1y ago

What's a company secret you can share now that you no longer work there?

You're viewing a single thread.

301 comments

Our business-critical internal software suite was written in Pascal as a temporary solution and has been unmaintained for almost 20 years. It transmits cleartext usernames and passwords as the URI components of GET requests. They also use a single decade-old Excel file to store vital statistics. A key part of the workflow involves an Excel file with a macro that processes an HTML document from the clipboard.
I offered them a better solution, which was rejected because the downtime and the minimal training would be more costly than working around the current issues.
- The library I worked for as a teen used to process off-site reservations by writing them to a text file, which was automatically e-faxed to all locations every odd day.
  If you worked at not-the-main-location, you couldn't do an off-site reservation, so on even days, you would print your list and fax it to the main site, who would re-enter it into the system.
  This was 2005. And yes, it broke every month with an odd number of days.
- downtime
  minimal retraining
  I feel your pain. Many good ideas that cause this are rejected. I have had ideas requiring one big downtime chunk rejected even though it reduces short but constant downtimes and mathematically the fix will pay for itself in a month easily.
  Then the minimal retraining is frustrating when work environments and coworkers still pretend computers are some crazy device they’ve never seen before.
- cleartext usernames and passwords as the URI components of GET requests
  I’m not an infrastructure person. If the receiving web server doesn’t log the URI, and supposing the communication is encrypted with TLS, which removes the credentials from the URI, are there security concerns?
  
  Anyone who has access to any involved network infrastructure can trace the cleartext communication and extract the credentials.
  
  I'm not 100% on this but I think GET requests are logged by default.
  POST requests, normally used for passwords, don't get logged by default.
  BUT the Uri would get logged would get logged on both, so if the URI contained @username:Password then it's likely all there in the logs
  
  Get and post requests are logged
  The difference is that the logged get requests will also include any query params
  GET /some/uri?user=Alpha&pass=bravo
  While a post request will have those same params sent as part of a form body request. Those aren’t logged and so it would look like this
  POST /some/uri
- As weird as it may seem, this might be a good argument in favor of Pascal. I despised learning it at uni, as it seems worthless, but is seems that it can still handle business-critical software for 20 years.
  
  What OP didn't tell you is that, due to its age, it's running on an unpatched WinXP SP2 install and patching, upgrading to SP3, or to any newer Windows OS will break the software calls that version of Pascal relies upon.

301 comments