Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...

Shirec posted:

Ok loving gently caress today. For the second time, my boss is accessing a customer’s patient data because he wants to look at my coworkers info (he went to an urgent care we service with an ulcer last night).

:aaaaa:

Shirec please PM me your info / resume, I can't promise I can get you out of your nightmarish hellscape but I can put your resume in.

Adbot
ADBOT LOVES YOU

ultrafilter
Aug 23, 2007

It's okay if you have any questions.


Volmarias posted:

:aaaaa:

Shirec please PM me your info / resume, I can't promise I can get you out of your nightmarish hellscape but I can put your resume in.

Same.

Shirec
Jul 29, 2009

How to cock it up, Fig. I

Sent you guys a PM. I have under a year of experience though, and I know I'm a hard sell to anybody.

ChickenWing posted:

what the gently caress

Haha, oh jeeze, I didn't mean to withhold anything. You brightened my morning with that reaction, which I sorely needed.

My boss is breathing down my neck of how he wants me to simulate the offshore team passing unit tests. Lots of putting me on the spot to explain exactly why I couldn't force this test to go green and talking down to me of how he expects me to work exactly in a certain way/order. Had about an hour of lecturing in front of my co-workers of how he doesn't understand the issues I bring up, that I need to think "like a developer." He not so subtly implied that my skill level is below the offshore team (who are brand new).

New Yorp New Yorp
Jul 18, 2003

Only in Kenya.
Pillbug

Shirec posted:

Lots of putting me on the spot to explain exactly why I couldn't force this test to go green and talking down to me of how he expects me to work exactly in a certain way/order.

This makes zero sense. He does not understand unit testing at all.

Tell him, "I couldn't 'force' this test to pass because unit tests are supposed to be written along with the code they test and heavily influence the design of the code. This code is not written to be easily tested and needs to be refactored, which is one of many reasons why writing unit tests should not be a separate process undertaken by a different person than the author of the code being tested."

Shirec
Jul 29, 2009

How to cock it up, Fig. I

New Yorp New Yorp posted:

This makes zero sense. He does not understand unit testing at all.

Tell him, "I couldn't 'force' this test to pass because unit tests are supposed to be written along with the code they test and heavily influence the design of the code. This code is not written to be easily tested and needs to be refactored, which is one of many reasons why writing unit tests should not be a separate process undertaken by a different person than the author of the code being tested."

He might literally fire me on the spot if I do that. His current wish for this team (and another log in the fire of wanting to leave) is that we just write unit tests that the offshore team gets passing. According to him, the offshore team will do whatever it takes to make a test go green, and if we write lovely tests, it's our fault. We are expected to break the need to communicate and share info all the time.
I totally agree with you and that's how I normally operate. Part of the 'simulation' is finding the weak spots in the unit tests. I'm not allowed to touch them at all. Nor am I allowed to argue what I think would be best.

This is not at all surprising to me after he tried to redefine work life balance to me. He told me that most people understand it wrong, that it actually means being so into your job that you don't mind everything shifting over to that.

Shirec fucked around with this message at 17:05 on May 30, 2018

Pedestrian Xing
Jul 19, 2007

:sever: * 1000

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...

Shirec posted:

This is not at all surprising to me after he tried to redefine work life balance to me. He told me that most people understand it wrong, that it actually means being so into your job that you don't mind everything shifting over to that.

:murder:

hailthefish
Oct 24, 2010

Scikar
Nov 20, 2005

5? Seriously?

Shirec posted:

He might literally fire me on the spot if I do that. His current wish for this team (and another log in the fire of wanting to leave) is that we just write unit tests that the offshore team gets passing. According to him, the offshore team will do whatever it takes to make a test go green, and if we write lovely tests, it's our fault. We are expected to break the need to communicate and share info all the time.
I totally agree with you and that's how I normally operate. Part of the 'simulation' is finding the weak spots in the unit tests. I'm not allowed to touch them at all. Nor am I allowed to argue what I think would be best.

This is not at all surprising to me after he tried to redefine work life balance to me. He told me that most people understand it wrong, that it actually means being so into your job that you don't mind everything shifting over to that.

