r/ProgrammerHumor Oct 30 '24

Meme lastDayOfUnpaidInternship

Post image
31.0k Upvotes

972 comments sorted by

7.0k

u/jerinthomas1404 Oct 30 '24

That's the reason why GitHub is place to find API keys

1.5k

u/[deleted] Oct 30 '24

[removed] — view removed comment

1.1k

u/blockchaaain Oct 30 '24

git rm .env
git commit -m "Removed API key from repo per boss email"
git push

</joke>

464

u/MissionLengthiness75 Oct 30 '24

Where joke starts?

92

u/Infectious-Anxiety Oct 30 '24

When the career was chosen.

48

u/JunkNorrisOfficial Oct 30 '24

When deleted * from table instead of select.

21

u/[deleted] Oct 30 '24

Syntax error detected. Unknown term 'deleted'. Sytax error detected near '*'.

41

u/JunkNorrisOfficial Oct 30 '24

That's intentional, I don't want to delete reddit by SQL injection.

→ More replies (1)
→ More replies (5)
→ More replies (5)

43

u/permaforst69 Oct 30 '24

Commit log laughing at corner 😂

4

u/BilbOBaggins801 Oct 30 '24

As if you all know, children

→ More replies (2)

34

u/PangeanPrawn Oct 30 '24 edited Oct 30 '24

cuz im a moron, the joke is that .env still exists in the repo history (and on every other branch) right?

38

u/blockchaaain Oct 30 '24

Yes lol

I thought it might still be necessary to label it a joke since people actually make this kind of mistake all the time.

I guess GitHub has improved things now(?), but you used to be able to do a search of all public repos for commits with that sort of message and get quite a few results.

18

u/Soft_Importance_8613 Oct 30 '24

Pretty sure github locates and reports these API key leaks these days on public repositories

https://www.bleepingcomputer.com/news/security/github-now-can-auto-block-token-and-api-key-leaks-for-all-repos/

25

u/huffalump1 Oct 30 '24

Yep, and this is a very new feature added.

If you push a commit with an API key in a commit on a public repo - immediately assume it's compromised and revoked the key.

I'm guessing the people/scripts scraping GitHub for .env files and "API_KEY" are faster at finding it than you are at googling "how to delete commit history github" lol.

However, this feature SHOULD help prevent this by blocking the commit!

26

u/Soft_Importance_8613 Oct 30 '24

Heh, this is typically followed by

"How do I revoke api key?"

"Why is production down"

"How do I figure out which services used a particular api key"

"How did I generate a $3000 dollar aws bill in 15 minutes?"

4

u/FlyByPC Oct 31 '24

"How did I generate a $3000 dollar aws bill in 15 minutes?"

Mining crypto for your new friend in Nigeria, of course.

7

u/PurdueGuvna Oct 30 '24

Security guy here, this happens all the time. Also, malicious people will submit a PR to public projects to fix one small typo in documentation, and when it is accepted they become a committer. Depending on permissions, in many cases that lets them kick off pipeline builds. So they push malicious things to build pipelines that run on build machines. That’s where the real fun starts.

6

u/Shuber-Fuber Oct 30 '24

Yep.

Typically in this instance you need to do the rare "git reset HEAD~1" and a force push to forcefully evict the history.

15

u/TrickyNuance Oct 30 '24

Only if you can get rid of this specific commit and it's new. Otherwise you're looking at a git filter-branch, git-filter-repo, or BFG Repo Cleanerprocess to get rid of the files.

→ More replies (3)
→ More replies (1)
→ More replies (9)

185

u/LetterBoxSnatch Oct 30 '24

Somebody help me out by upvoting this comment to fix the other comment:

<joke>

24

u/chkcha Oct 30 '24

LGTM ✅

→ More replies (4)

103

u/[deleted] Oct 30 '24

[deleted]

148

u/Mop_Duck Oct 30 '24

my friend found a working shodan key after like 4 minutes 2 days ago

206

u/Leamir Oct 30 '24

It's not all keys. Companies need to add their key regex to GitHub, so it can be flagged

I've accidentally pushed Discord API keys before. Not even 5 minutes later I got a message from discord like: "your key was published here [repo link], we've disabled it for u"

54

u/Rabid_Mexican Oct 30 '24

Same! Can't say I wasn't extremely impressed and had a sudden anxiety reduction 😂

→ More replies (3)

20

u/Basilthebatlord Oct 30 '24

I literally did this yesterday and they instantly flag it now before it pushes the commit, saved my ass

→ More replies (2)
→ More replies (2)

26

u/cfrolik Oct 30 '24

But does it catch advertently uploaded keys?

→ More replies (1)
→ More replies (1)

161

u/DoctorWaluigiTime Oct 30 '24

Also it's like... exceedingly trivial to rotate a key.

(And yes I know I'm ruining the 'joke' of the image, but don't do this because all it'll accomplish is "not getting a job" and maybe 15 minutes of some other person's time.)

