The Daily WTF

The Daily WTF http://thedailywtf.com/ The Daily WTF CodeSOD: Death of the Auth-Er https://thedailywtf.com/articles/death-of-the-auth-er <div>When writing Perl, it's not unusual to want to <code>die</code>. The <code>die</code> function ends your Perl program with an error string, and you'll often see code like: <code>die "My error" unless $i > 5</code> or <code>die "Other error" if check()</code>, because Perl just loves the backwards conditionals. What's even more fun with <code>die</code> is <a href="https://perldoc.perl.org/functions/die">how it behaves with <code>eval</code> blocks</a>, so it doesn't always kill your program, sometimes it is how you pass error strings back out of sections of your program.And poor Bobby has inherited some Perl that just really loves to <code>die</code>.<pre><code class="language-perl">public function store() { echo 'Hello'; die; if (Auth::attempt(Input::only('email', 'password'))) { echo 'done'; die; // return "welcome ".Auth::user()->username } echo "Oops! Fails"; die; return Redirect::back()->with_input(); } </code></pre>Bobby didn't send the source control history here, but I have a sense of what it likely was like, once. If they authenticate successfully, print a welcome message. If they don't, redirect back to the logon page and let them try again. I suspect they wanted to disable the route. So first they disabled the success path, only to discover that the failure path kept redirecting, so they disabled that too. Finally, they added the <code>Hello</code> at the top to disable the whole thing.Why? Why did they do any of this? No idea. It feels like debugging code, but you'd expect more <code>echo</code>s and fewer <code>die</code>s if that were the case. And you wouldn't expect it to leak into production and sit there for years, which is what happened here. Easy Reader Version: My favorite thing about Perl is that when they finally tried to make the syntax make sense, it pissed people off so badly they had to name the result as a new language, because they couldn't call in Perl without Perl programmers rioting. <style>.comment { border: none; }</style><div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">BuildMaster</a> allows you to create a self-service release management platform that allows different teams to manage their applications. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">Explore how!</a></div><div style="clear: left;"></div></div> CodeSOD https://thedailywtf.com/articles/death-of-the-auth-er Tue, 03 Nov 2026 06:30:00 GMT <div>When writing Perl, it's not unusual to want to <code>die</code>. The <code>die</code> function ends your Perl program with an error string, and you'll often see code like: <code>die "My error" unless $i > 5</code> or <code>die "Other error" if check()</code>, because Perl just loves the backwards conditionals. What's even more fun with <code>die</code> is <a href="https://perldoc.perl.org/functions/die">how it behaves with <code>eval</code> blocks</a>, so it doesn't always kill your program, sometimes it is how you pass error strings back out of sections of your program.And poor Bobby has inherited some Perl that just really loves to <code>die</code>.<pre><code class="language-perl">public function store() { echo 'Hello'; die; if (Auth::attempt(Input::only('email', 'password'))) { echo 'done'; die; // return "welcome ".Auth::user()->username } echo "Oops! Fails"; die; return Redirect::back()->with_input(); } </code></pre>Bobby didn't send the source control history here, but I have a sense of what it likely was like, once. If they authenticate successfully, print a welcome message. If they don't, redirect back to the logon page and let them try again. I suspect they wanted to disable the route. So first they disabled the success path, only to discover that the failure path kept redirecting, so they disabled that too. Finally, they added the <code>Hello</code> at the top to disable the whole thing.Why? Why did they do any of this? No idea. It feels like debugging code, but you'd expect more <code>echo</code>s and fewer <code>die</code>s if that were the case. And you wouldn't expect it to leak into production and sit there for years, which is what happened here. Easy Reader Version: My favorite thing about Perl is that when they finally tried to make the syntax make sense, it pissed people off so badly they had to name the result as a new language, because they couldn't call in Perl without Perl programmers rioting. <style>.comment { border: none; }</style><div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">BuildMaster</a> allows you to create a self-service release management platform that allows different teams to manage their applications. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">Explore how!</a></div><div style="clear: left;"></div></div> CodeSOD: Get It Now https://thedailywtf.com/articles/get-it-now <div>"TODO" comments are an inescapable part of our work. Yes, yes, you should just do it right the first time, everything should probably have a ticket in whatever your ticket system is for visibility, but at some point, you're just going to leave a "TODO" behind.But hopefully, the TODO gets TODONE, which is not what happened in Sam C's codebase.<pre><code class="language-php">function getnow() { //TODO return '2012'; } </code></pre>It's the <a href="https://xkcd.com/221/">XKCD</a>, but for years. Or <a href="https://knowyourmeme.com/memes/what-year-is-it">WHAT YEAR IS IN</a> memes.At least it's a relatively recent year, not some far off point from over a decade ago.Wait. 2012 was how long ago? That can't be right. It was just a few years ago! Easy Reader Version: The linear passage of time is a crime <div> [Advertisement] Plan Your .NET 9 Migration with Confidence Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. <a href="https://inedo.com/support/whitepapers/dotnet-guide?utm_campaign=dotnet&utm_source=tdwtf-footer">Download Free Guide Now!</a></div><div style="clear: left;"></div></div> CodeSOD https://thedailywtf.com/articles/get-it-now Mon, 02 Nov 2026 06:30:00 GMT <div>"TODO" comments are an inescapable part of our work. Yes, yes, you should just do it right the first time, everything should probably have a ticket in whatever your ticket system is for visibility, but at some point, you're just going to leave a "TODO" behind.But hopefully, the TODO gets TODONE, which is not what happened in Sam C's codebase.<pre><code class="language-php">function getnow() { //TODO return '2012'; } </code></pre>It's the <a href="https://xkcd.com/221/">XKCD</a>, but for years. Or <a href="https://knowyourmeme.com/memes/what-year-is-it">WHAT YEAR IS IN</a> memes.At least it's a relatively recent year, not some far off point from over a decade ago.Wait. 2012 was how long ago? That can't be right. It was just a few years ago! Easy Reader Version: The linear passage of time is a crime <div> [Advertisement] Plan Your .NET 9 Migration with Confidence Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. <a href="https://inedo.com/support/whitepapers/dotnet-guide?utm_campaign=dotnet&utm_source=tdwtf-footer">Download Free Guide Now!