and jammed requests on the buy gift cards route
2- The endpoint returns the gift card to continue the payment process, but the gift card is already valid
3- Clients wants only to force passwords to have strong combinations
4- Talk about a FIREWALL? Only next month
5- Reduce the token expiration from 3 HOURS to 10 minutes? Implement strong passwords first
6- And then start using refresh tokens

BONUS: Clearly someone from inside that worked for them, the API and database password are the same for years. And the route isn't used directly by the application, although it exists and has rules that the attacker kows. And multiple accounts from legit users are being used, so the person clearly has access to some internal shit

Part 1: https://devrant.com/rants/4298172/...

So we get this guy in a meeting and he is now saying "we can't have application accounts because that violates our standard of knowing who accessed what data - the application account anonamizes the user behind the app account data transaction and authorization"

And so i remind him that since it's an application account, no one is going to see the data in transit (for reference this account is for CI/CD), so the identity that accessed that data really is only the app account and no one else.

This man has the audacity to come back with "oh well then thats fine, i cant think of a bunch of other app account ideas where the data is then shown to non-approved individuals"

We have controls in place to make sure this doesnt happen, and his grand example that he illustrates is "Well what if someone created an app account to pull github repo data and then display that in a web interface to unauthorized users"

...

M******* why wouldnt you JUST USE GITHUB??? WHO WOULD BUILD A SEPARATE APPLICATION FOR THAT???

I swear I have sunk more time into this than it would have costed me to mop up from a whole data breach. I know there are situations where you could potentially expose data to the wrong users, but that's the same issue with User Accounts (see my first rant with the GDrive example). In addition, the proposed alternative is "just dont use CI/CD"!!!

I'm getting pretty pissed off at this whole "My compliance is worth more than real security" bullshit.