The Daily WTF: Curious Perversions in Information Technology

da Doctah · 2013-02-20 Reply Admin

Not of Waterloo:
That's how my University's email server handles detected spam too; it appends ***SPAM*** to the subject but otherwise leaves it untouched. I assume Waterloo is doing the same. Is the wtf that the submitter's client didn't then catch it, or is the submitter unaware of the feature because they rarely get (detected) spam from that account?

Every once in a while, I have to feel sorry for the people at Hormel. I'll bet a good ninety percent of their legitimate marketing mail gets dropped right in the trash.

2013-02-21 Reply Admin

I think all of you are taking this "Security Hole" way too seriously. At the very least, you're making some pretty big assumptions about the environment these motion sensor doors are in.

I've worked in a building that had a similar setup. It wasn't a government secret lab, or a bank. We mainly had the mag lock doors because:

a.) We were located in an area of town with a lot of foot traffic, including some riff raff. We didn't want random people just walking into our office. (This happened more often than you would think through the front door.)

b.) We were required to for PCI compliance.

We weren't concerned about a boogeyman waiting outside of the door to slip in and steal our secret data.

Of course the security genius explicitly mentioned concern for letting the boogeyman in though, so nevermind :-/

2013-02-21 Reply Admin

NMe:
Anon:
I've seen some spam filters that work by tagging messages detected as spam by adding "*****SPAM*****" to the subject line. They expect you to configure your mail client to take whatever action you want on messages that have been tagged.
This is indeed just a spam filter that adds that designation to the subject line. Spam filters work by giving points to an email and if the points go above a certain threshold, they mark it as possible spam in this way but still deliver it. If the points go above an even higher threshold, the mail gets deleted.
So in short: not a WTF, just a loosely configured spam filter.

Not a WTF, just a lousy configured mail user agent. In some countries you are not allowed to decide how to deal with an email that you think is spam if you are not the addressee. This is why filters do spam tagging for users to act upon. OTOH greylisting does not fall in this trap.

Now if the submitter thinks that this is a WTF s/he has not received a lot of spam in his/her life. Which brings me to a whole new category of WTF: Beginners that think they know how the world works...

2013-02-21 Reply Admin

Some Damn Yank:
Swedish tard:
Some Damn Yank:
Frank:
Not sure I see the face-palm issue with the motion-detectors. Apparently they want to restrict use of the building by unauthorized people. Is that what you're objecting to? If not, how else do you propose they do this?

This is exactly how our building does it. Otherwise, you'd need a card reader on the inside to get out. Where's the WTF?
A button will suffice. And it is also cheaper and more secure and more obvious, and more durable than a motion detector.
I don't see how a button, with moving parts, is more durable than a motion detector, with no moving parts. Also, our doors have crash bars in case of fire, so it's just a convenience. We're not the only tenants, all the doors in this building are like this. So far security hasn't been an issue - if anyone really wants in they can always break a window.

And yet, at my previous job, the motion scanners stopped working several times in various places, whereas the buttons did not. Sometimes dust covered the sensor, sometimes the sensors broke and sometimes they just plain stopped working and needed a power cycle.

2013-02-21 Reply Admin

Anon:
When exiting the facility, you no longer need to push the door handles.

So...was this really a problem before?

Of course it was!

(For the consulting company's motion sensor business...)

2013-02-21 Reply Admin

Dave:
this comment of 'frist' I personally found outdated.

That is defenetly true, I agree. Except it is half true.

2013-02-21 Reply Admin

Age below 30? Is that actually legal in the US? Age discrimination!

2013-02-21 Reply Admin

da Doctah:
Every once in a while, I have to feel sorry for the people at Hormel. I'll bet a good ninety percent of their legitimate marketing mail gets dropped right in the trash.

There is no such thing as "legitimate marketing mail".

There can be "legitimate marketing" but it isn't mail. It is called a web site. If I want to know about your crap, I will come to you.

2013-02-21 Reply Admin

shadowman:
Evidently Java doesn't require one to use source or follow compile rules?

In Java you can use frameworks like Spring, so bad references don't give you any problems before run-time.