There's a gamble here and I realise it's one that you can't afford to take, but hopefully it at least makes you feel better to see it. A lot of your boss's behaviour is because just as you can't afford to get fired, he probably can't really afford for you to quit either. The other members of your team are relatively inexperienced and underpaid as well and that's all for the simple reason that people who aren't desperate will turn your boss down as soon as they hit one of his red flags. When you leave for a much better job (and you will, because at junior level your capacity to learn is worth far more than arbitrary years of experience and you've learned a huge amount in a short space of time), he's going panic. At least one part of that is probably going to be to make you a ridiculous offer to try to convince you to stay. When you turn it down (obviously, because all the money in the world isn't worth those conditions) he will take it as a personal betrayal just like he did with the last person who left.

It's understandable to be afraid of getting fired but when you look back at this stage of your career in a few years' time you'll realise your boss is actually in a very precarious situation himself and he's only propped up by exploiting people in vulnerable positions. Literally every new thing you learn, even things like "this is a textbook example of how not to do TDD" makes you stronger and him weaker because all those things added up are the experience that will get you your next job.

Bongo Bill
Jan 17, 2012

Congratulations on working for the worst boss in the world.

-Anders
Feb 1, 2007

Denmark. Wait, what?
I'm just chiming in to say that I've been checking this and the newbie thread extra frequently today, hoping that you got a new job.
As a manager (of a different field) his behaviour is completely alien to me, and I hope you get out as soon as possible.

Shirec
Jul 29, 2009

How to cock it up, Fig. I

-Anders posted:

I'm just chiming in to say that I've been checking this and the newbie thread extra frequently today, hoping that you got a new job.
As a manager (of a different field) his behaviour is completely alien to me, and I hope you get out as soon as possible.

Same except my email. I'm starting to get the internal dread that I got passed over :smith: I'm trying to not think about it too much cause I don't want to cry at work.

Scikar posted:

There's a gamble here and I realise it's one that you can't afford to take, but hopefully it at least makes you feel better to see it. A lot of your boss's behaviour is because just as you can't afford to get fired, he probably can't really afford for you to quit either. The other members of your team are relatively inexperienced and underpaid as well and that's all for the simple reason that people who aren't desperate will turn your boss down as soon as they hit one of his red flags. When you leave for a much better job (and you will, because at junior level your capacity to learn is worth far more than arbitrary years of experience and you've learned a huge amount in a short space of time), he's going panic. At least one part of that is probably going to be to make you a ridiculous offer to try to convince you to stay. When you turn it down (obviously, because all the money in the world isn't worth those conditions) he will take it as a personal betrayal just like he did with the last person who left.

It's understandable to be afraid of getting fired but when you look back at this stage of your career in a few years' time you'll realise your boss is actually in a very precarious situation himself and he's only propped up by exploiting people in vulnerable positions. Literally every new thing you learn, even things like "this is a textbook example of how not to do TDD" makes you stronger and him weaker because all those things added up are the experience that will get you your next job.

Thank you, I really appreciate these words. Sometimes I worry that he's right and I am garbage, or I'm poisoning my understanding of programming. I've been considering quitting since last week or so, after I had that thought of he needs me as well. I wish my savings were robust enough to bear that (and I imagine renting a new place will suck w/o a job).

The dev community here has been a lifesaver, thank you all y'all :unsmith:

-Anders
Feb 1, 2007

Denmark. Wait, what?
Just remember that even if the day passes without any news, it might just be because some important stuff came up and they haven't had time to get back to you or anyone else.
This stuff happens all the time, and I don't think hiring a new computer whisperer is anyone's full time job.

Ghost of Reagan Past
Oct 7, 2003

rock and roll fun
It's not you, it's your boss. He's a gigantic piece of poo poo.

-Anders
Feb 1, 2007

Denmark. Wait, what?

Ghost of Reagan Past posted:

It's not you, it's your boss. He's a gigantic piece of poo poo.

This ^^^

fourwood
Sep 9, 2001

Damn I'll bring them to their knees.