</a></div><div style="clear: left;"></div></div> CodeSOD: Oh, K? https://thedailywtf.com/articles/oh-k <div>Pierre found this cry for help:<pre><code class="language-c"> for (j = 0; j < DISTRICT_CARDINALITY; j++) { /* * A poor way to work around some sort of memory * violation. k gets clobbered, so I buffer l with it. * Help? */ for (k = 0, l = 0; k < customers; k++, l++) { /* c_id */ FPRINTF(output, "%d", l + 1); METAPRINTF((output, "%c", delimiter)); </code></pre>Honestly, I'm always a little worried in C-like languages when the loop variable isn't scoped to the loop and declared in place. Always concerning, so when there's concerns with clobbering, I'm not surprised.This iterates across a set of "districts", and then iterates across a list of customers. Standard output functions are replaced with macros, and honestly, I don't know that I want to know what happens in <code>METAPRINTF</code>.But fine, this iterates across a bunch of stuff and generates output. It's the comment that we're really curious about. "Some sort of memory violation", so we duplicate our loop variable. What on earth could be happening here?Well, Pierre found the "memory violation", which is probably what you expected:<pre><code class="language-c">k = strlen(someOutputString) - 8; </code></pre><code>k</code> is used elsewhere in the loop as a variable. That's not a memory violation, that's just how variables work.This leaves us with one possible conclusion: the developer who wrote the comment couldn't find this bug. And given the weird use of macros here, I'm going to go out on a limb and guess that it's not the developer's fault; I strongly suspect the loop is so long, so complicated, and so obfuscated that very few developers could find that.My earlier complaint about scoping the variable to the loop wouldn't fix this, which I guess is on me. They still should really scope the variable to the loop. Easy Reader Version: Don't get me started on languages that do variable hoisting and lift variables to the top of the function no matter where you declare them. <style>.comment { border: none; }</style><div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.<a href="https://inedo.com/proget?utm_source=tdwtf&utm_medium=footer&utm_content=PlebsFooter">Learn more.</a></div><div style="clear: left;"></div></div> CodeSOD https://thedailywtf.com/articles/oh-k Thu, 29 Oct 2026 06:30:00 GMT <div>Pierre found this cry for help:<pre><code class="language-c"> for (j = 0; j < DISTRICT_CARDINALITY; j++) { /* * A poor way to work around some sort of memory * violation. k gets clobbered, so I buffer l with it. * Help? */ for (k = 0, l = 0; k < customers; k++, l++) { /* c_id */ FPRINTF(output, "%d", l + 1); METAPRINTF((output, "%c", delimiter)); </code></pre>Honestly, I'm always a little worried in C-like languages when the loop variable isn't scoped to the loop and declared in place. Always concerning, so when there's concerns with clobbering, I'm not surprised.This iterates across a set of "districts", and then iterates across a list of customers. Standard output functions are replaced with macros, and honestly, I don't know that I want to know what happens in <code>METAPRINTF</code>.But fine, this iterates across a bunch of stuff and generates output. It's the comment that we're really curious about. "Some sort of memory violation", so we duplicate our loop variable. What on earth could be happening here?Well, Pierre found the "memory violation", which is probably what you expected:<pre><code class="language-c">k = strlen(someOutputString) - 8; </code></pre><code>k</code> is used elsewhere in the loop as a variable. That's not a memory violation, that's just how variables work.This leaves us with one possible conclusion: the developer who wrote the comment couldn't find this bug. And given the weird use of macros here, I'm going to go out on a limb and guess that it's not the developer's fault; I strongly suspect the loop is so long, so complicated, and so obfuscated that very few developers could find that.My earlier complaint about scoping the variable to the loop wouldn't fix this, which I guess is on me. They still should really scope the variable to the loop. Easy Reader Version: Don't get me started on languages that do variable hoisting and lift variables to the top of the function no matter where you declare them. <style>.comment { border: none; }</style><div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.<a href="https://inedo.com/proget?utm_source=tdwtf&utm_medium=footer&utm_content=PlebsFooter">Learn more.</a></div><div style="clear: left;"></div></div> CodeSOD: Session Recording https://thedailywtf.com/articles/session-recording <div>We still get a fair bit of old school ASP .Net webforms code, which was cutting edge about twenty years ago, but remains a collection of bad choices that tried to make web programming feel like desktop programming. As an aside, what a reversed world we live in today, where everyone uses Electron and our desktop programming feels like web programming.In any case, Thomas sends us some pretty ugly webforms code.<pre><code class="language-vbscript">Me.Session("Albumid") = CType(e.Item.FindControl("lblAlbumID"), Label).Text If Not Me.Session("Albumid") Is Nothing And Not Me.Session("Uid") Is Nothing Then Me.strDelSQL = "Delete from tbl_Albumshare_Mast where Album_Id=" & Me.Session("Albumid") & " and Sharer_ID=" & Me.Session("Uid") Me.objDB.ExecQry(Me.strDelSQL) Me.Response.Redirect("frmmyalbumshare.aspx", False) End If </code></pre>Broadly, the goal of this code is to take an album ID from the user and delete an album from the database where the ID matches and the album is owned by this user. And everything is horrible here.First, the use of <code>e.Item.FindControl</code> to look up the input field is suspicious. That's usually what you do when you've dynamically generated controls, but I don't think that's happening here. Because we use <code>FindControl</code> we have to cast it to <code>Label</code>, and only then can we get the text property. That itself raises a question, because why are user inputs getting stored in a label?. That's not what labels are for. They're clearly doing some sort of hacky lookup/autocomplete field thing and using the label to actually store the input, but presenting the user with a different UI for picking it. Not an uncommon pattern in those days, but a hidden field would be a more typical way of doing it.We then construct a SQL injection vulnerability and run it against the database.Then, we use a redirect to send the user to a different page. Again, a common thing to do back then, but a thing I hate: using HTTP 300 codes to redirect users as a form of navigation is awkward and weird.Of course, none of that is precisely the WTF here. The real WTF is the developer apparently hates local variables. <code>strDelSQL</code> is a member variable- why do we need to store this in a class member? Especially because in the page lifecycle, we handle one request and then die; either this is unnecessary, or far, far worse, some other code is looking at this SQL query later. But far worse than a badly scoped variable is the overuse of session variables.Thomas sends us this block as a representation, but the developer responsible just stored everything they could in a session variable. While in this example, "Uid" probably makes sense, "Albumid" definitely doesn't. And in other cases, basically every user form input gets stored in a session variable, and even worse: they're often used as loop variables. <code>while Session("myloop") < 5</code> type stuff.And finally, we already know I hate hungarian notation, but here we have a client side form holdover that pollutes the user experience: the URL they get redirected to has a hungarian <code>frm</code> prefix. It's bad enough that you're using hungarian notation, but don't show that to your users! They really don't need to see everything. Easy Reader Version: Webforms were a mistake, but an *interesting* mistake, and a weird historical time capsule. <div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. <a href="https://inedo.com/proget/private-nuget-server?utm_source=tdwtf&utm_medium=footer&utm_content=PlebsFooter&utm_campaign=Cyclops2020">Learn more.