RobFreundlich · 2013-02-21 Reply Admin

me:
But it's secure!!:
At our university, in rooms for the Computer Science students, they installed motion detectors like this. They had to disable them when students starting slipping paper over the top of the door to get access.
We had this in our old office. Once some of us tried, just for fun, to get in without using our keys. We managed to get through the main door and our office door MacGyver style with the help of a newspaper, some cardboard, and a stapler. Very secure!

Ditto for my old office. Of course, they made it very easy for us by making sure there was a 1-inch gap between the doors AND between the doors and the floor.

2013-02-21 Reply Admin

Ironside:
TheLazyHase:
Steve The Cynic:
Carl:
I guess you all want to use your badge and PIN to get out, is that it? And what about when the lock fails closed as described earlier?
If a door has a window, and its lock fails closed, you use a chair, hammer, or other large object (e.g. the GAU-8 you carry in your back pocket for moments like this) to open the window. Of course, the window doesn't close easily after you've opened it with a chair, but if there's a raging fire behind you, do you really care about that?

Have you ever been in a panicked mob ? If yes, you would understand why that kind of door (the one who cannot be opened if there is an outage) are forbidden in Europa - and I belive in America too.

When you have a fire behind you - and, more importantly, hundred of other people fleeing the same thing - you'd better be able to open the door without hurdle, 'cause you may not be able to backtrack to a windows. In fact, even a door which need to have free space on the inside to open (because of the way the hinge are placed) can cause death in thoses situations.

I believe humans are forbidden from building anything on Europa, not just doors.

No, it is in Japan. They are compelled to build anything using robots only.

RobFreundlich · 2013-02-21 Reply Admin

shinyemptyhead:
Setting aside the very real possibility of leaving your badge inside and locking yourself out, note that it triggers on any movement, not on some deliberate buzzing motion. So basically if I walk past a door, it will unlock. At that point the entire system becomes dependant on my challenging the person coming in - which, human nature being what it is, nobody will do after the first week.

When my startup was eaten by a large company that specializes in anti-virus software, we were shown a video about "physical access security" that included an exhortation about not letting anyone in AT ALL, as well as every single person having to swipe their ID badge to come in.

It had a very earnestly presented bit about John Q Evildoer who had just been fired that day and wanted to get back into the building to wreak havoc in revenge for his firing. Bill Friendly recognized John but didn't know he'd been fired, Falling for the old "I forgot my badge" trick, he let John in, leading to unimaginable horrors and damage.

When the video ended, we all solemnly promised to never let anyone into the building and to never piggyback on someone else's card swipe. And then promptly proceeded to let our friends into the building when they forgot their cards and to piggyback on each others card swipes when coming in as a group.

powerlord · 2013-02-21 Reply Admin

SPAM takes me back... it's one of the ways Apache SpamAssassin marks emails that it thinks are spam if you don't have it configured to delete emails.

2013-02-21 Reply Admin

RobFreundlich:
shinyemptyhead:
Setting aside the very real possibility of leaving your badge inside and locking yourself out, note that it triggers on any movement, not on some deliberate buzzing motion. So basically if I walk past a door, it will unlock. At that point the entire system becomes dependant on my challenging the person coming in - which, human nature being what it is, nobody will do after the first week.

When my startup was eaten by a large company that specializes in anti-virus software, we were shown a video about "physical access security" that included an exhortation about not letting anyone in AT ALL, as well as every single person having to swipe their ID badge to come in.

It had a very earnestly presented bit about John Q Evildoer who had just been fired that day and wanted to get back into the building to wreak havoc in revenge for his firing. Bill Friendly recognized John but didn't know he'd been fired, Falling for the old "I forgot my badge" trick, he let John in, leading to unimaginable horrors and damage.

When the video ended, we all solemnly promised to never let anyone into the building and to never piggyback on someone else's card swipe. And then promptly proceeded to let our friends into the building when they forgot their cards and to piggyback on each others card swipes when coming in as a group.

but then the UPS or FEDEX guy just get's buzzed in with no check at all.

