• 3 Posts
  • 169 Comments
Joined 1 year ago
cake
Cake day: August 4th, 2023

help-circle

  • Yeah, I do know about that. (You’re referring to the PPA repo thing, yeah?) But there are a couple of reasons why that isn’t a workable solution specifically for me specifically.

    • The major reason is that I only use Ubuntu on my work machine and my employer’s compliance department won’t really answer questions about whether it’s allowed to add extra repositories or install things not from the official Ubuntu repositories on company-owned hardware. (And they’re always really threatening and assholeish about breaking the rules they won’t elaborate on, so my best option is kindof just to interpret the rules as strictly as I can and follow that. Or else flout the rules and dare them to fire me. Heh…) Raising questions like that is always a whole thing.
    • “firefox” from the PPA repo and “firefox” from Snap have the same package name which makes things awkward dealing with Apt. (Unless you use “firefox-esr” from the PPA repo, which would otherwise be an acceptable workaround if that was the only issue.)

    So I just use Chrome on my work machine. I dislike Chrome more than Firefox for many reasons, but I at least mitigate some of the issues with Chrome by specifically not doing anything personal on my work machine. I don’t really care if Chrome invades my employer’s privacy. Especially when my employer doesn’t give me a choice in browsers. If anything comes of it, it’s their own damned fault.



  • Do they play a part in commercial DDOS protection?

    Absolutely! As well as mitigating other types of threats. “Web Application Firewalls” (don’t be fooled, they’re not like regular firewalls really) are a type of transparent web proxy that watch requests for anything that “looks like” a SQL injection or XSS payload and block those requests if necessary. Transparent web proxies may also do things like caching or even “honeypot” functionality that may shunt likely bot traffic to a fake version of the website to prevent scraping of real site content.


  • Ooo. This is a good one.

    A computer can have more than one network interface, right? (Like, you can be plugged into ethernet at home but also connected to the WIFI of the coffee shop across the street.)

    A VPN gives you a whole new network device (“virtual ethernet card” if you will) that works as if that card was connected to some LAN somewhere else. Typically, you’d forward “all” of your computer’s/smartphone’s/etc traffic through the VPN so that your computer “thinks it’s on that remote LAN” rather than on your home WIFI or whatever.

    Proxies… well the term can mean a few different things in different contexts, really. But generally you’re not forwarding “all” traffic through them, just HTTP traffic (and usually only a subset of all HTTP traffic) or just traffic that is specifically told to be forwarded through them.

    An opaque web proxy is one that you can point your browser (or other HTTP interface) to. It won’t handle protocols other than HTTP. And when you want to use an opaque web proxy, your HTTP client has to know how to do that. (Whereas with VPN’s, it’s your operating system, not your individual applications, that need to know how to forward through it.)

    A transparent web proxy can be something you (and your apps and OS) don’t know you’re even using. When you point your browser or app to a Lemmy instance, it’s almost certain that the domain is pointed not at an application server that actually runs the Lemmy code, but rather at a transparent web proxy that does stuff on the instance-owner’s end like preventing spamming or whatever. This type of proxy is sometimes called a “reverse web proxy” and can also only work with HTTP.

    A SOCKS proxy, like an opaque web proxy, requires applications to know how to use it. (Ok, technically that’s not 100% true. It’s possible in some cases to have a transparent proxy of some sort forward through a SOCKS proxy in a way that the application doesn’t know SOCKS is involved. There are also some cool OS-level hacks that can force an app to go through a SOCKS proxy without the app knowing anything about SOCKS. But if you’re doing those things, you’re a hacker.) And with a SOCKS proxy, your computer doesn’t “think” it’s connected to a whole different LAN. Individual applications know that they’re forwarding through SOCKS. SOCKS supports more protocols than just HTTP. Probably all TCP-based protocols, but I don’t think it has any support for UDP. So you won’t be torrenting through SOCKS.

    That’s all I can think to say at the moment. There are special-purpose proxies for things like security auditing (like Burp Suite, for instance.) But I’m guessing that’s not the sort of thing you’re asking about.


  • TootSweet@lemmy.worldtoProgrammer Humor@programming.devJava Was The Future
    link
    fedilink
    English
    arrow-up
    21
    arrow-down
    1
    ·
    edit-2
    8 days ago

    I write Java for a paycheck, but I really hate it.

