8 points
*

Our business-critical internal software suite was written in Pascal as a temporary solution and has been unmaintained for almost 20 years. It transmits cleartext usernames and passwords as the URI components of GET requests. They also use a single decade-old Excel file to store vital statistics. A key part of the workflow involves an Excel file with a macro that processes an HTML document from the clipboard.

I offered them a better solution, which was rejected because the downtime and the minimal training would be more costly than working around the current issues.

permalink
report
reply
2 points

The library I worked for as a teen used to process off-site reservations by writing them to a text file, which was automatically e-faxed to all locations every odd day.

If you worked at not-the-main-location, you couldn’t do an off-site reservation, so on even days, you would print your list and fax it to the main site, who would re-enter it into the system.

This was 2005. And yes, it broke every month with an odd number of days.

permalink
report
parent
reply
2 points

downtime

minimal retraining

I feel your pain. Many good ideas that cause this are rejected. I have had ideas requiring one big downtime chunk rejected even though it reduces short but constant downtimes and mathematically the fix will pay for itself in a month easily.

Then the minimal retraining is frustrating when work environments and coworkers still pretend computers are some crazy device they’ve never seen before.

permalink
report
parent
reply
0 points

As weird as it may seem, this might be a good argument in favor of Pascal. I despised learning it at uni, as it seems worthless, but is seems that it can still handle business-critical software for 20 years.

permalink
report
parent
reply
1 point
*

What OP didn’t tell you is that, due to its age, it’s running on an unpatched WinXP SP2 install and patching, upgrading to SP3, or to any newer Windows OS will break the software calls that version of Pascal relies upon.

permalink
report
parent
reply
0 points

cleartext usernames and passwords as the URI components of GET requests

I’m not an infrastructure person. If the receiving web server doesn’t log the URI, and supposing the communication is encrypted with TLS, which removes the credentials from the URI, are there security concerns?

permalink
report
parent
reply
1 point
*

Anyone who has access to any involved network infrastructure can trace the cleartext communication and extract the credentials.

permalink
report
parent
reply
0 points

I’m not 100% on this but I think GET requests are logged by default.

POST requests, normally used for passwords, don’t get logged by default.

BUT the Uri would get logged would get logged on both, so if the URI contained @username:Password then it’s likely all there in the logs

permalink
report
parent
reply
1 point

Get and post requests are logged

The difference is that the logged get requests will also include any query params

GET /some/uri?user=Alpha&pass=bravo

While a post request will have those same params sent as part of a form body request. Those aren’t logged and so it would look like this

POST /some/uri

permalink
report
parent
reply
0 points

GET requests are logged

That’s why I specified

the receiving web server doesn’t log the URI

in my question.

permalink
report
parent
reply
7 points

i worked for a hybrid hosting and cloud provider that was partnered with Electronic Arts for the SimCity reboot.

well half way through they decided our cloud wasn’t worth it, and moved providers. but no one bothered to tell all the outsourced foreign developers that they were on a new provider architecture.

all the shit storm fail launch of SimCity was because of extremely shitty code that was meant to work on one cloud and didn’t really work on another. but they assumed hurr hurr all server same.

so you guys got that shit launch and i knew exactly why and couldn’t say a damn thing for YEARS

permalink
report
reply
-1 points

Not to put the blame on the devs, but the problems might have been attenuated by defining a proper interface layer against the server.

permalink
report
parent
reply
4 points

It’s a damn single player game 💀

permalink
report
parent
reply
6 points

Health insurance company I worked for would automatically reject claims over a certain amount without reviewing them. Just to be dicks and make people have to resubmit. This was over 25 years ago, but it’s my understanding many health insurers still pull this shit. They don’t care if it’s legal or not. Enforcement is lazy and fines are cheaper than medical claims.