Shirec posted:

Same except my email. I'm starting to get the internal dread that I got passed over :smith: I'm trying to not think about it too much cause I don't want to cry at work.

Thank you, I really appreciate these words. Sometimes I worry that he's right and I am garbage, or I'm poisoning my understanding of programming. I've been considering quitting since last week or so, after I had that thought of he needs me as well. I wish my savings were robust enough to bear that (and I imagine renting a new place will suck w/o a job).

The dev community here has been a lifesaver, thank you all y'all :unsmith:

You are good and he is awful.

Ghost of Reagan Past posted:

It's not you, it's your boss. He's a gigantic piece of poo poo.

ChickenWing
Jul 22, 2010

:v:

Shirec posted:

Haha, oh jeeze, I didn't mean to withhold anything. You brightened my morning with that reaction, which I sorely needed.

Glad I could help, although on the other hand now I need my afternoon brightened because I finished reading and now I'm real mad about your boss. I'd like to reiterate that

Ghost of Reagan Past posted:

It's not you, it's your boss. He's a gigantic piece of poo poo.

Munkeymon
Aug 14, 2003

Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.



fourwood posted:

You are good and he is awful.

:agreed:

Janitor Prime
Jan 22, 2004

PC LOAD LETTER

What da fuck does that mean

Fun Shoe

ChickenWing posted:

Glad I could help, although on the other hand now I need my afternoon brightened because I finished reading and now I'm real mad about your boss. I'd like to reiterate that

Seriously, I was outraged at the post about IDE settings before reading any of the background info on her boss. This is the most hosed up story I've read recently, and now I want to physically assault that rear end clown. Gotta calm down as I'm just starting my day :sigh:

Brain Candy
May 18, 2006

Ghost of Reagan Past posted:

It's not you, it's your boss. He's a gigantic piece of poo poo.

Not an emptyquote.

the talent deficit
Dec 20, 2003

self-deprecation is a very british trait, and problems can arise when the british attempt to do so with a foreign culture





Shirec posted:

Same except my email. I'm starting to get the internal dread that I got passed over :smith: I'm trying to not think about it too much cause I don't want to cry at work.

remember that there's lots of reasons they might pass on you and you not being good enough for the job is probably the least likely reason they'll pass if they do. they may have candidates with personal connections to existing employees or they may have candidates who asked for less money or they may just have selected someone who had a particularly good day the day they interviewed. getting them to fly you out for an interview is proof you were almost certainly good enough for the role and getting passed over for this particular role doesn't really indicate anything. no matter what response you get keep applying and interviewing and you'll find something else better. i've got 10 years of experience, a bunch of impressive sounding titles and roles on my resume and i still get passed over for jobs. it's not the end of the world

vonnegutt
Aug 7, 2006
Hobocamp.

Ghost of Reagan Past posted:

It's not you, it's your boss. He's a gigantic piece of poo poo.

also if any job interview starts asking about why you want to leave with <1 year experience, you can honestly say that your boss is talking about offshoring your position and you don't see a future there. No one would fault you for looking for a new job if you have clear evidence that your job may not exist soon.

vonnegutt fucked around with this message at 21:27 on May 30, 2018

CPColin
Sep 9, 2003

Big ol' smile.
Holy poo poo the changelog for this vendor application we, thankfully, opted not to use:

  • The login process was made more secure by incorporating an RSA 2048-bit public key from the server, which is used to encrypt both the user name and password prior to transmitting them to the server. All credentials are now transmitted in a secure form even if the link itself is not secure. The key is ephemeral and persists only as long as the session, so subsequent logins use a new key.
  • The login process was modified to work correctly over an SSL connection, or a non-SSL connection within a DMZ or behind the firewall.
  • Fixed the issue in the [Foo] screen where the format of certain dollar amounts was inadvertently converted to a date value.
  • Resolved all XSS and XSRF vulnerabilities.
  • Every user must change their password the first time they access any of these web applications. This requirement is due to a change in the method of persisting login credentials in the underlying database. Passwords are no longer stored in a recoverable format within the database.
  • The Forgot Password feature now uses a time-limited, single-use link that is provided through an email message.
  • The account-locking functionality changed to adhere to best practice recommendations and there were a number of behind the scenes changes to address issues identified in internal and external web application security penetration tests.
  • (Several versions later) Applications now require a secure browser connection using the HTTPS protocol. Attempted HTTP connections are now automatically redirected to HTTPS.
  • You can no longer link to sensitive documents like W-2 forms across sessions. Now, you must first log into [Foo] and navigate to the appropriate page under the [Bar] section. Any previously-saved bookmarks to W-2 forms or other sensitive documents are no longer valid.
  • Updated [Foo] to improve security of the Home Address page under the [Bar] section. These changes prevent any unintended or unauthorized modifications to personal information in read-only fields.