</a></div><div style="clear: left;"></div></div> CodeSOD https://thedailywtf.com/articles/session-recording Wed, 28 Oct 2026 06:30:00 GMT <div>We still get a fair bit of old school ASP .Net webforms code, which was cutting edge about twenty years ago, but remains a collection of bad choices that tried to make web programming feel like desktop programming. As an aside, what a reversed world we live in today, where everyone uses Electron and our desktop programming feels like web programming.In any case, Thomas sends us some pretty ugly webforms code.<pre><code class="language-vbscript">Me.Session("Albumid") = CType(e.Item.FindControl("lblAlbumID"), Label).Text If Not Me.Session("Albumid") Is Nothing And Not Me.Session("Uid") Is Nothing Then Me.strDelSQL = "Delete from tbl_Albumshare_Mast where Album_Id=" & Me.Session("Albumid") & " and Sharer_ID=" & Me.Session("Uid") Me.objDB.ExecQry(Me.strDelSQL) Me.Response.Redirect("frmmyalbumshare.aspx", False) End If </code></pre>Broadly, the goal of this code is to take an album ID from the user and delete an album from the database where the ID matches and the album is owned by this user. And everything is horrible here.First, the use of <code>e.Item.FindControl</code> to look up the input field is suspicious. That's usually what you do when you've dynamically generated controls, but I don't think that's happening here. Because we use <code>FindControl</code> we have to cast it to <code>Label</code>, and only then can we get the text property. That itself raises a question, because why are user inputs getting stored in a label?. That's not what labels are for. They're clearly doing some sort of hacky lookup/autocomplete field thing and using the label to actually store the input, but presenting the user with a different UI for picking it. Not an uncommon pattern in those days, but a hidden field would be a more typical way of doing it.We then construct a SQL injection vulnerability and run it against the database.Then, we use a redirect to send the user to a different page. Again, a common thing to do back then, but a thing I hate: using HTTP 300 codes to redirect users as a form of navigation is awkward and weird.Of course, none of that is precisely the WTF here. The real WTF is the developer apparently hates local variables. <code>strDelSQL</code> is a member variable- why do we need to store this in a class member? Especially because in the page lifecycle, we handle one request and then die; either this is unnecessary, or far, far worse, some other code is looking at this SQL query later. But far worse than a badly scoped variable is the overuse of session variables.Thomas sends us this block as a representation, but the developer responsible just stored everything they could in a session variable. While in this example, "Uid" probably makes sense, "Albumid" definitely doesn't. And in other cases, basically every user form input gets stored in a session variable, and even worse: they're often used as loop variables. <code>while Session("myloop") < 5</code> type stuff.And finally, we already know I hate hungarian notation, but here we have a client side form holdover that pollutes the user experience: the URL they get redirected to has a hungarian <code>frm</code> prefix. It's bad enough that you're using hungarian notation, but don't show that to your users! They really don't need to see everything. Easy Reader Version: Webforms were a mistake, but an *interesting* mistake, and a weird historical time capsule. <div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. <a href="https://inedo.com/proget/private-nuget-server?utm_source=tdwtf&utm_medium=footer&utm_content=PlebsFooter&utm_campaign=Cyclops2020">Learn more.</a></div><div style="clear: left;"></div></div> News Roundup: Security Fourth https://thedailywtf.com/articles/security-fourth <div>A bit ago, I broke with my usual pattern and <a href="https://thedailywtf.com/articles/the-frist-line-of-defense">wrote up some security issues</a> that I felt were particularly funny. It was a change of pace, a different thing, but not a thing that'd become a habit. After all, I'm not a security expert, this isn't a security site, and seriously, what are the odds that suitably funny security issues would crop up again less than a week later?Well.Let's start with the actual serious issue, <a href="https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities">PHP2Shell</a>. In terms of scope, every version of PHP for the past twenty years has had this bug. The general issue that permits the exploit was <a href="https://calif.io/php2shell/#an-interesting-timeline-of-events">known about</a>, but wasn't considered exploitable.Oops.The broad strokes of the bug is that it's two separate bugs. The first allows someone to bypass the checks on a request's size, thus giving them a direct route to triggering an out-of-memory error. The second is that, depending where you are in the processing pipeline, PHP doesn't properly handle cleanup, allowing for use-after-free that can trigger code execution. It doesn't matter what code you've written, this all happens before the request even hits your code.Bigger oops.This bug was found via LLM tools, which has lead to a lot of hype around the idea that we've <a href="https://www.wiz.io/blog/php2shell-php-rce#the-ai-inflection-point-26">entered some new era</a>. I'll certainly grant that the ability to throw compute at hacking challenges instead of human effort is going to shift the landscape, but I'm not quite willing to buy the apocalyptic prophecies. Especially when some of those prophets are telling us that their AIs will avoid deletion by <a href="https://www.cnbc.com/2026/10/13/anthropic-ai-models-self-replication-smart-devices.html">copying themselves onto your thermostat</a>. I think it's safe to say we're going to see a lot of security incidents coming out of LLMs in the near future, not because they're magic genius hackers, but because they're pretty good at processing structured text and running tests.For those of us living in the real world, the concern isn't AIs, but HIs: human intelligences. In this case, the exploit was discovered back in August. Security researchers and the PHP Foundation put their heads down to work on it, and where necessary, notified so-called "critical infrastructure providers" to ensure that everyone was ready to address the issue. The problem there is that two people can keep a secret if one of them is dead, and a lot more than two people got roped in to deal with this.Rumors were circulating in security circles. And cybersecurity firm <a href="https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues">Chainguard</a> decided this was good enough excuse to break the embargo and announce the flaw before patches were available. No patches for a flaw that impacts 20 years worth of software versions of widely deployed software.Patches are out now, though only for versions 8.2 and up. Source patches are out back to 7.4, which is officially end-of-life, but I have to wonder how many official EOLed copies of PHP are out