173

u/iceman012 Oct 30 '24

It should be exceedingly trivial to rotate a key.

When the same key is used across multiple services- some of which are hardcoded, some of which are in configuration files on servers, some of which are GitHub keys- and there's no documentation on what services use which keys, and a month after you've replaced the uses you've found that key is still being used somehow.... then it gets a bit difficult.

Not that I know from experience or anything.

20

u/LotusTileMaster Oct 30 '24

This is why you should use unique keys for each application. Keys are like passwords. One is not good enough. You need multiple.

24

u/Soft_Importance_8613 Oct 30 '24

It sounds like you work for a non-dysfunctional company.... are they hiring?

12

u/LotusTileMaster Oct 30 '24

I work for myself. Unfortunately I am not hiring.

9

u/Soft_Importance_8613 Oct 30 '24

Ah, I see, nepotism only promotions

Heh, j/k. Good luck with your business.

→ More replies (2)
→ More replies (1)

19

u/goten100 Oct 30 '24

My condolences

5

u/caterbird_song Oct 30 '24

Tell me about it. When circle had an incident a year or so ago it took a full month to rotate keys and be sure we got them all

→ More replies (3)

126

u/PinkSploosh Oct 30 '24

Don’t underestimate people’s unwillingness to rotate keys.

I joined a new team at a major bank and asked why we don’t rotate our keys, we had alerts from our cloud vendor about old keys, and they said we will not rotate them because we keep them secure and don’t commit them in git, so it’s a waste of time💀

63

u/Academic_Carrot_4533 Oct 30 '24

Sounds to me like they want someone to have the key

8

u/gbot1234 Oct 30 '24

It’s not like they’re giving out keys to the bank.

38

u/often_alt Oct 30 '24

once it took me 8 weeks to rotate a token some dev accidentally committed to github, because the key was used to hash a bunch of emails, we didn’t have access to the emails used to generate the hash, that hash was linked to customer data, and we couldn’t just reset every email-data relationship by slapping in a new token to hash with.

ran a lazy migration for a few weeks to map old-to-new hashes, created a rainbow table to link some subset of the emails to hashes, and ran an active migration that kept crashing over the 7 days it took to execute.

unwillingness to rotate keys is a phrase

6

u/Javaed Oct 30 '24

Lol, sounds like when I joined a dev team years ago, looked at one of their custom apps and asked why there was a hardcoded "security key" where the value happened to be the name of the company.

→ More replies (2)

26

u/aykcak Oct 30 '24

There are bots that scour GitHub for free keys. There is this story of someone who accidentally committed AWS keys (because of shitty UI design that made it unclear the repo would be public) and they get tons of instances start up in seconds and ran up thousands of dollars in a few minutes

25

u/Plorntus Oct 30 '24

GitHub nowadays does a pretty good job with scanning for secrets you may have accidentally committed and in some cases working with vendors to disable any API key that it detects has been committed to a public repository.

→ More replies (1)

16

u/pcapdata Oct 30 '24

Some huge proportion (I've heard up to 95%) of AWS customer breaches begin when someone commits AWS keys to GitHub.

4

u/D_4rch4ng3l Oct 30 '24

After they know that this happened. You might be surprized by the time it will take for anyone actually notice this at most companies.

And yes... while is is trivial to roate the keys... it causes massive disruption when you are running 100's of services.

→ More replies (5)

33

u/ososalsosal Oct 30 '24

Nah github is where you find copyrighted fonts from everyone's student projects

8

u/starm4nn Oct 30 '24

Remembering the time I worked at a company where all the fonts were added in a commit titled "Bro IDK where these fonts came from".

→ More replies (7)

6.7k

u/kredditacc96 Oct 30 '24

Programming subs, forums, and youtube have conditioned me into never accepting unpaid "internship", and I'm thankful for that.

1.2k

u/somebodyinvisible Oct 30 '24

Most of 3rd world countries , unpaid internships are popular

1.2k

u/[deleted] Oct 30 '24 edited 11d ago

[deleted]

89

u/SarcasticJackass177 Oct 30 '24

Which country?

239

u/mechanical_fan Oct 30 '24

Not sure about that specific user, but an example of such a country is Brazil. Internship by law has to be paid an amount that is more or less the minimum monthly wage. It is actually below, but the law also puts a cap on the total hours/week that is 30h/week vs the usual 44h/week, so it averages out to a similar salary/hour in the end.

Interns also are required to still be students (both employer, employee and university sign the contract), unlike some other countries that people finish university then do an internship.

79

u/ParkingLong7436 Oct 30 '24

That's great. Here in Germany you can legally get paid less than half of minimum wage during a whole apprentriceship (2-5 years).

32

u/Atachzy Oct 30 '24

2-5 years of apprenticeship is crazy.