Obviously this is in the USA.

permalink
report
reply
3 points

We need a whole branch of government dedicated to fucking with insurance companies. They basically generate free money by having money, they don’t actually provide any net positive outside of just having money

permalink
report
parent
reply
4 points

We need to move to single payer healthcare and just eliminate the need for insurance companies.

permalink
report
parent
reply
2 points
1 point

Here is an alternative Piped link(s): https://piped.video/watch?v=-wpHszfnJns

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I’m open-source, check me out at GitHub.

permalink
report
parent
reply
1 point

That’s pretty much the only BDG video I couldn’t finish. Too dark. Everything else has been delightful

permalink
report
parent
reply
6 points
*

The company would bid on government contracts, knowing full well they promised features that didn’t exists and never would, but calculating that the fine for not meeting the specs was lower than the benefit of the contract and getting the buyers locked into our system. I raised this to my boss, nothing changed and I quit shortly after.

permalink
report
reply
3 points

I’ve worked in IT consulting for over 10 years and have never once lied about the capabilities of a product. I have said, it doesn’t do that natively, but if that’s a requirement we can scope how much it would take to make it happen. Sadly my company is very much the exception.

The worst I saw was years ago I was working on an infrastructure upgrade of a Hyper-V environment. The client purchased a backup solution I wasn’t familiar with but said it supported Hyper-V. It turns out their Hyper-V support was in “beta”. It wasn’t in beta. They were literally using this client as a development environment. It was a freaking joke. At one point I had to get on the phone with one of their developers and explain how high-availability and fail-over worked.

permalink
report
parent
reply
1 point

I could very well have been that developer. Usual story, sales promised the world, that our vmware-based system would run on anything and everything, and of course it’s all HA and load balanced, smash cut to me on Monday morning trying to figure out how to make it do that before it goes live on Wednesday.

permalink
report
parent
reply
2 points

eh DHCP isn’t really important right? obviously if it hasn’t changed since the 80’s why would you need to reboot your server.

what are vulnerabilities?

permalink
report
parent
reply
2 points

I worked in government contracting (and government, for that matter) for years and that blows my mind. I can’t remember the details, but if you even had a bad reviews, much less being found noncompliant, it could disqualify you entirely from some contract vehicles for a matter of years. Wild that there’s some agency that somehow lets people get away with fraud.

Also, if that cost the government money, there’s a chance you could report that after the fact and make some money.

permalink
report
parent
reply
1 point

Promising features that never existed is part and parcel to a lot of software sales, whether gov or private. Speaking from post-sales experience.

permalink
report
parent
reply
1 point

The contractor I worked for was run by a man who used to say “if the contract says they’ll blow up the contractor on delivery, we’re putting in a bid and solve the problem later”

permalink
report
parent
reply
5 points
*

1-800-got-junk? doesn’t care at all about its environmental impact. No sorting what so ever happens to what goes on their trucks it all goes to landfills. All the ads will say they recycle and that they repurpose old furniture but I was threatened with being fired when I recommended donating antiques instead of dumping a load of furniture.

More jobs and more profits comes before anything else in that company, including employee health and safety. Several times I was told to enter spaces we werent trained for (attics and crawl spaces) and carry waste I legally couldn’t transport (human/organic wastes and the laws states the driver is fined, not the company). One guy injured his shoulder during an attic job and was told to finish the shift or lose his job. Absoulte scum of a company with very sleazy management and possibly the labour board in their pocket as they kept “losing the files” when I tried to file a report with buddy’s shoulder (he was hesistant to report for fear of losing his job).

permalink
report
reply
3 points

I’ve had a few friends work for them out in Montreal, and their parent company (2 Men and a Truck). According to them it’s a mob-operated business.

permalink
report
parent
reply
2 points

Oh no! I had a great experience with 2 men and a truck when I he used them! No idea it was associated with the 1 800 junk folks

permalink
report
parent
reply
1 point

Thats painful to read

permalink
report
parent
reply

Ask Lemmy

!asklemmy@lemmy.world

Create post

A Fediverse community for open-ended, thought provoking questions


Rules: (interactive)


1) Be nice and; have fun

Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can’t say something nice, don’t say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them


2) All posts must end with a '?'

This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?


3) No spam

Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.


4) NSFW is okay, within reason

Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].


5) This is not a support community.

It is not a place for ‘how do I?’, type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.


6) No US Politics.

Please don’t post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !askusa@discuss.online


Reminder: The terms of service apply here too.

Partnered Communities:

Tech Support

No Stupid Questions

You Should Know

Reddit

Jokes

Ask Ouija


Logo design credit goes to: tubbadu


Community stats

  • 11K

    Monthly active users

  • 3K

    Posts

  • 99K

    Comments