    It feels like everything is layers and layers of overengineered cruft, each added to the precarious tower for something extremely minor. But every subsequent card in the house of cards makes it more precarious. “But look, I don’t have to write accessors.” “But look, I eliminated the need for the web.xml file.” “But look, I don’t have to understand SQL now.” But look, the codebase depends on a shit-ton of completely opaque Automagic™ that you have no hope of understanding the moment something goes wrong – which it will if you even think of changing your Java version. And since it’s practically impossible to understand what’s going on under-the-hood of whichever dependency is fubar’d this week, you have to resort to a mixture of trial-and-error and copy-pasting shit (that you also don’t understand) from StackOverflow and praying to Cthulhu something works – which is also trial-and-error because Java questions in particular have tons of just straight up wrong answers.

    To be fair, I’m the guy on my team who people come to when they run into those sorts of “I bumped up one subminor version of Mockito to fix a bug that was preventing my unit test from working but now literally half of our unit tests won’t build” or “I added the war plugin to the build.gradle and now SwaggerUI is broken.” So maybe I see more than my fair share of “well shit, I guess I’ll just spend the next three hours hunting down which magical combination of Jar version numbers will fix things” kind of problems. But damn. This shit didn’t ever happen back when I was doing Python for a paycheck.

    I don’t use Java if I don’t have to. If I have to use Java, I prefer to just use Servlets (mostly I do web development) and absolutely as few dependencies as I can possibly get away with. Fewer moving parts mean less that can break.





  • AI is quite fit for the task of understanding what might be the purpose of code

    Disagree.

    I don’t know how some non-AI tool could be better for such task.

    ClamAV has been filling a somewhat similar use case for a long time, and I don’t think I’ve ever heard anyone call it “AI”.

    I guess bayesian filters like email providers use to filter spam could be considered “AI” (though old-school AI, not the kind of stuff that’s such a bubble now) and may possibly be applicable to your use case.



  • Woah woah woah. Springfield is definitely a city. It says so right in the logo:

    A screenshot of the home page of the website springfieldmo.gov (the official website for Springfield Missouri) showing only the top-left corner of the page (pretty much just the logo and the address bar of the browser showing the url). Just beside the logo it says "City Of Springfield".

    (Real talk, folks. I don’t care if anyone considers Springfield a “major city” or even a “city” at all. It’s just funny to think of an anthropomorphic caricature of Springfield, Missouri crying over a perceived slight to its ego.)








  • TootSweet@lemmy.worldtoProgrammer Humor@programming.devA QA engineer walks into a bar
    link
    fedilink
    English
    arrow-up
    16
    arrow-down
    1
    ·
    edit-2
    1 month ago

    To be fair, the team at the time was all business majors. (Is “Computer Information Systems” what they call that degree most places or just at my alma mater?) I think I was the only computer science major there.

    They’d done a surprisingly admirable job of cobbling together a working e-commerce, loss prevention, customer sercvice portal, orderfulfillment, and CMS suite. And their schooling was in, like, finance, MS Office, and maybe one semester on actual programming.

    None of them had ever learned how to count in binary. Let alone been exposed to 2’s compliment. And there were no QA engineers.

    Oh, there was the sysadmin. He had a temper and was a cowboy. If you asked him to do something, it’d be fuckin’ done, man. But you did not want to know how he made sausage. The boss asked him to set up a way for us to do code reviews and he installed Atlassian Fisheye/Crucible on a laptop under his desk. We used that for years. And a lot of the business logic of the customer-facing e-commerce site lived in the rewrite rules in the Apache config that only he had access to and no one else could decipher if they did have access.

    Those were good times. Good times.


  • TootSweet@lemmy.worldtoProgrammer Humor@programming.devA QA engineer walks into a bar
    link
    fedilink
    English
    arrow-up
    142
    arrow-down
    4
    ·
    edit-2
    1 month ago

    Back when I was the “new guy” code monkey at a fairly sizeable brick-and-mortor-and-e-retailer, I let the intrusive thoughts win and did some impromptu QA on the e-commerce site. (In the test environment. Don’t worry.)

    It handled things like trying to put “0” or “-1” or “9999999999999” or “argyle” quantity of an item in the cart just fine.

    But I know my 2’s-compliment signed integers. So I tried putting “0xFFFFFFFF” quantity of an item in my cart. Lo and behold, there was now -1 quantity of that item in my cart and my subtotal was also negative. I could also do things like put a $100.00 thing in the cart and then -1 quantity of something that cost $99.00 in the cart and have a $1.00 subtotal.

    (IIRC, there was some issue with McDonalds ordering kiosks at one time where you could compose an order with negative quantities of things to get an arbitrarily large unauthorized discount.)

    The rest of my team thought I was a fucking genius from that moment on. I highly recommend if you’re ever the “new guy” dev on a team and want to appear indispensible, find a bug that it would never occur to a QA engineer who doesn’t have a computer science degree to even test for.