It took years for everybody around here to agree not to select this vendor! I especially like the last bullet point there, because it has the hallmarks of code that blindly trusts whatever form data gets sent to it and I've already found a spot or two in our own code that does the same thing!

Rocko Bonaparte
Mar 12, 2002

Every day is Friday!
I yearn for a kinder, simpler time when I read about Pollyanna being stuck in a small hole versus this whole new trapped-in-shithell thing.

Edit: Also, there's a real simple way to make all the tests go green. Just assert them against true! It's real simple to do; it's what the offshore team is gonna do!

Rocko Bonaparte
Mar 12, 2002

Every day is Friday!

CPColin posted:

Holy poo poo the changelog for this vendor application we, thankfully, opted not to use:

...

It took years for everybody around here to agree not to select this vendor! I especially like the last bullet point there, because it has the hallmarks of code that blindly trusts whatever form data gets sent to it and I've already found a spot or two in our own code that does the same thing!
Are you so sure the alternative really is better? Other changelogs might be omitting mentions of security holes you could drive a truck through simply because they aren't even acknowledging they have a problem.

CPColin
Sep 9, 2003

Big ol' smile.

Rocko Bonaparte posted:

Are you so sure the alternative really is better?

We have not evaluated any alternatives. I am sure this one is bad, especially since so many of these bug fixes are based off of feedback their customers have given over the years, i.e., not because they actually caught stuff via their own testing.

Edit: Or did you mean "alternative" as "not putting stuff in the changelog"? I'm glad they're putting stuff in the changelog, but the stuff they've been having to fix is indicative of pretty poor coding and testing standards on their end.

CPColin fucked around with this message at 21:46 on May 30, 2018

Gildiss
Aug 24, 2010

Grimey Drawer

Rocko Bonaparte posted:

I yearn for a kinder, simpler time when I read about Pollyanna being stuck in a small hole versus this whole new trapped-in-shithell thing.

Edit: Also, there's a real simple way to make all the tests go green. Just assert them against true! It's real simple to do; it's what the offshore team is gonna do!

I think that shitdevils plan is for his US team to write unit tests and then the offshore team writes the code that then passes those tests?

Shirec
Jul 29, 2009

How to cock it up, Fig. I

Gildiss posted:

I think that shitdevils plan is for his US team to write unit tests and then the offshore team writes the code that then passes those tests?

It is. We currently only have 3 devs locally (me and my two co-workers) working on a new version of our product. We have a version 1 that is built entirely by offshore but it's unwieldy, badly coded, incredibly insecure, and only works through a lot of hard coding for individual customers.

The original plan that was sold me to me was our local team was going to build version 2, which was multi-tenant and infinitely scalable. All of us are brand new devs (one CS grad, two bootcamp). I came on in mid October, we went almost immediately into minimum 60 hour weeks. Lots and lots of learning and getting stuff to work in probably not the right way, none of it TDD.

Blood, sweat, and tears, we got 1.0 ready to go, rickety and buggy, by mid December. Boss presents it to CEO, CEO says he wants the ability to pause this and that, do some other things that make multi tenant completely infeasible. So we have to re-do all of it. We get a week and a half of blissful vacation and come back to this news.