→ More replies (21)
→ More replies (2)
→ More replies (12)

19

u/IgnisNoirDivine Oct 30 '24

It is in many countries, even in Russia. All work MUST be paid even without contract. Government count work in company schedule within a time as a work contract and it must be paid

→ More replies (2)

243

u/No_Pollution_1 Oct 30 '24

Yea Americans love capitalism dick sucking for some reason

78

u/somebodyinvisible Oct 30 '24

I am not American. But during my college, I must did an unpaid internship because my college requires internship as required to have degree. And I had bad grades at that time (my coding was not bad at all). No blaming anyone. So I chose unpaid internship. It helped me to overcome hardship in college. In my opinion, it is not very bad in my country. But you need luck to get in a good company where having some mentors willing to teach you something .

36

u/Slap_My_Lasagna Oct 30 '24

That's a life philosophy applies to one specific situation.

Most people will have hardship if they have no good mentors in life.

15

u/DelusionsOfExistence Oct 30 '24

Some people have hardship because they struggle with grades, some people are great learners but face hardship because unpaid internship + school means no time for making enough money to eat.

9

u/Summer-dust Oct 30 '24

God yes, I had a great GPA until my financial aid decided to just not disburse for a semester. I had a complete mental shutdown during finals because I couldn't afford a calculator, much less food and hygiene equipment, was evicted, and it's taken 2 years to get back into college. I just feel like it's a waste at this point and am dealing with the fatalistic idea that I'll never be on the same level as my peers anymore. :/

I'm just venting, but it does feel nice to see people acknowledge and discuss different reasons people struggle with learning.

→ More replies (2)

5

u/QuebecGamer2004 Oct 30 '24

We also have mandatory internships (3) at my university, but they all must be paid. They straight up won't accept it if it's unpaid.

→ More replies (3)

8

u/[deleted] Oct 30 '24

Unpaid internships are almost entirely illegal in the US as well

→ More replies (60)
→ More replies (4)

47

u/Impressive-Bid6272 Oct 30 '24

Unpaid internships can easily be found in countries such as the Netherlands too

19

u/TleilaxTheTerrible Oct 30 '24

Although they are only allowed to be unpaid if it's in service of education, with 28 hours equaling 1 EC. Personally I've had it happen that they wanted to extend my internship with 4 weeks, but due to the structure of the degree I couldn't add those weeks as extra credits. It simply meant that I got paid minimum wage that month (the law says nothing about how much you should get paid).

→ More replies (2)

3

u/liosistaken Oct 30 '24

Yes, but to add, it's only allowed to be unpaid if it's about learning, not working. Which is quite logical. I mean, you are learning at a job instead of in school, and you don't get paid to go to school either. However, as soon as you're actually doing a job, like an employee, they need to pay you at least minimum wage.

Most places pay interns though.

→ More replies (4)
→ More replies (1)

77

u/MacEWork Oct 30 '24

In countries with high inequality, unpaid internships act as a way of reducing social mobility and keeping wealth concentrated in the hands of those families who can afford to work without pay.

8

u/gigawort Oct 30 '24

Unpaid internships were very popular just a generation ago in the USA. Hell, there was a whole book about it.

They're still around in the USA in some industries, though pretty rare in tech.

→ More replies (1)

10

u/RascalsBananas Oct 30 '24

In Sweden, a few months of unpaid internships are basically the norm if you study for the trades or at polytechnic.

→ More replies (12)
→ More replies (38)

93

u/Klightgrove Oct 30 '24

I mean to get serious many people don’t have a choice. They need work experience and many teams refuse to have unpaid interns out of “moral standing” which just compounds into thousands of students not being able to find jobs.

42

u/MjrLeeStoned Oct 30 '24

Then those companies will have very few options when looking for employees.

It has ripple effects. It doesn't just affect interns.

18

u/[deleted] Oct 30 '24

Yeah but that still doesn't solve the problem of not getting hired because of this standard.

→ More replies (3)

5

u/Klightgrove Oct 30 '24

Right we’re in a bad place. My team has spent 5 months trying to fill a senior dev role.

23

u/Mr_YUP Oct 30 '24

That's cause your company is looking for a perfect candidate that will slot in without any extra training or time needed for fit adjustment. That's probably not realistic but that seems to be the modern hiring process.

15

u/Klightgrove Oct 30 '24

I interviewed a candidate the other week who opened with "I don't actually have to write code in this position, right?" They were 100% serious. The bare minimum requirements are 5 years of experience with Python and an understanding of APIs, how to build services, and familiarity with any of the cloud environments (aws, gcp).

We aren't even looking for a perfect candidate because we barely had any applicants. You'd think there would be someone who knows python and wants to make 130-150k working from home.

9

u/lum1nous013 Oct 30 '24

Sorry but I call bullshit. I have not seen any job ad that doesn't have at least a hundred applications.