there.On a lighter note, we can't let the hijinks of eMudhra pass without comment. eMudhra is, among other things, a root certificate authority. They've got a bunch of key pairs that they use to sign certificates for other customers, thus vouching for those customers' identity. As a root CA, they were trusted by pretty much every TLS/SSL implementation on Earth; if you had a certificate from eMudhra, every browser would trust that you were who you said you were.The only problem? One of their private keys was 4. Yes, it's the <a href="https://xkcd.com/221/">XKCD</a>.Now, in their defense(?), eMudhra didn't generate impossibly insecure keys. They performed a key signing ceremony and generated appropriately strong keys. Then they used an in-house tool to pack/unpack the keys, and this tool decided to truncate some of them down to one byte. Shockingly, even though ECC has relatively short key sizes, 8-bit ECC isn't secure! You could derive the private key from the public key using only pencil and paper. But the worst part is that they did check the validity of the keys- before they got truncated, giving them a false sense of security.The good news, for eMudhra, is that this particular key signing ceremony generated <a href="https://ministryofcyberaffairs.com/news/emudhra-ca-key-compromise-explained-what-happened-and-what-to-do-0a37748d-4de2-4578-b3bd-488487663407">a total of 24 keys</a>, and only 8 of them were truncated to the point of uselessness. I have it on good authority that <a href="https://www.youtube.com/watch?v=k5hWWe-ts2s&list=RDk5hWWe-ts2s&start_radio=1&pp=ygUdbWVhdGxvYWYgMiBvdXQgb2YgMyBhaW4ndCBiYWSgBwE%3D">two out of three ain't bad</a>.Now, after that disgrace, it's no surprise that eMudhra is <a href="https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/">dropping out of the certificate authority business</a>. Still, the press release where their chairman explains the rationale is some serious <a href="https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business">"screw you guys, I'm going home,"</a> energy.<blockquote>He added that global SSL/TLS is a small part of eMudhra’s business contributing to about 1% of the global revenue. Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base. However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business. In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders. For many certifying authorities, SSL/TLS is the whole business. For eMudhra it is one part of a much broader digital solutions portfolio. We will put our energy where we create the most value for customers with Sharpened Focus on Core Enterprise Solutions and trust services other than SSL/TLS.</blockquote>eMudhra's chairman added "There were no end entity certificates issued out of the affected CA’s. Its infrastructure was not compromised and no data was breached. All physical and logical security controls remained intact." That's thin sauce, of course, because while eMudra may not have issued any certs under the broken keys, anyone else could have. It's not that everyone is overreacting to a non-event, and more that it's a non-event only through sheer luck.Also, removing a root CA from your trust store isn't a trivial task, and at the time of this writing, there's still loads of cleanup that needs to happen as a result of this.Something I learned while writing this is that eMudhra's slogan is "Trust Delivered". This is sorta like when my partner and I tried to get a coffee table delivered, and instead received a cardboard box full of wooden shards, because apparently someone though "air freight" meant "wait till the plane is roughly over my house and push the box out the back". Something was delivered, but it wasn't a coffee table by the time I got it. Easy Reader Version: It was a nice coffee table too. Cool little mid-century modern style thing, but high quality. <div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.<a href="https://inedo.com/proget?utm_source=tdwtf&utm_medium=footer&utm_content=PlebsFooter">Learn more.</a></div><div style="clear: left;"></div></div> News Roundup https://thedailywtf.com/articles/security-fourth Tue, 27 Oct 2026 06:30:00 GMT <div>A bit ago, I broke with my usual pattern and <a href="https://thedailywtf.com/articles/the-frist-line-of-defense">wrote up some security issues</a> that I felt were particularly funny. It was a change of pace, a different thing, but not a thing that'd become a habit. After all, I'm not a security expert, this isn't a security site, and seriously, what are the odds that suitably funny security issues would crop up again less than a week later?Well.Let's start with the actual serious issue, <a href="https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities">PHP2Shell</a>. In terms of scope, every version of PHP for the past twenty years has had this bug. The general issue that permits the exploit was <a href="https://calif.io/php2shell/#an-interesting-timeline-of-events">known about</a>, but wasn't considered exploitable.Oops.The broad strokes of the bug is that it's two separate bugs. The first allows someone to bypass the checks on a request's size, thus giving them a direct route to triggering an out-of-memory error. The second is that, depending where you are in the processing pipeline, PHP doesn't properly handle cleanup, allowing for use-after-free that can trigger code execution. It doesn't matter what code you've written, this all happens before the request even hits your code.Bigger oops.This bug was found via LLM tools, which has lead to a lot of hype around the idea that we've <a href="https://www.wiz.io/blog/php2shell-php-rce#the-ai-inflection-point-26">entered some new era</a>. I'll certainly grant that the ability to throw compute at hacking challenges instead of human effort is going to shift the landscape, but I'm not quite willing to buy the apocalyptic prophecies. Especially when some of those prophets are telling us that their AIs will avoid deletion by <a href="https://www.cnbc.com/2026/10/13/anthropic-ai-models-self-replication-smart-devices.html">copying themselves onto your thermostat</a>. I think it's safe to say we're going to see a lot of security incidents coming out of LLMs in the near future, not because they're magic genius hackers, but because they're pretty good at processing structured text and running tests.For those of us living in the real world, the concern isn't AIs, but HIs: human intelligences. In this case, the exploit was discovered back in August. Security researchers and the PHP Foundation put their heads down to work on it, and where necessary, notified so-called "critical infrastructure providers" to ensure that everyone was ready to address the issue. The problem there is that two people can keep a secret if one of them is dead, and a lot more than two people got roped in to deal with this.Rumors were circulating in security circles. And cybersecurity firm <a href="https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues">Chainguard</a> decided this was good enough excuse to break the embargo and announce the flaw before patches were available. No patches for a flaw that impacts 20 years worth of software versions of widely deployed software.Patches are out now, though only for versions 8.2 and up. Source patches are out back to 7.4, which is officially end-of-life, but I have to wonder how many official EOLed copies of PHP are out there.On a lighter note, we can't let the hijinks of eMudhra pass without comment. eMudhra is, among