We start to gear up again, getting told we only have 3 months to get what was done in a year, with no UI this time. I'm tasked with making a separate custom stand alone server that can read dropped in customer data to send along to our standardized platform. Constant revisions and backtracking and new best ways of doing things and we are still currently re-writing all the unit tests because now we have a NEW best standard. Hours aren't as bad as they used to be but we still can be here until 8 or 9 at night. During all of this, I'm normally sidelined and not involved in planning discussions.

Because we can't keep up and aren't totally enthusiastic about the plan to go to a 60 hour week again, boss says he has no choice and goes to the unit test plan that you spoke of. I also got some interesting insight that when he meets with our board, he can't mention that one reason for our version is that it will be secure with patient data, while the current one is not. Because they don't know it's insecure, or if they do, they don't know it's as dire as it is. So it's an interesting thought what I could do with that, but I also don't know anyone in my company except my boss an my 2 co-workers

tl;dr it's all kind of an insane mess of constant rewrites

edit: Also I feel insanely bad about the insecure patient data stuff and plan on reporting things to HIPAA as soon as I quit, no small part of my current anxieties is about that. I didn't know how bad it was until it became more and more evident, and then my boss started saying more

Shirec fucked around with this message at 23:14 on May 30, 2018

B-Nasty
May 25, 2005

CPColin posted:

It took years for everybody around here to agree not to select this vendor!

Jesus Christ. I mean, I guess it's good they're *now* taking more of a security focus, but most of those issues are AppSec/OWASP 101 level stuff. I'd be most concerned with the 'no longer direct link' bit, as applications not designed with proper AuthZ to resources (a.k.a. insecure direct object reference) from the start are awfully hard to retrofit and lock down.

The overposting one is also probably hiding some deep holes as well. Someone should write a browser extension that automatically adds:
IsAdmin: true
Role: admin
etc

to all user-info form POSTs for giggles.

CPColin
Sep 9, 2003

Big ol' smile.

B-Nasty posted:

I'd be most concerned with the 'no longer direct link' bit, as applications not designed with proper AuthZ to resources (a.k.a. insecure direct object reference) from the start are awfully hard to retrofit and lock down.

Yep. This isn't the only time they've had issues with people loving around with query strings, either. During the last round of my coworkers testing this stuff, before I got here, they noticed you could look at other users' info by stuffing their ID's into the query strings. You could also elevate your privileges by messing with your cookies. Their solution to both issues was to encrypt the parameters. For the cookies, they left the unencrypted versions sitting there, right next to the encrypted versions, effectively painting a giant target on them. That feedback must've gotten back to them, because the latest version removed the plain-text cookies.

Did I mention one of the reasons my coworkers rejected this vendor previously was because passwords were case-insensitive and would have whitespace trimmed when the login form was submitted? I have a feeling that "Passwords are no longer stored in a recoverable format within the database" bit means "Passwords are no longer stored in plain text." I didn't see that version of the application, though, so I couldn't confirm it.

redleader
Aug 18, 2005

Engage according to operational parameters

CPColin posted:

Did I mention one of the reasons my coworkers rejected this vendor previously was because passwords were case-insensitive and would have whitespace trimmed when the login form was submitted? I have a feeling that "Passwords are no longer stored in a recoverable format within the database" bit means "Passwords are no longer stored in plain text." I didn't see that version of the application, though, so I couldn't confirm it.

It absolutely means that passwords are stored in a plaintext varchar field. I've seen this exact thing before.

redleader
Aug 18, 2005

Engage according to operational parameters
Shirec, internalize this:

fourwood posted:

You are good and he is awful.
and this:

Ghost of Reagan Past posted:

It's not you, it's your boss. He's a gigantic piece of poo poo.


Shirec posted:

The original plan that was sold me to me was our local team was going to build version 2, which was multi-tenant and infinitely scalable. All of us are brand new devs (one CS grad, two bootcamp). I came on in mid October, we went almost immediately into minimum 60 hour weeks.

one reason for our version is that it will be secure with patient data, while the current one is not.

Holy loving poo poo, I thought this was just some boring LOB app owned by some cheapskates, and not something that handles healthcare data. Even if your boss was a saint, you should still be deserting this sinking ship because it is going to go down hard.

Virigoth
Apr 28, 2009

Corona rules everything around me
C.R.E.A.M. get the virus
In the ICU y'all......