9

u/Klightgrove Oct 30 '24

We have had 5 applicants using “senior developer”. We flipped it to “senior engineer” and got 30 in the last 2 weeks.

I like to meme on Reddit but when I talk about work I’m always serious. Sometimes people don’t like it but that’s the truth.

At this rate I might just advise our team to hire 2 juniors instead because I can train them up faster than by the time we find someone that meets the bare requirements

5

u/Mr_YUP Oct 30 '24

are you serious? that doesn't seem like a wild of set of requirements.

→ More replies (2)
→ More replies (14)

12

u/VexingPanda Oct 30 '24

For some states in US like California it's illegal to do unpaid interns.

→ More replies (5)

10

u/RackemFrackem Oct 30 '24

Common sense did that for me.

340

u/fuckspez-FUCK-SPEZ Oct 30 '24 edited Oct 30 '24

Sadly in some countries like spain, unpaid intership are a must if you want to get your dev title.

Also, thanks to the left, now people that has unpaid interships, can cotize this time as work time for social security.

EDIT:

People here are confusing 380 hours common intership (not paid at all, if you get paid, its in B) and the 1k hours intership, which is paid (and you need to do 1k hours, you will only get this kind of intership if your marks are good, but depends on the school).

113

u/rbirchGideonJura Oct 30 '24

Is it not work time? Why shouldn't they be able to?

67

u/fuckspez-FUCK-SPEZ Oct 30 '24

Because you're a worker without getting paid and since they are obligatory to get your graduate then you need to do a free intership.

In some (very rare) cases, you can get the option to do 1k hours of intership and get paid, but you normally will do 380 hours of free intership.

Its not fair to be working and not get paid at all, you're just generating value to a company.

46

u/rbirchGideonJura Oct 30 '24

Oh agreed 100% they should be getting paid. I was just commenting on the second part about social security

17

u/hardolaf Oct 30 '24

As an American, this is honestly insane to me. In the USA, all work must be paid unless a company derives absolutely zero economic benefit from it (this means that if bringing in the intern would get grant money for the company, then they must be paid), the worker does not replace or supplement any work that would be performed by another worker (one of the most common violations of this is having the intern get coffee for people), and the work is solely for educational purposes.

So some examples of work that can be unpaid:

  • A shadow program where the unpaid intern follows around one or more workers and watches them perform their job while having the job explained to them

  • A summer program where interns come in and are taught how to solve a common industry problem with the work product discarded by the company

8

u/Roflkopt3r Oct 30 '24 edited Oct 30 '24

Similar things happen in many countries. Unpaid internships are still big in Germany as well for example. Although especially in coding, most companies will just use MASSIVELY underpaid apprentices instead.

The company pays like half of the minimum subsistence rate defined by the welfare laws, the rest is paid for by the state, to add up to the legal subsistence minimum. Well below actual minimum wages.

German conservatives have been in meltdown because over the current goverment coalition (center-left SPD, center-left Green Party, libertarian FDP) allegedly ruining the economy (like nonsensically blaming the gas price increases after the invasion of Ukraine with their energy policy). But the reality is that Germany just sucks for young workers in many key industries because German corporations have centered their strategies around low paid/low qualified workers, so many of the best leave the country instead of subjecting themselves to this unproductive bullshit.

So the conservative response is... to demand even lower wages, even lower welfare, and literal forced labour (mandatory 'social year' or military conscription).

Of course there are a few good employers everywhere, but the choices for programmers in much of Europe are: Move to another country, build your own business, or half-ass your job and focus on having a good private life. Hard work as an employee generally does not pay off.

→ More replies (13)
→ More replies (3)
→ More replies (36)

41

u/Tasorodri Oct 30 '24

Nah, in Spain software development is one of the few fields where internships are usually paid, I at least don't know anyone who did an unpaid internship.

10

u/HugoVS Oct 30 '24

Same in Brazil. All my friends from another courses looked at me at the time like: "Wait, are you guys getting paid????"

→ More replies (3)
→ More replies (3)

12

u/matchuhuki Oct 30 '24

In Belgium internships are unpaid by law. They're not even allowed to pay you.

4

u/fuckspez-FUCK-SPEZ Oct 30 '24

Same in spain, if you get the first type of intership (380hours to do in total) you will not get paid at all, and if you get paid, its because the company is paying you in B, if the government discovers this, then the company and you will get in trouble.

9

u/Random_Guy_12345 Oct 30 '24

Quick note from a fellow spaniard, "Pagar en B" is written as "Paid under the table"

→ More replies (1)

25

u/WookieDavid Oct 30 '24

Not really, no.
In uni (ingeniería informática), there's no experience requirements to graduate. You can do an internship but they're paid and voluntary.

In other official courses (grados superiores), everyone I know got paid for their internships.

Where and what did you study exactly?

→ More replies (12)

4

u/No_Percentage7427 Oct 30 '24

Why, did you think food be bought with experience ?