other things, a root certificate authority. They've got a bunch of key pairs that they use to sign certificates for other customers, thus vouching for those customers' identity. As a root CA, they were trusted by pretty much every TLS/SSL implementation on Earth; if you had a certificate from eMudhra, every browser would trust that you were who you said you were.The only problem? One of their private keys was 4. Yes, it's the <a href="https://xkcd.com/221/">XKCD</a>.Now, in their defense(?), eMudhra didn't generate impossibly insecure keys. They performed a key signing ceremony and generated appropriately strong keys. Then they used an in-house tool to pack/unpack the keys, and this tool decided to truncate some of them down to one byte. Shockingly, even though ECC has relatively short key sizes, 8-bit ECC isn't secure! You could derive the private key from the public key using only pencil and paper. But the worst part is that they did check the validity of the keys- before they got truncated, giving them a false sense of security.The good news, for eMudhra, is that this particular key signing ceremony generated <a href="https://ministryofcyberaffairs.com/news/emudhra-ca-key-compromise-explained-what-happened-and-what-to-do-0a37748d-4de2-4578-b3bd-488487663407">a total of 24 keys</a>, and only 8 of them were truncated to the point of uselessness. I have it on good authority that <a href="https://www.youtube.com/watch?v=k5hWWe-ts2s&list=RDk5hWWe-ts2s&start_radio=1&pp=ygUdbWVhdGxvYWYgMiBvdXQgb2YgMyBhaW4ndCBiYWSgBwE%3D">two out of three ain't bad</a>.Now, after that disgrace, it's no surprise that eMudhra is <a href="https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/">dropping out of the certificate authority business</a>. Still, the press release where their chairman explains the rationale is some serious <a href="https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business">"screw you guys, I'm going home,"</a> energy.<blockquote>He added that global SSL/TLS is a small part of eMudhra’s business contributing to about 1% of the global revenue. Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base. However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business. In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders. For many certifying authorities, SSL/TLS is the whole business. For eMudhra it is one part of a much broader digital solutions portfolio. We will put our energy where we create the most value for customers with Sharpened Focus on Core Enterprise Solutions and trust services other than SSL/TLS.</blockquote>eMudhra's chairman added "There were no end entity certificates issued out of the affected CA’s. Its infrastructure was not compromised and no data was breached. All physical and logical security controls remained intact." That's thin sauce, of course, because while eMudra may not have issued any certs under the broken keys, anyone else could have. It's not that everyone is overreacting to a non-event, and more that it's a non-event only through sheer luck.Also, removing a root CA from your trust store isn't a trivial task, and at the time of this writing, there's still loads of cleanup that needs to happen as a result of this.Something I learned while writing this is that eMudhra's slogan is "Trust Delivered". This is sorta like when my partner and I tried to get a coffee table delivered, and instead received a cardboard box full of wooden shards, because apparently someone though "air freight" meant "wait till the plane is roughly over my house and push the box out the back". Something was delivered, but it wasn't a coffee table by the time I got it. Easy Reader Version: It was a nice coffee table too. Cool little mid-century modern style thing, but high quality. <div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.<a href="https://inedo.com/proget?utm_source=tdwtf&utm_medium=footer&utm_content=PlebsFooter">Learn more.</a></div><div style="clear: left;"></div></div> Securely Useless https://thedailywtf.com/articles/securely-useless <div>Submitter Chops relates a tale of chasing "The Standard" at any cost:<blockquote>A company had been forced, kicking and screaming, into the 20th century, and then into the 21st. Their range of dumb hardware was no longer being bought by customers who expected at least some way to get the data off it, and a USB stick wouldn't cut it.<a href="https://commons.wikimedia.org/wiki/File:Networks.svg" title="Nicu B. 2004-2016, CC0, via Wikimedia Commons"><img alt="Computer network" itemprop="image" src="https://thumb.wikimedia.org/wikipedia/commons/thumb/5/52/Networks.svg/250px-Networks.svg.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail" width="300" /></a>The techno-fearful hired an external IT company and instructed them to ensure that the company adhered to the UK's "CyberEssentials" programme of IT security.Unfortunately, this meant that the nascent software development capability was immediately hamstrung, as people were denied the right to install and run unapproved software (including software that needed admin level rights in order to work, such as process monitor tools used as standard in software dev and test), could not easily connect across networks (also vital for the software dev), could not add various hardware to the network (such as the company's own products, which made testing them awfully difficult) and so on.A criminal underworld of mystery PCs slowly grew into place, plugging into the network to get things done, disavowed by anyone who saw them. Tunnels grew up, IP addresses were handed round on notepaper (no DNS approvals), a shadow world of software development in the back alleys of the network. Until finally it was too much, and approval was given for a second, less secure network. The plan was that the real core business, the really important parts, they would stay on the high-security side. There would be a second network, with a single bridge, which would serve the various software development and test systems, and also host the myriad new internal services growing up (wikis, servers, tools and so on). This way, the real core business would definitely remain secure, and compliant, and the software side of it and all that would not compromise the heart of the business.The heart of the business ended up being a network share containing a decade of out-of-date, unsearchable documentation for products that were mostly no longer sold. It is super-secure, and the business heads confirm whole-heartedly that the company adheres to the CyberEssentials programme 100% with zero compromise.There's just a carefully separated set of servers and PCs, not the true core of the business but about eight times the size and full of essential activity, on a secondary network.</blockquote><div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">BuildMaster</a> allows you to create a self-service release management platform that allows different teams to manage their applications. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">Explore how!</a></div><div style="clear: left;"></div></div> Feature Articles https://thedailywtf.com/articles/securely-useless Mon, 26 Oct 2026 06:30:00 GMT <div>Submitter Chops relates a tale of chasing "The Standard" at any cost:<blockquote>A company had been forced, kicking and screaming, into the 20th century, and then into the 21st. Their range of dumb hardware was no longer being bought by customers who expected at least some way to get the data off it, and a USB stick wouldn't cut it.<a href="https://commons.wikimedia.org/wiki/File:Networks.svg" title="Nicu B. 2004-2016, CC0, via Wikimedia Commons"><img alt="Computer network" itemprop="image" src="https://thumb.wikimedia.org/wikipedia/commons/thumb/5/52/Networks.svg/250px-Networks.svg.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail" width="300" /></a>The techno-fearful hired an external IT company and instructed them to ensure that the company adhered to the UK's "CyberEssentials" programme of IT security.Unfortunately, this meant that the nascent software development capability was immediately hamstrung, as people were denied the right to install and run unapproved software (including software that needed admin level rights in order to work, such as process monitor tools used as standard in software dev and test), could not easily connect across networks (also vital for the software dev), could not add various hardware to the network (such as the company's own products, which made testing them awfully difficult) and so on.A criminal underworld of mystery PCs slowly grew into place, plugging into the network to get things done, disavowed by anyone who saw them. Tunnels grew up, IP addresses were handed round on notepaper (no DNS approvals), a shadow world of software development in the back alleys of the network. Until finally it was too much, and approval was given for a second, less secure network. The plan was that the real core business, the really important parts, they would stay on the high-security side. There would be a second network, with a single bridge, which would serve the various software development and test systems, and also host the myriad new internal services growing up (wikis, servers, tools and so on). This way, the real core business would definitely remain secure, and compliant, and the software side of it and all that would not compromise the heart of the business.The heart of the business ended up being a network share containing a decade of out-of-date, unsearchable documentation for products that were mostly no longer sold. It is super-secure, and the business heads confirm whole-heartedly that the company adheres to the CyberEssentials programme 100% with zero compromise.There's just a carefully separated set of servers and PCs, not the true core of the business but about eight times the size and full of essential activity, on a secondary network.</blockquote><div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">BuildMaster</a> allows you to create a self-service release management platform that allows different teams to manage their applications. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">Explore how!</a></div><div style="clear: left;"></div></div> Representative Line: Readable Formats https://thedailywtf.com/articles/readable-formats <div>We all love format strings for generating human readable text. Certainly, they're a better choice than string concatenation. Even if I have a blind spot that keeps me from remembering the <code>printf</code> format tokens, I still prefer to use format strings.Jasmine has a co-worker that does use format strings, but they also miss using string concatenation. So they've found a way to combine them, and avoid the perils of making readable code that describes the format of their text.<pre><code class="language-csharp">myField.DataFormatString = "{0:#,##0." + new string('0', 2) + ";(#,##0." + new string('0', 2) + ")}"; </code></pre>Now, in their defense, I can see how this code started its life. At some point, they wanted to make the number of decimal places a parameter. And sure, this is an easy way to do that and retain the intent, though this whole thing could be cleaned up with just a simple <code>decimalPlaces = new string('0', 2)</code>, which would make the concatenation less confusing to read.Related, while I was checking the documentation on the .NET formatting strings, I learned that they have a per-mille format specifier <a href="https://learn.microsoft.com/en-us/dotnet/standard/base-types/custom-numeric-format-strings#the--custom-specifier-4">which requires writing a unicode sigil</a> on most keyboards.I'm sorry, but seeing <code>string perMilleFmt = "#0.## " + '\u2030';</code> in my code would be TRWTF. Easy Reader Version: Todo: write a version of ALGOL that uses just the unicode escape characters. Y'know, for readability. <div> [Advertisement] Picking up NuGet is easy. Getting good at it takes time. <a href="https://inedo.com/support/whitepapers/nuget-guide?utm_source=tdwtf&utm_medium=Footerad&utm_campaign=nuget">Download our guide to learn the best practice of NuGet for the Enterprise.</a></div><div style="clear: left;"></div></div> Representative Line https://thedailywtf.com/articles/readable-formats Thu, 22 Oct 2026 06:30:00 GMT <div>We all love format strings for generating human readable text. Certainly, they're a better choice than string concatenation. Even if I have a blind spot that keeps me from remembering the <code>printf</code> format tokens, I still prefer to use format strings.Jasmine has a co-worker that does use format strings, but they also miss using string concatenation. So they've found a way to combine them, and avoid the perils of making readable code that describes the format of their text.<pre><code class="language-csharp">myField.DataFormatString = "{0:#,##0." + new string('0', 2) + ";(#,##0." + new string('0', 2) + ")}"; </code></pre>Now, in their defense, I can see how this code started its life. At some point, they wanted to make the number of decimal places a parameter. And sure, this is an easy way to do that and retain the intent, though this whole thing could be cleaned up with just a simple <code>decimalPlaces = new string('0', 2)</code>, which would make the concatenation less confusing to read.Related, while I was checking the documentation on the .NET formatting strings, I learned that they have a per-mille format specifier <a href="https://learn.microsoft.com/en-us/dotnet/standard/base-types/custom-numeric-format-strings#the--custom-specifier-4">which requires writing a unicode sigil</a> on most keyboards.I'm sorry, but seeing <code>string perMilleFmt = "#0.## " + '\u2030';</code> in my code would be TRWTF. Easy Reader Version: Todo: write a version of ALGOL that uses just the unicode escape characters. Y'know, for readability. <div> [Advertisement] Picking up NuGet is easy. Getting good at it takes time. <a href="https://inedo.com/support/whitepapers/nuget-guide?utm_source=tdwtf&utm_medium=Footerad&utm_campaign=nuget">Download our guide to learn the best practice of NuGet for the Enterprise.</a></div><div style="clear: left;"></div></div> CodeSOD: Doing the Assignment https://thedailywtf.com/articles/doing-the-assignment <div>Today's code maybe isn't much of a WTF, but it does point in the general direction of, "Damn, you live like this?" Poor Nancy unfortunately does.<pre><code class="language-java">int x = 3; int y = 4; int z = 4; x = y = z; </code></pre>Each variable is declared and initialized, and then they're set equal to each other. It just raises the question though, why do it this way? Why not declare them and then <code>x = y = z = 4</code>, if we want that? Or maybe, for more clarity, <code>int x = DEFAULT_VALUE;</code> would be more legible, and we can skip the multiple assignments on one line. Why does <code>x</code> get set to 3 but then overwritten? Easy Reader Version: I'm never fond of x = y = z. It points at being *clever*, and as oft stated, I *hate clever*. <div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. <a href="https://inedo.com/proget/private-nuget-server?utm_source=tdwtf&utm_medium=footer&utm_content=GotYouCoveredFooter&utm_campaign=Cyclops2020">Learn more.</a></div><div style="clear: left;"></div></div> CodeSOD https://thedailywtf.com/articles/doing-the-assignment Wed, 21 Oct 2026 06:30:00 GMT <div>Today's code maybe isn't much of a WTF, but it does point in the general direction of, "Damn, you live like this?" Poor Nancy unfortunately does.<pre><code class="language-java">int x = 3; int y = 4; int z = 4; x = y = z; </code></pre>Each variable is declared and initialized, and then they're set equal to each other. It just raises the question though, why do it this way? Why not declare them and then <code>x = y = z = 4</code>, if we want that? Or maybe, for more clarity, <code>int x = DEFAULT_VALUE;</code> would be more legible, and we can skip the multiple assignments on one line. Why does <code>x</code> get set to 3 but then overwritten? Easy Reader Version: I'm never fond of x = y = z. It points at being *clever*, and as oft stated, I *hate clever*. <div><img src="https://thedailywtf.com/images/inedo/proget-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. <a href="https://inedo.com/proget/private-nuget-server?utm_source=tdwtf&utm_medium=footer&utm_content=GotYouCoveredFooter&utm_campaign=Cyclops2020">Learn more.</a></div><div style="clear: left;"></div></div> The Outage https://thedailywtf.com/articles/the-outage <div>At my employer, we use a service called Coveralls, which is a code coverage reporting tool that hooks into your CI pipeline. It takes your <code>lcov</code> reports and gives you some insights, and also makes it easy to cause the CI pipeline to fail if newly added code doesn't have reasonable coverage.I have no strong feelings about the tool, but on February 24th, our CI jobs started failing, and our CI step that talked to Coveralls was the culprit. Coveralls had gone down. That happened to us, and a lot of other people. It was a widespread outage impacting anybody who used their service.Coveralls actively published updates as the outage dragged on, and boy, did it drag on. Between them posting nearly identical updates minutes or even seconds apart and the general desperation that snuck into their outage notes after the first few days, I couldn't help but find their notes hilarious.They've <a href="https://status.coveralls.io/incidents/pdbt7vdzlvpj">published their post-mortem</a>, and the short version is that despite them paying their bills, Amazon decided they hadn't, and shut down their services. But it took them roughly 68 hours to figure that out.If you scroll down past the post-mortem, you can see their outage notes. This is an unauthorized, dramatic reading of those notes. We've taken some liberties in interpreting it.<iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen="" frameborder="0" height="480" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube.com/embed/YgVKi4B6nrs" title="" width="720"></iframe>I hope this is taken in a good spirit, because they were just doing their best when this happened. I don't think most companies would be able to maintain operations when their cloud provider decides to lock their accounts. But I don't care who you are: begging your users to email you if they can help you migrate off AWS is funny. Easy Reader Version: Yes, I am in fact the kind of person who thinks an eight minute video where all the dialogue comes from outage notes is funny. <div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Confidence&utm_campaign=Buildmaster_Footer">Utilize BuildMaster</a> to release your software with confidence, at the pace your business demands. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Confidence&utm_campaign=Buildmaster_Footer">Download</a> today! </div><div style="clear: left;"></div></div> Feature Articles https://thedailywtf.com/articles/the-outage Tue, 20 Oct 2026 06:30:00 GMT <div>At my employer, we use a service called Coveralls, which is a code coverage reporting tool that hooks into your CI pipeline. It takes your <code>lcov</code> reports and gives you some insights, and also makes it easy to cause the CI pipeline to fail if newly added code doesn't have reasonable coverage.I have no strong feelings about the tool, but on February 24th, our CI jobs started failing, and our CI step that talked to Coveralls was the culprit. Coveralls had gone down. That happened to us, and a lot of other people. It was a widespread outage impacting anybody who used their service.Coveralls actively published updates as the outage dragged on, and boy, did it drag on. Between them posting nearly identical updates minutes or even seconds apart and the general desperation that snuck into their outage notes after the first few days, I couldn't help but find their notes hilarious.They've <a href="https://status.coveralls.io/incidents/pdbt7vdzlvpj">published their post-mortem</a>, and the short version is that despite them paying their bills, Amazon decided they hadn't, and shut down their services. But it took them roughly 68 hours to figure that out.If you scroll down past the post-mortem, you can see their outage notes. This is an unauthorized, dramatic reading of those notes. We've taken some liberties in interpreting it.<iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen="" frameborder="0" height="480" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube.com/embed/YgVKi4B6nrs" title="" width="720"></iframe>I hope this is taken in a good spirit, because they were just doing their best when this happened. I don't think most companies would be able to maintain operations when their cloud provider decides to lock their accounts. But I don't care who you are: begging your users to email you if they can help you migrate off AWS is funny. Easy Reader Version: Yes, I am in fact the kind of person who thinks an eight minute video where all the dialogue comes from outage notes is funny. <div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Confidence&utm_campaign=Buildmaster_Footer">Utilize BuildMaster</a> to release your software with confidence, at the pace your business demands. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Confidence&utm_campaign=Buildmaster_Footer">Download</a> today! </div><div style="clear: left;"></div></div> A Vat of Terrible Experiences https://thedailywtf.com/articles/a-vat-of-terrible-experiences <div>Taxes are a royal pain for everyone. Amazon has found a unique way to make them even worse, as Kris W. attests:<blockquote>I recently bought a €9.61 kitchen knife on Amazon Spain. My card was charged €7.94 instead. After some investigation, I discovered that Amazon had applied an old VAT registration number I'd added to my personal account years ago, and had classified my purchase as a VAT-exempt intra-EU business transaction. The invoice even contained my business address from 2022, which no longer appeared anywhere in my account settings. I just wanted to remove the VAT number so I could go back to buying kitchen utensils without accidentally generating international tax paperwork.<a href="https://commons.wikimedia.org/wiki/File:European_VAT_Taxes.svg" title="Wikideas1, CC0, via Wikimedia Commons"><img alt="European VAT Taxes" itemprop="image" src="https://thumb.wikimedia.org/wikipedia/commons/thumb/7/78/European_VAT_Taxes.svg/250px-European_VAT_Taxes.svg.