2013-02-21 Reply Admin

I once worked at a manufacturing plant that required you to swipe your card to get in and to get out. There was a crash bar on the door and nothing to stop you from pushing it to get out, however your ID card would still believe you were in the building(because you didn't swipe out) and not let you swipe back in. Employees were trained very well to not let people piggyback on their ID to get in, (ie. you were fired if caught)

The best part for me was my shift started at 4:30am and the main entrance which would be manned by a receptionist who could call security to explain your mistake did not open until 7:00am. After not being paid a couple hours work and getting a stern lecture from my supervisor, I learned to always swipe my ID whenever I walked through a door.

I'm not sure why they had this level of security. I worked on circuits for touch screen controllers. I think some contracts in another part of the building had a requirement for auditing who was working on the project.

2013-02-21 Reply Admin

Paul:
jay:
Not to say that there aren't stupid regulations. It's possible.
More like it's guaranteed.
Politicians love regulations because it expands their power base ...

Consider: there were lots of regulators monitoring the banks. But instead of making rules that said "you have to be careful with people's money" they said "you must issue X% of your loans to low income people who will never be able to pay them back." All because politicians wanted to look like they were "doing something" about the "home ownership problem".

Sure. To get off on one of our economic/political tangents ...

I don't know how many times I've heard media people talk about how the problem was "predatory lending". By that term they mean, Banks lending money to people that they knew would never be able to pay it back. Now let's think about this carefully: Why would a bank lend money to someone that they knew couldn't pay it back? And how is this taking advantage of the borrower? Of course they did it because the government forced them too. And it wasn't the bank taking advantage of the borrower; it was politicians taking advantage of the bank. When the whole thing collapsed, then the politicians decided that they had to bail out the banks, and so it became the politicians and the banks conspiring together to take advantage of the taxpayers.

But the whole idea that our banking problems were caused by greedy banks who were insufficiently regulated is absurd. The problem was grandstanding politicians over-regulating the banks.

2013-02-21 Reply Admin

The SPAM tag was probably added by spam-filtering software, not by the original spammer.

The "Maximum 30 years old" spec in a job ad is probably illegal where I live (Ontario, Canada.) I do not believe you're allowed to discriminate on the basis of age.

2013-02-21 Reply Admin

Sam:
da Doctah:
Every once in a while, I have to feel sorry for the people at Hormel. I'll bet a good ninety percent of their legitimate marketing mail gets dropped right in the trash.
There is no such thing as "legitimate marketing mail".
There can be "legitimate marketing" but it isn't mail. It is called a web site. If I want to know about your crap, I will come to you.

Like so many things in life, the idiots and the crooks ruin it for everybody.

Imagine a world where companies sent email advertisements for their products to people whom they had some reasonable cause to believe might actually be interested. Like, they had previously bought something from this company, or from a competitor. Imagine that they sent these emails at reasonable frequencies, like perhaps once every couple of months. So the average person got two or three emails a day containing advertising for products that he might actually be interested in buying.

The people receiving the email might actually find it useful. If not, it would be easy to identify and trash two or three emails a day, and while people might complain about it, it really would be no big deal.

But then the idiots and crooks got involved. So to take myself as an example, I get dozens of emails every day for products that I have absolutely no interest in. Often I get several emails per day for the same product. I get several emails per day for viagra, despite the fact that I am not married, dating, or otherwise involved or looking to be involved with a woman, nor have I ever had the sort of problem that viagra is supposed to treat. I get ads for women's clothes, despite the fact that I am not married, etc, nor am I a transvestite. I get ads trying to sell me airplanes, despite the fact that I do not have a pilot's license nor am I remotely rich enough to buy an airplane. And of course, I get many emails from Nigerians who apparenlty found my email address at random and are now eager to give me millions of dollars for no apparent reason.

I'll have to count, but I'd guess that 90% of the email I receive is spam.

2013-02-21 Reply Admin

jay:

I don't know how many times I've heard media people talk about how the problem was "predatory lending". By that term they mean, Banks lending money to people that they knew would never be able to pay it back. Now let's think about this carefully: Why would a bank lend money to someone that they knew couldn't pay it back? And how is this taking advantage of the borrower? Of course they did it because the government forced them too. And it wasn't the bank taking advantage of the borrower; it was politicians taking advantage of the bank. When the whole thing collapsed, then the politicians decided that they had to bail out the banks, and so it became the politicians and the banks conspiring together to take advantage of the taxpayers.

But the whole idea that our banking problems were caused by greedy banks who were insufficiently regulated is absurd. The problem was grandstanding politicians over-regulating the banks.

Lending money to people who can't pay it back results in a net profit, as long as the value of the collateral is as much or more then the loan and the person makes at least one payment. In the case of home loans the collateral is the house which is worth as much as the loan + the down payment, meaning the house is already worth more than the total sum loaned. This means that unless the house market crashes the bank can then sell on the house at the same price and keep the down payment and any payments made on the loan.

Also in the case of the GFC small banks would also package up a whole bunch of bad loans and sell them on to larger financial holding companies, making it no longer the banks problem whether people could pay or not as they already made their money. This encouraged them to get more clients regardless of whether of whether the loan would even theoretically make a profit.

However because poor people were buying big houses the housing market went nuts, building more and more houses as the prices climbed until people started to default on loans, then the banks tried to sell on the houses that were defaulted, this combined with the fact that there were now tons of new houses being finished meant that the price of houses plummeted, meaning the collateral of home loans was suddenly worth less than the loan itself was. Of course the first thing that happened is the big boys stopped buying sub prime mortgage packages, leaving the smaller banks with worthless home loans and the big firms with many AAA investment packages that infact, were worthless.

This lead to mass defaults when people realized that the homes they had bought would now cost them many times more than they were worth and that many would loose their jobs.

If it had been illegal to engage in predatory lending techniques then this wouldn't have happened, if it was illegal to package up lots of worthless loans into apparently AAA investments this wouldn't have happened so clearly more regulations would have prevented this, and as there was a clear profit motive for all players up until the crash less regulation could have changed nothing. I think what we can best say is that there is a need for better regulations, more intelligently applied.

Also, do you really believe that any large business with a profit motive to act in an unethical way will not do so, greed never factors into the decision as the need for more money is the single driving force behind all business.

2013-02-22 Reply Admin

Snuffy:
Also, do you really believe that any large business with a profit motive to act in an unethical way will not do so, greed never factors into the decision as the need for more money is the single driving force behind all business.

The vast majority of commenters here (as well as the vast majority of programmers/IT people I've met in real life) are libertarians. Take from that what you will.

2013-02-22 Reply Admin

jay:
Paul:
jay:
Not to say that there aren't stupid regulations. It's possible.
More like it's guaranteed.
Politicians love regulations because it expands their power base ...

Consider: there were lots of regulators monitoring the banks. But instead of making rules that said "you have to be careful with people's money" they said "you must issue X% of your loans to low income people who will never be able to pay them back." All because politicians wanted to look like they were "doing something" about the "home ownership problem".

Sure. To get off on one of our economic/political tangents ...

I don't know how many times I've heard media people talk about how the problem was "predatory lending". By that term they mean, Banks lending money to people that they knew would never be able to pay it back. Now let's think about this carefully: Why would a bank lend money to someone that they knew couldn't pay it back? And how is this taking advantage of the borrower? Of course they did it because the government forced them too. And it wasn't the bank taking advantage of the borrower; it was politicians taking advantage of the bank. When the whole thing collapsed, then the politicians decided that they had to bail out the banks, and so it became the politicians and the banks conspiring together to take advantage of the taxpayers.

But the whole idea that our banking problems were caused by greedy banks who were insufficiently regulated is absurd. The problem was grandstanding politicians over-regulating the banks.

You clearly do not understand how the system was set up. The banks were just making as many loans as they possibly could, because they then packaged those loans into opaque bundles which they sold to other banks. So if the loans failed, it wasn't their problem. I believe there were commonly several stages of this bundling, and in some cases banks would actually then short on the bundled loans that they themselves had sold -- essentially, BETTING THE HOMEOWNER WOULD DEFAULT. So they made a BIGGER profit if they gave a loan to someone who couldn't pay it back! Which was all made possible by the rating agencies giving great ratings to these bundles without even knowing what was inside them...generally because they were being directly paid to give them a good rating.

It was a giant casino, where they gambled with other peoples' money.

2013-02-22 Reply Admin

jay:
But then the idiots and crooks got involved. So to take myself as an example, I get dozens of emails every day for products that I have absolutely no interest in. Often I get several emails per day for the same product. I get several emails per day for viagra, despite the fact that I am not married, dating, or otherwise involved or looking to be involved with a woman, nor have I ever had the sort of problem that viagra is supposed to treat. I get ads for women's clothes, despite the fact that I am not married, etc, nor am I a transvestite. I get ads trying to sell me airplanes, despite the fact that I do not have a pilot's license nor am I remotely rich enough to buy an airplane. And of course, I get many emails from Nigerians who apparenlty found my email address at random and are now eager to give me millions of dollars for no apparent reason.

I get three or four snail-mail offers per week from Discover card. This has been going on for months. You'd think they would have figured out by now that I'm not interested. There's no way to opt-out (without opting out of all card offers, which I don't really want to do, because Discover is the only one that's an ass)...so instead, I'm saving them. Every one. And in another couple months, I'm gonna have hundreds of those fuckers. And I will take every last prepaid reply envelope, and I will stuff them with cardboard, wood scraps, scrap metal, anything I can find that's heavy, along with some notes explaining why, and go fill the mailboxes. It's not much, I know, but at least it's something...if enough people do it then they'll have to stop sending that crap so capriciously.

2013-02-22 Reply Admin

The building I formerly worked in had automatic doors. Access from outside was swipe card and PIN. From inside there was a motion sensor mounted on the top of the door frame.

There was a large awning attached to the outside of the door frame and held up at the far end by two support poles. We discovered if you kicked the pole just right, it would vibrate the awning, door frame, and sensor enough to open the door. From the outside.

CAPTCHA: Vulputate. What happens when a fox gets caught in aforementioned automatic doors.

2013-02-22 Reply Admin

Mike:
me:
Once some of us tried, just for fun, to get in without using our keys. We managed to get through the main door and our office door MacGyver style with the help of a newspaper, some cardboard, and a stapler. Very secure!
Easy there cowboy. Sure the penalty for breaking and entering is probably just a few months probation, but if the company had any "intellectual property" in there they could have fucked you up for life. Circumventing a copyright protection system -- even a flimsy one -- is a serious offense.
Under the - fortunately killed but frequently arising in a fresh corpse - SOPA legislation you could get 5 years for copying a Michael Jackson song... one year more than the doctor who killed him.

First off, notsureifserious.jpg.

Next, what does copyright protection have to do with anything? When was this mentioned?

Finally, this was not breaking and entering. The OP was authorized to enter this building. He just tried to do so in a non-conventional way.

2013-02-22 Reply Admin

Did you miss the part where you would have needed a heavier coat and thermal underwear too? And then there's the likelihood of getting fired for fucking with what could be considered "safety equipment".

You must have missed the part where it said motion sensor. These buggers don't detect proximity but motion instead, hence the name. So a piece of duct tape stuck to the sensor will trigger it only once. Then the door will close and the sensor will no longer cause the door to open.

2013-02-22 Reply Admin

Snuffy:
This means that unless the house market crashes the bank can then sell on the house at the same price and keep the down payment and any payments made on the loan.

Not true at all. A bank is not going to hold on to a house where the borrower has defaulted, for 30+ days (the usual minimum time it takes to sell a house). They're going to try to sell it as quickly as possible, which means it's going to be steeply discounted.

This is why credit rating and income are less important as the down payment amount increases. At a 30% discount, a house is going to sell pretty quickly, so the risk of being stuck with a property instead of cash is minimal.

tin · 2013-02-22 Reply Admin

powerlord:
*****SPAM***** takes me back... it's one of the ways Apache SpamAssassin marks emails that it thinks are spam if you don't have it configured to delete emails.

Yep. Surprised that it took until page 3 for someone to recognize this as the default Spam Assassin action.

Personally I prefer adding some question marks to such tags. It wasn't sure enough to just drop the message, so it shouldn't imply to the user that it knew what it was doing.

2013-02-23 Reply Admin

for the SPAM email. That was probably not put on by the writer of the email. A lot of times spam solution like postini or barracuda will teg a message that it believes is SPAM by adding it in the subject of the email. It does this when it is not 100% sure about the email and allows you to set your mail client rules accordingly

2013-02-24 Reply Admin

invalidemail.com is currently owned by Oracle, and I have seen email from this domain used in production by one of their hosted solutions.

Go figure. Perhaps the spammer wasn't being as lazy as you thought :-)

2013-02-25 Reply Admin

What has a moon of Jupiter to do with japan?

Kuba · 2013-02-25 Reply Admin

But it's secure!!:
At our university, in rooms for the Computer Science students, they installed motion detectors like this. They had to disable them when students starting slipping paper over the top of the door to get access.

This maybe works for microwave motion sensors. It absolutely doesn't work for passive infrared sensors, unless there's lot of hot light sources pointing to where your piece of paper would go...

Kuba · 2013-02-25 Reply Admin

David:
Didn't see anyone mention that requiring under a certain age, I believe, is illegal in the US for the purposes of employment. Could be wrong, but I think I'm not.

Never mind that you can't require someone never to have applied for a visa either. I'd even call it borderline to require no prior visa denials. Not all visa denials are the same. You can be denied for insufficient documentation -- that's quite different from being denied due to overstaying or due to fraud.

Kuba · 2013-02-25 Reply Admin

chairman tain:
Snuffy:
This means that unless the house market crashes the bank can then sell on the house at the same price and keep the down payment and any payments made on the loan.

Not true at all. A bank is not going to hold on to a house where the borrower has defaulted, for 30+ days (the usual minimum time it takes to sell a house). They're going to try to sell it as quickly as possible, which means it's going to be steeply discounted.

This is why credit rating and income are less important as the down payment amount increases. At a 30% discount, a house is going to sell pretty quickly, so the risk of being stuck with a property instead of cash is minimal.

I don't know where you live, but in the U.S. the banks are anything but quick in selling the foreclosed properties. They know full well that had they actually tried hard to sell those properties at a discount, there's so many of them, the market would crash again. I know plenty of decent foreclosed homes in the area where I live. Most of them have been on the market for over a year. About a third are on the market for well over 2+ years. Never mind the number of arbitrary hoops you have to jump through to even know those homes exist. For one, most realtors for some reason do not want to list the properties on the usual realtor websites. They simply don't show up in the search results. It's fucked up. And the banks whine about their losses on foreclosures -- they do nothing at all to sell them, duh!

2013-02-26 Reply Admin

Regarding "I Find This Vacancy Outdated". I'm wondering whether the email was originally in English or it was translated for posting here? That English is a WTF

2013-02-26 Reply Admin

The SPAM tagging is to allow you to set up a mail rule to junk it yourself if you so choose. Quite a few major ISPs do this, since it kinda gets them off the hook for false positives.

2013-03-12 Reply Admin

We have those proximity card and motion sensors with magnetic locks on our exterior doors too. Although our front door is mostly glass, so you can flex the glass by pulling hard on the handle which lifts the metal strip across the top of the door away from the bottom up, then walk right in.

2013-10-20 Reply Admin

chairman tain:
Snuffy:
This means that unless the house market crashes the bank can then sell on the house at the same price and keep the down payment and any payments made on the loan.

Not true at all. A bank is not going to hold on to a house where the borrower has defaulted, for 30+ days (the usual minimum time it takes to sell a house). They're going to try to sell it as quickly as possible, which means it's going to be steeply discounted.

Starting in 2009, things reversed, with homeowners wanting the banks to foreclose but the banks putting it off. Many people wanted to strategically default on their home loans–they had the income to pay their mortgage, but the value of the house had dropped, so the investment wasn't worth it. (It's a purely business decision, and businesses do it without compunction.) Mortgage holders dragged their heels in foreclosing because the market was glutted, and they don't want to be liable for taxes while holding the property any more than the homeowners do. Planet Money had an interesting episode about the phenomenon back in Jan, 2010.

2021-07-14 Reply Admin

chloroquine tablets amazon https://chloroquineorigin.com/# can hydroxychloroquine cause blindness

2022-05-09 Reply Admin

how safe is hydroxychloroquine https://keys-chloroquinehydro.com/

2022-06-04

Comment held for moderation.

Best of Email: Automated Insecurity, Outdated Vacancy, and a Burnt Tongue

Leave a comment on “Best of Email: Automated Insecurity, Outdated Vacancy, and a Burnt Tongue”