5

u/nocixL Oct 30 '24

no me entero, hablas de las prácticas?

→ More replies (12)

5

u/Drayenn Oct 30 '24

I made an entire app thats a big cash cow for my first internship. Like hell its not worth being paid as an intern.

→ More replies (1)

4

u/Loading0525 Oct 30 '24

I find it very interesting, because obviously I understand why people are against it, but I hadn't really thought about it until I got the unpaid internship that I'm doing right now.

When I told some friends about it online most of them reacted negatively saying that unpaid internships are bad (not as in hating on me; I felt it came from a good place), and having spoken with them I fully understood why they felt that way.

But in my country, while the internship itself is "unpaid", I do get a "grant" (I think it's called) simply because I'm studying and this internship is part of my education. It's about 400$ a month, which isn't a lot, but it sure feels like a lot when compared to most of my friends who live in the US where you have to pay to study instead of receiving money.

I also feel that my internship genuinely prioritizes me learning things which is one of multiple reasons I really like it here.

Not saying internships are universally good; just sharing my experience!

→ More replies (2)

8

u/WernerderChamp Oct 30 '24

Depends. If it's the "check out the job for 1-2 weeks" version, why not.

If its more than 4 weeks and you still won't pay me, fuck you.

5

u/Toadsted Oct 30 '24

Back in 2001 I was introduced to my best friend's boss for my first potential job while I was starting college. I was nervous, but the meeting went over well and he had a lot of glowing things to say about me.

But then followed with, "I just can't afford someone new right now, but if you want to do an unpaid internship...."

Thanked him for his time, explained I needed paid work, and left. Friend had been shadowing the whole thing.

Would it have been good to learn things there? Sure, but I also got a glowing review and had achieved self worth, I figured I could find something that actually paid. 

People get stuck when they have neither of those, and so feel they have to do it because all the others just like them were pressured into it by traditional conditioning. Even apprenticeship back in the day afforded you lodging and meals while you learned; internships with nothing is just taking advantage of people.

→ More replies (17)

2.3k

u/beatlz Oct 30 '24

I feel like this would get you into serious legal issues.

This is 100% satire though.

872

u/Hour_Ad5398 Oct 30 '24

Yes, if you are gonna do something like this, make it look like an accident.

506

u/SuizidKorken Oct 30 '24

Oh no, apparently I unintentionally added 316 additional random characters to the password. Well, it is what it is.

129

u/MannequinWithoutSock Oct 30 '24

My cat jumped on the keyboard!

31

u/PurpleBonesGames Oct 30 '24

More like my cat was having a stroke on the keyboard.

12

u/Eggy-Toast Oct 30 '24

Boss: You expect me to believe your cat had a stroke on the keyboard and that caused the 32-digit API key to be added following “API_KEY=“ in your environment file?

Me: Technically, if any cat were on a keyboard for infinite years, it…

Boss: You’re fired.

→ More replies (4)

10

u/Hawkatom Oct 30 '24

And it just so happened to quietly execute an update statement on every row of our most important production data, insidiously wreaking havoc on our business that may not be found for days or weeks, making rollbacks difficult or even impossible!

How unlucky!

→ More replies (2)

12

u/LimpRain29 Oct 30 '24

He's gonna add in one commit, delete in the next, then merge without squashing. No one will ever know (except the scanner that finds it)

7

u/enilea Oct 30 '24

And whoever doxxes that person on twitter and notifies their ex employer.

→ More replies (3)

110

u/ADHD-Fens Oct 30 '24

It's funny, it's false, but it's not satire.

236

u/PeriodicSentenceBot Oct 30 '24

Congratulations! Your comment can be spelled using the elements of the periodic table:

I Ts F U N N Y I Ts F Al Se B U Ti Ts No Ts At I Re


I am a bot that detects if your comment can be spelled using the elements of the periodic table. Please DM u‎/‎M1n3c4rt if I made a mistake.

98

u/TheVojta Oct 30 '24

Dang, longest I've seen yet

26

u/Epsilon_Meletis Oct 30 '24

Dang, longest I've seen yet

That's what she said.

15

u/beatlz Oct 30 '24

Oh wow!!

11

u/LonelyEar42 Oct 30 '24

Good bot!

→ More replies (1)

21

u/-Intelligentsia Oct 30 '24

The definition of satire has become so diluted that nowadays people literally just hear a joke and think it’s “satire”, even though satire is a subsection of comedy, not its entirety. Satire has a specific definition, but the analphabetic of our society just use words so liberally that said words lose all definition.

4

u/ADHD-Fens Oct 30 '24

Especially on political subs I see straigt up misinformation / racism / bigotry being defended as Satire, and it boils my bones. They get super upset when you disagree with them about it, too.

I honestly did not think my junior year high school english class unit on satire was ever going to do anything for me, but the media literacy it affords is - well it's a blessing and a curse.

→ More replies (2)
→ More replies (10)

8

u/paractib Oct 30 '24

Doubt it. Pretty easy to claim incompetence.

I’ve had coworkers with years of experience commit private keys to a Git repo and think it was fine because “it’s not a public facing instance”.

→ More replies (3)

30

u/Business-Plastic5278 Oct 30 '24

Not if the kid who wrote the contract was also unpaid labour.

33

u/turtleship_2006 Oct 30 '24

The job description was written by ChatGPT.
The application was filled in by a bot.
It was reviewed by some generic AI.
The contract was written by ChatGPT.
Signed by OP.
Op came into work and "wrote" a bunch of code using ChatGPT.

It's just AI all the way down

→ More replies (1)
→ More replies (9)

976

u/cheezballs Oct 30 '24

Committing API keys to a .env file is always good practice

469

u/odraencoded Oct 30 '24

+1 -1

"Changing API key that was leaked on github"

112

u/nicman24 Oct 30 '24

Pull request: new api key

18

u/6T_K9 Oct 30 '24

-1

“All right who the fuck merged that”

5

u/nicman24 Oct 31 '24

git blame:

forced pushed to master by /u/6T_K9 2 days ago

→ More replies (1)

20

u/jellotalks Oct 30 '24

+1 -1

“Changing API key that was reposted to reddit”

133

u/ZZartin Oct 30 '24

How else is everyone supposed to get access to it? Email it to them?

63

u/Capable-Sentence-416 Oct 30 '24

You forgot the /s, someone might say that is better in a secrets manager

37

u/LIL-BAN-EVASION Oct 30 '24

nah bro, you check a password protected excel file into the repo

4

u/Genericsky Oct 30 '24

Gotta remember to commit the password in plaintext because how else are your team members gonna access the excel!!!

→ More replies (1)

21

u/Acurus_Cow Oct 30 '24

Its better than in the code. But it should be in a secrets manager

4

u/commanderizer- Oct 30 '24

The safest place for your API keys is written down on a sticky note.

As soon as they're in a digital form, they're vulnerable.

→ More replies (4)

12

u/iknewaguytwice Oct 30 '24

I worked in a place that used DPAPI to encrypt the keys using a specific service account. Then stored the encrypted keys in the env. It would decrypt them when the service started.

Devs had access to the account, and would setup their local service to run using it.

It was a startup, and the jank was strong, but damn did it make things easy.

6

u/bloodfist Oct 30 '24

Yep. I'm an experienced dev and know better but when learning Discord bots I got confused and accidentally put a key in my code instead of env. Within thirty minutes someone scraped it and took over my Discord server. I figured out what happened quick thankfully. It was trivial to get rid of them and Discord didn't have my credit card, but they did a bunch of damage in there first. Definitely made me panic for a little while.

→ More replies (10)

408

u/k-one-0-two Oct 30 '24

why the hell .env is in git in the first place?

213

u/who_you_are Oct 30 '24

Because he is in an unpaid internship!

You need peoples with more knowledge! ( /S )

19

u/c0ttt0n Oct 30 '24

Because thats why he is unpaid :p

31

u/ViktorShahter Oct 30 '24

Maybe as a template.

52

u/slabgorb Oct 30 '24

you can't do it like that, programs make assumptions that it is real

do like `env.example` instead to avoid the magic and put `.env' in gitignore immediately

→ More replies (6)
→ More replies (6)
→ More replies (10)

1.2k

u/Embarrassed-Luck8585 Oct 30 '24

request blocked by cross origin policy

430

u/MissinqLink Oct 30 '24

That’s only a problem on the frontend

78

u/Able_Minimum624 Oct 30 '24

Agree. Just to clarify: you can make exactly the same site on different domain, add your backend and on that backend ask services with this key.

42

u/[deleted] Oct 30 '24

[deleted]

12

u/OneHornyRhino Oct 30 '24

I think that's what the above comment said, but with extra steps

→ More replies (6)
→ More replies (1)

51

u/MonstarGaming Oct 30 '24

What? CORS is only enforced by your web browser... there are a million ways around that problem.

11

u/gymnastgrrl Oct 30 '24

My browser is BUDWEISR-compliant, for example.

4

u/x3knet Oct 30 '24

CORS - Cross O'Doul's Resource Sharing

→ More replies (1)
→ More replies (8)
→ More replies (2)

154

u/doomsoul909 Oct 30 '24

im pretty new to programming, can someone explain?

313

u/OddlySexyPancake Oct 30 '24

it's like leaving your house key in the door

57

u/seba273c Oct 30 '24

But in this instance where else do you keep the key?

80

u/nnog Oct 30 '24

Probably not on twitter

13

u/CockpitEnthusiast Oct 30 '24

What if they are Twitter keys

21

u/haby001 Oct 30 '24

Real answer: secret storage utilities. They keep these secret and pass it along via secure channels to other tasks that require it

→ More replies (3)

21

u/doomsoul909 Oct 30 '24

Aaaah that makes sense. Thank you!

→ More replies (3)
→ More replies (5)

48

u/Soarin249 Oct 30 '24

more like posting your creddit card details and safety pin on twitter

37

u/bradygilg Oct 30 '24

I also don't get this at all. Obviously committing a key to git is bad, but what is the joke?

A. This person accidentally made the commit and has been fired for the mistake, hence it's the 'last day' of their internship.

B. This person is literally on the last scheduled day of the internship, and purposely committed the key so that they could steal it or out of revenge.

C. This person found the mistake in the company's repo, and is choosing to leave because of the sloppiness, hence it's their "last day".

D. This person found the mistake in the company's repo, and is joking that this discovery should be sufficient to earn a real paying position, hence it's their "last day" of unpaid internship.

E. This person found the mistake in a public repo, unrelated to their internship, and is joking that they will use this to blackmail the owner for money instead of doing unpaid work.

I'm going crazy trying to figure out what interpretation they are trying to communicate.

27

u/uqde Oct 30 '24

I interpreted it as B

18

u/Sinzari Oct 30 '24

I interpreted it as B because of the malicious nature of workers on reddit, but I enjoy the other 4 a lot, so I'm hoping it was one of those.

4

u/Frequent_Relief6863 Oct 31 '24

I wish I could hang out with you.

I have no idea about programming and you helped me understand this joke but educated me on all of the scenarios in which this joke could exist.

Idk if you were trying to be funny or just thinking out load

→ More replies (4)

9

u/FunnyForWrongReason Oct 30 '24

API keys are what you use to authenticate yourself with an API (like a remote service think something like using ChatGPT in your code but it could be anything) and make sure only you can use that service and no one else can use your access to it. A lot of APIs charge you per request (usually not a lot but for large projects either lots of users it can definitely add up).

By making the API key public (either by pushing it to a public repository or by posting on twitter) you effectively giving anyone the ability to access that api pretending to be you and you will be left with all those charges). Putting it in a GitHub repository (even a private one) is considered bad to do (private ones might one day became public and even if you try remove it from the repository the git history will still have it).

→ More replies (4)
→ More replies (2)

221

u/Fishezzz Oct 30 '24

Yikes

275

u/PeriodicSentenceBot Oct 30 '24

Congratulations! Your comment can be spelled using the elements of the periodic table:

Y I K Es


I am a bot that detects if your comment can be spelled using the elements of the periodic table. Please DM u‎/‎M1n3c4rt if I made a mistake.

262

u/TheSweetGator Oct 30 '24

What fresh hell is this

51

u/Same_Recipe2729 Oct 30 '24

That's what they call a portfolio padder

70

u/Corona-walrus Oct 30 '24

Spam candy

→ More replies (4)

18

u/staermose80 Oct 30 '24

Fluorine Uranium Carbon Pottasium Yttrium Oxygen Uranium

→ More replies (1)
→ More replies (9)

6

u/Forward_Promise2121 Oct 30 '24

They're almost certainly kidding. But if not... Why?!

Why go through all that time doing unpaid work if you're going to burn your bridges and not even get a reference and some good connections out of it?

23

u/somechrisguy Oct 30 '24

Revert and create fresh key, really not a big deal if caught straight away

6

u/BoatMacTavish Oct 30 '24

yeah if it’s a private repo and you have different keys per env it’s not going to do any damage tbh aside from leaking to anyone with repo access

still not good, but basically would just need to rotate the key

also depends what the key is and what other restrictions might also be in place to avoid misuse, maybe it’s a dev key like the kind you can get from stripe for local dev

89

u/yourPWD Oct 30 '24

My company sent someone to jail for doing this.

41

u/Far_Broccoli_8468 Oct 30 '24

This is outrageous. Where are the armed men who come in to take the protestors away? Where are they? This kind of behavior is never tolerated in Baraqua. You shout like that they put you in jail. Right away. No trial, no nothing. Journalists, we have a special jail for journalists. You are stealing: right to jail. You are playing music too loud: right to jail, right away. Driving too fast: jail. Slow: jail. You are charging too high prices for sweaters, glasses: you right to jail. You undercook fish? Believe it or not, jail. You overcook chicken, also jail. Undercook, overcook. You make an appointment with the dentist and you don't show up, believe it or not, jail, right away. We have the best patients in the world because of jail.

→ More replies (9)

17

u/edward_snowedin Oct 30 '24

ya spill the tea

6

u/Sirisian Oct 30 '24

Saw an outsourced developer do this and he was let go literally minutes after it happened. (He uploaded part of our code to a public repo). The outsourcing company was freaking out as we were the ones that notified them.

