Modern IDEs have solved the old tabs vs spaces debate.

It is spaces....otherwise some AI will fill in something which is not a tab!

#programming #ux

~€4 million fine for McDonald’s Poland because of weak/default credentials and IDOR 🫠

The Polish Data Protection Authority (UODO) has fined McDonald’s Poland PLN 16.9 million (≈ €4 million) and its processor 24/7 Communication PLN 184 thousand (≈ €40 thousand) after a misconfigured server exposed sensitive data.

The UODO is Poland’s data‐protection authority enforcing both GDPR and national privacy laws. PESEL acts like a Social Security Number, uniquely identifying Polish citizens, while passport numbers serve as alternative identifiers for non‐citizens.

Researchers Sam Curry and Ian Carroll discovered an admin panel on the global hiring portal mchire.com by trying default test credentials (123456:123456). Inside, they found an IDOR vulnerability in the PUT /api/lead/cem-xhr endpoint that let them enumerate values and pull applicants addresses, emails, phone numbers, and even chat histories with the AI bot.

Notably, the UODO imposed these hefty fines despite the lack of proof that any data was truly exfiltrated or publicly disclosed.

I have unlocked every vehicle and character in Mario Kart World and regretfully confirm there is no 2014 Mercedes GLA.

2/10, bad game.

Atwood's law: Any software that can be written in JavaScript will eventually be written in JavaScript.

The Atwood-Goodwin law: Any software that was re-written in JavaScript will eventually be re-re-written in Rust.

#programming #rust #javascript

🎮 Random Retro Game:

Title: Tetris (1984)
Released: 1984-06-06
Platforms: Game Boy, NES
Also released on: SNES, Commodore / Amiga, Atari 2600, Atari ST, Genesis

#Tetris(1984) #GameBoy #NES #Retrogames

Elon Musk: "A Starlink non è consentito operare in Sudafrica, perché non sono nero". Il Sudafrica ha respinto questa affermazione spiegando che Starlink non ha fatto domanda di licenza. In Sudafrica è in vigore infatti la normativa sul “Black Economic Empowerment”, che impone alle aziende di telecomunicazioni straniere di cedere almeno il 30% del capitale a investitori appartenenti a gruppi storicamente svantaggiati

[Si Elon, quelli su cui pelle la tua famiglia ha costruito la tua fortuna]

Vita da #PlatformEngineer: c'é un utente gitlab usato come bot molto legacy di cui nessuno aveva la 2fa né codici di recupero.

Con un personal access token abbiamo caricato una chiave SSH tramite API, con quella `ssh -i new_key [email protected] 2fa_recovery_codes` che rigenera i codici di recupero e finalmente recuperato l'accesso.

Morale della storia: **mai lasciare personal access token in giro** (ma questa volta mi hanno salvato il c**o).