News for hackers. Stuff that matters.
Re:Pornhub Bypasses Ad Blockers with WebSockets by krylon on Wednesday November 02, 2016 @07:53PM (#12860448)
> "YOU PUT THIS IN PRODUCTION WITHOUT FILLING OUT ALL THE REQUIRED JIRA TICKETS AND APPROVAL FROM 3 LAYERS OF MANAGEMENT?!?! WE'RE GONNA HAVE TO TAKE THIS DOWN AND HAVE A MEETING!"

This is totally OT, but during my training at a large corporation, I was building a very simple web application and found it desirable to access the corporate phone directory to augment some of the information I presented to the users.

I looked around a little and discovered that there was indeed an LDAP server that served the phone directory for the entire freaking company. It would even speak to me after I did an anonymous bind. ;-) So I wrote my web application, handed it off to the guy who ended up maintaining it (me being a trainee and all), and the I thought I'd be a good corporate citizen and checked what I had to do to "legally" access that LDAP server. Turns out I had fill out an application form that was something like six pages long.

Unfortunately, filling out that form and sending it to the designated address were my last actions as a member of that team, as my time with that particular team was up. So I never found out if "they" rejected the application or not. (I guess they approved it, because if it was such a big deal, they would not have opened that LDAP server for anonymous access, but you never know - could have been plain stupidity.)

Re:Pornhub Bypasses Ad Blockers with WebSockets by wastedhours on Thursday November 03, 2016 @03:36AM (#12862198)
That seems to be the entirety of the last two jobs I've had too - go and build something in dev that's incredibly useful but not signed off/uses APIs that'd need a 6 month review process for (did something similar with LDAP access, found an endpoint and used it for something infinitely more useful to the business), once IT finds out about it, I get my wrist slapped, but have built a fairly solid business case in only a few days, and get to fasttrack through sign off to production.

Ruffle a few feathers, but organisational inertia would kill off anything particularly useful for our teams that are 24/7 fighting fires.

Re:Pornhub Bypasses Ad Blockers with WebSockets by kzisme on Thursday November 03, 2016 @09:49AM (#12863893)
Were the forms essentially a "Change Request" form?
Re:Pornhub Bypasses Ad Blockers with WebSockets by krylon on Thursday November 03, 2016 @11:39AM (#12864868)
No, the information they wanted was actually surprisingly reasonable - how many requests per day was my application going to make, how many concurrent connections, how many people would be using my app, what kind of information did I need, what did I need it for, who could they contact if my application turned out to be - intentionally or by accident - DOS'ing the LDAP server(s), and so forth.

I just found it kind of funny that I should fill out a six-page form to get information I could technically access already, anonymously. (Also, it was the first time I saw such a form, that might have been a bit of a culture shock for me.)

Re:Pornhub Bypasses Ad Blockers with WebSockets by harlanji on Thursday November 03, 2016 @04:14PM (#12867528)
Granting anonymous access would be a matter of organization precedent, but I can imagine a world where it's encouraged to dev against these services and notify upstream service owners when stuff is about to change reasonably ahead of time (too soon and too many chefs might come, unfortunate reality).

I think every service owner should know who their 'customers' are, it's important because of things like Pager Duty rotations for example. Remember that scene from Hackers, "God wouldn't be on this late?"... in a sense, the 6 page form might seem like overkill but it beats sifting through a conversational email thread asking for all the same pieces of information. They could gamify the form I suppose, if that's better than a paper form... but on their end there should be a spreadsheet used for op budgeting etc and they need the info.

Re:Pornhub Bypasses Ad Blockers with WebSockets by kzisme on Thursday November 03, 2016 @02:59PM (#12866897)
I see - at my work I'm currently encountering change requests and they are about the same thing. Papers/requests explaining in baby steps what is going on so it can be replicated.

It's my first time coming across them - I suppose it's a good idea, but slightly overkill since I write documentation for my code and it's in source control as well.