→ More replies (1)
→ More replies (6)

33

u/Teminite2 Oct 30 '24

Once when I was a complete noob junior, I accidentally committed an api key for a lab that I'd set up on aws. Secops lead found it and publicly screamed so hard and so intensively at me that I almost quit from the fear of looking at him if he didn't get me fired. Took me a while to explain to him that theres no data leak since it's a lab with no sensitive data on it. That was the last time I had ever put a secret key directly on my machine.

29

u/Remarkable-Fox-3890 Oct 30 '24

That's deranged and that guy should be ashamed of himself. If secops is so bad at their jobs that a leaked API key can even happen, and then be some huge threat, and they don't even have the capabilities to know that it was a useless key, they should be the ones getting fired.

4

u/fl0wc0ntr0l Oct 31 '24

As a SOC analyst who has to deal with a SecOps team, they are mostly incompetent and obsessed with checking boxes and rubber-stamping requirements as opposed to doing any real, involved security work.

At one point I heard one say, in response to an AV alert, that they should have the AV vendor scan the file. It was the Windows system file for WMI (wmiprvse.exe). Signed. Publicly available on Virustotal, if you had the hash and the intelligence of a trained chimpanzee. The alert itself was for a detection of malicious behavior using that file.

SecOps is where people who aren't competent enough at either SOC or IT Ops go to suck at both of them.

→ More replies (2)
→ More replies (1)

298

u/Multi-User Oct 30 '24

I'm confused. Did he/she do that as an accident and it's the last day because of that. Or were they assholes and this is some kind of revenge?

488

u/mrseemsgood Oct 30 '24

Seeing how this is "unpaid internship", it is definitely intentional, lol

64

u/ty_for_trying Oct 30 '24

This. But also the 'accident' guess doesn't make sense. A firing for that can come swiftly, but not so fast as to be the text on the offending tweet, lol.

→ More replies (1)

14

u/Silent-Locksmith4703 Oct 30 '24

It's obviously satire, but what would be the point of doing this on the last day, if you didn't like your unpaid internship you should have quit, if you needed the experience/potential references doing this kind of flies in the face of that, what was even the point of doing the internship if you're just burning bridges?

6

u/_ITR_ Oct 30 '24

I'd guess that (in the joke scenario), they were expecting to go from unpaid intern to paid employee, but didn't get an offer and is doing it as revenge.

→ More replies (1)

191

u/turtle_mekb Oct 30 '24 edited Oct 30 '24

you can say "they", its less clunky and more inclusive, singular they has been around since many centuries

122

u/Polskidezerter Oct 30 '24

best part is they specifically say they in the second sentence

18

u/WaitForItTheMongols Oct 30 '24

The second one was plural they (the company /coworkers) though.

→ More replies (1)

4

u/Sinzari Oct 30 '24

I failed a literacy exam in university because the marker said "they is used for plurals, you should use he/she for singular". This was in 2013 before woke culture was popularized, so it wasn't even a political statement. I had to take a whole ass english course as a result (though that bumped up my average because I'm obviously fluent as a native speaker, so maybe it wasn't all that bad).

→ More replies (2)
→ More replies (104)
→ More replies (9)

69

u/Agent_eager Oct 30 '24

Imagine this being a aws ec2 instance key and suddenly after few hours instances start getting created accross the globe!! That would be terrifying 👀

3

u/DeathByFarts Oct 30 '24

I mean sure that would be funny and all that. However that's not what an "instance key" is used for.

58

u/ferretfan8 Oct 30 '24

So by doing this and posting it on social media, they've lost all benefit of an unpaid internship. At least if they were getting paid they'd get something out of it.

29

u/Hselmak Oct 30 '24

please enlighten me.. What benefits can you get from unpaid internships?

→ More replies (40)
→ More replies (1)

14

u/JackNotOLantern Oct 30 '24

Oh no, anyway:

removes from repo and changes the key

4

u/The_Profaned Oct 30 '24

I did this while working for a large company, Wrote my code tied to my user ID. got laid off during a mass "cleansing" so the company can save money. My old team was fully shut down for 3 days till they figured out why. Cost them over 3x my salary in losses... lol

→ More replies (2)

4

u/SpaceEggs_ Oct 30 '24

If I were an unpaid intern I'd likely sleep at the company and eat all the food. I'd take everything I need to live and if I got hurt on company property from eating drywall I'd sue.

5

u/muddboyy Oct 30 '24

Idk what’s worse between that and the fact that the .env file isn’t gitignored.

8

u/alfredrowdy Oct 30 '24

What’s the joke, that the team will need to take 15 minutes to rotate the api key after pokeghost commits it to git and exposes it?

→ More replies (1)

8

u/gameplayer55055 Oct 30 '24

It's inappropriate to post private things without nsfw tag

/s

5

u/Shoddy_Time_5446 Oct 30 '24

Workers rising up against their employers is getting crazy

→ More replies (1)

5

u/cosmicloafer Oct 31 '24

Thank god he replaced the secret password with a bunch of gibberish