The words infinitely scalable makes me want to punch things.

Bruegels Fuckbooks
Sep 14, 2004

Now, listen - I know the two of you are very different from each other in a lot of ways, but you have to understand that as far as Grandpa's concerned, you're both pieces of shit! Yeah. I can prove it mathematically.

Shirec posted:

Blood, sweat, and tears, we got 1.0 ready to go, rickety and buggy, by mid December. Boss presents it to CEO, CEO says he wants the ability to pause this and that, do some other things that make multi tenant completely infeasible. So we have to re-do all of it. We get a week and a half of blissful vacation and come back to this news.

omfg are you working on a vna (vendor neutral archive)?

Shirec
Jul 29, 2009

How to cock it up, Fig. I

Bruegels Fuckbooks posted:

omfg are you working on a vna (vendor neutral archive)?

No, we’re a messaging platform. We take uploaded information from whatever health care facility and perform some sort of messaging action with it. Payment reminders, surveys, reminding people to get their H1C1 levels checked, etc etc.

Pollyanna
Mar 5, 2005

Milk's on them.


Shirec posted:

No, we’re a messaging platform. We take uploaded information from whatever health care facility and perform some sort of messaging action with it. Payment reminders, surveys, reminding people to get their H1C1 levels checked, etc etc.

Ew, I know the kind. Those places are a dime a dozen in Boston and basically none of them are any good.

spiritual bypass
Feb 19, 2008

Grimey Drawer

Shirec posted:

We currently only have 3 devs locally working on a new version of our product. All of us are brand new devs

Whoa, I don't remember you mentioning this before. No wonder your coworkers are all cowards!

Shirec
Jul 29, 2009

How to cock it up, Fig. I

rt4 posted:

Whoa, I don't remember you mentioning this before. No wonder your coworkers are all cowards!

That's one of the sticking points my boss hates about me. I've got 6 years of corporate experience before this (and they weren't all magic wonder jobs) so I know what a good work environment looks like and how to maintain my own balance. This isn't my first job so I'm not skipping all my lunches, never taking vacation, and working until 7 every night to impress the boss, unlike the other guys.

I've tried to talk to them about what healthy work place looks like, but it's all on deaf ears. Also, hilariously, I'm the best paid out of the three (another thing my boss likes to threaten me with because I'm not 'worth' it). My one co-worker with an actual CS degree is paid somehow less than I, and my team lead gets the same as me, and I took a pay cut for this job, so we're all very under market.

Bruegels Fuckbooks
Sep 14, 2004

Now, listen - I know the two of you are very different from each other in a lot of ways, but you have to understand that as far as Grandpa's concerned, you're both pieces of shit! Yeah. I can prove it mathematically.

Shirec posted:

No, we’re a messaging platform. We take uploaded information from whatever health care facility and perform some sort of messaging action with it. Payment reminders, surveys, reminding people to get their H1C1 levels checked, etc etc.

that's almost a relief, if those kind of HIPAA problems were going on with someone working on a VNA, that would be the most ridiculous lawsuit ever.

Adbot
ADBOT LOVES YOU

prisoner of waffles
May 8, 2007

Ah! well a-day! what evil looks
Had I from old and young!
Instead of the cross, the fishmech
About my neck was hung.

Shirec posted:

That's one of the sticking points my boss hates about me. I've got 6 years of corporate experience before this (and they weren't all magic wonder jobs) so I know what a good work environment looks like and how to maintain my own balance. This isn't my first job so I'm not skipping all my lunches, never taking vacation, and working until 7 every night to impress the boss, unlike the other guys.

I've tried to talk to them about what healthy work place looks like, but it's all on deaf ears. Also, hilariously, I'm the best paid out of the three (another thing my boss likes to threaten me with because I'm not 'worth' it). My one co-worker with an actual CS degree is paid somehow less than I, and my team lead gets the same as me, and I took a pay cut for this job, so we're all very under market.

ahhh, is that why you're getting the worst treatment, because you're the one who best understands how unfair/unrealistic/unpleasant the environment is?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply