Yep I see this at work pretty regularly - a SpringBoot log file full of requests for all sorts of things (mostly WordPress but I think some IIS as well).

Yeah I wanted to use alg none for some unit tests once (it was easier than setting up the next lowest tier security option) but whichever Java library I was using had completely disabled it. I could see it had been supported at some point but it had been updated so that it couldn't be enabled at all.

Yes, that’s a good thing. That alg:none might be easy in tests is not a good reason for a weak mode in the real code and spec.

Been there, done that, wrote the stub/mock and ended up with the better test. :)

Wasn’t it like a month ago when Sharepoint still accepted alg:none? I guess that proves they’re not using Java :)

Yeah same with AWS - they say they can't see my custom KMS key but... this stuff all lives on their servers, not on my servers. AWS definitely have the ability to see my KMS keys and decrypt my data but I assume that they won't unless a judge tells them to.

Yeah agreed - any ephemeral stuff I need is generally in DynamoDB - S3 (and database) are for permanent storage.

> I remember Cisco before iOS used to have hundreds of branches for their router, one branch for each major customer that was demanding specific features. It was unmanageable

Ouch. I heard of a company in my home town (small B2B service provider) doing something similar - they paid well but I didn't think it was worth it.

I know someone who worked there maybe 10 years ago in an embassy, and it was wild in a very bad way.

- they had a meeting with some locals and the locals discussed the need for retaliation for something, and their plan was to rape someone's daughter

- a kid bought a mini packet of chips on credit from a general store, the debt wasn't repaid and the end result was the general store getting burned down

- a fellow employee forgot to lock their car doors (everyone gets told to do this) and was car-jacked, but he got his car back because the car-jacker couldn't drive a manual car

- the embassy had high fences and security, but just in case, each house within the embassy compound had a central panic room in case the outer wall is breached

It's sad because I know of people who worked there in the 1970s (for Australians it was close to home but a bit of extra money because it was overseas) and it was apparently fine back then, but lawlessness has well and truly taken over.

And on the flip-side, if it's an exec at another company getting tarred and feathered by the media for their incompetence, it means they probably won't end up at my company in six months' time and do the same thing.

> My bank does not charge for deposits or change; this would be insane and I've never encountered this in the US.

Some smaller banks in Australia do but the big ones all have cash and coin ATMs which are free for account holders.

On a Mac I have no idea what, if anything F5 does in Chrome. Refresh is the much more annoying Cmd+r.

CGNAT'ed IP address? I get occasional CloudFlare blocks at home from some hobby-related websites I visit maybe once a week, and I know that no one else in my house is doing anything to hit rate limits.