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail" width="300" /></a>Unfortunately, Amazon no longer provided any visible way to manage that VAT number. Their customer support chatbot insisted I provide the order number from which I wanted the VAT number removed. A human agent confidently explained that I must have entered it into a secondary address field, and instructed me to delete and recreate my shipping address. Another support representative sent me an extensive list of documents I'd need to provide, including my passport, airline boarding passes, proof of export outside the EU, or my NATO identification card. Apparently removing a VAT number from an Amazon account is a process normally reserved for international travelers, Andorran residents, and military alliances.Eventually, I found Amazon's official help page. It explicitly stated that VAT numbers could be removed either by contacting Customer Service or by creating an Amazon Business account to use the self-service option. After another round of correspondence, Customer Service informed me that they were not allowed to remove VAT numbers and instructed me to use the Business settings that my personal account didn't have. So I followed the documentation and created a Business account using my existing email address. During registration, Amazon required me to enter the very VAT number I was trying to remove, then promptly congratulated me by email on successfully adding and activating it.But I couldn't access the Business settings yet. Amazon couldn't verify my business and demanded official documentation, so I obtained two freshly-issued certificates from two separate Spanish government agencies to prove that I was, in fact, a self-employed software developer. I uploaded both documents and waited. Eventually, my shiny new Amazon Business account was approved. I now had a separate Business account, complete with its own purchasing features and complimentary Business Prime membership. At last, I could navigate to the promised VAT-management page!The page displayed my VAT number, confirmed it was valid, and offered a button to add more tax information. Beside the existing number, however, there was no Edit button. No Delete button. No self-service removal option whatsoever. There was only a link saying, Contact Customer Service to change your tax ID.Naturally, the link led to a generic help center. After creating an entire business account, submitting government paperwork, and successfully registering the same VAT number a second time, I had arrived precisely where I started: Customer Service, which had already explained that it was not allowed to remove VAT numbers.</blockquote><div> [Advertisement] Picking up NuGet is easy. Getting good at it takes time. <a href="https://inedo.com/support/whitepapers/nuget-guide?utm_source=tdwtf&utm_medium=Footerad&utm_campaign=nuget">Download our guide to learn the best practice of NuGet for the Enterprise.</a></div><div style="clear: left;"></div></div> Feature Articles https://thedailywtf.com/articles/a-vat-of-terrible-experiences Mon, 19 Oct 2026 06:30:00 GMT <div>Taxes are a royal pain for everyone. Amazon has found a unique way to make them even worse, as Kris W. attests:<blockquote>I recently bought a €9.61 kitchen knife on Amazon Spain. My card was charged €7.94 instead. After some investigation, I discovered that Amazon had applied an old VAT registration number I'd added to my personal account years ago, and had classified my purchase as a VAT-exempt intra-EU business transaction. The invoice even contained my business address from 2022, which no longer appeared anywhere in my account settings. I just wanted to remove the VAT number so I could go back to buying kitchen utensils without accidentally generating international tax paperwork.<a href="https://commons.wikimedia.org/wiki/File:European_VAT_Taxes.svg" title="Wikideas1, CC0, via Wikimedia Commons"><img alt="European VAT Taxes" itemprop="image" src="https://thumb.wikimedia.org/wikipedia/commons/thumb/7/78/European_VAT_Taxes.svg/250px-European_VAT_Taxes.svg.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail" width="300" /></a>Unfortunately, Amazon no longer provided any visible way to manage that VAT number. Their customer support chatbot insisted I provide the order number from which I wanted the VAT number removed. A human agent confidently explained that I must have entered it into a secondary address field, and instructed me to delete and recreate my shipping address. Another support representative sent me an extensive list of documents I'd need to provide, including my passport, airline boarding passes, proof of export outside the EU, or my NATO identification card. Apparently removing a VAT number from an Amazon account is a process normally reserved for international travelers, Andorran residents, and military alliances.Eventually, I found Amazon's official help page. It explicitly stated that VAT numbers could be removed either by contacting Customer Service or by creating an Amazon Business account to use the self-service option. After another round of correspondence, Customer Service informed me that they were not allowed to remove VAT numbers and instructed me to use the Business settings that my personal account didn't have. So I followed the documentation and created a Business account using my existing email address. During registration, Amazon required me to enter the very VAT number I was trying to remove, then promptly congratulated me by email on successfully adding and activating it.But I couldn't access the Business settings yet. Amazon couldn't verify my business and demanded official documentation, so I obtained two freshly-issued certificates from two separate Spanish government agencies to prove that I was, in fact, a self-employed software developer. I uploaded both documents and waited. Eventually, my shiny new Amazon Business account was approved. I now had a separate Business account, complete with its own purchasing features and complimentary Business Prime membership. At last, I could navigate to the promised VAT-management page!The page displayed my VAT number, confirmed it was valid, and offered a button to add more tax information. Beside the existing number, however, there was no Edit button. No Delete button. No self-service removal option whatsoever. There was only a link saying, Contact Customer Service to change your tax ID.Naturally, the link led to a generic help center. After creating an entire business account, submitting government paperwork, and successfully registering the same VAT number a second time, I had arrived precisely where I started: Customer Service, which had already explained that it was not allowed to remove VAT numbers.</blockquote><div> [Advertisement] Picking up NuGet is easy. Getting good at it takes time. <a href="https://inedo.com/support/whitepapers/nuget-guide?utm_source=tdwtf&utm_medium=Footerad&utm_campaign=nuget">Download our guide to learn the best practice of NuGet for the Enterprise.</a></div><div style="clear: left;"></div></div> The Frist Line of Defense https://thedailywtf.com/articles/the-frist-line-of-defense <div>We don't cover a lot of security issues here, simply because they're not usually funny. But sometimes, they are. So here's a quick hit about some recent ones.We start with a very bad month for the Danish social security system, the Central Register of Persons (CPR). Last week, they detected a breach <a href="https://www.theregister.com/security/2026/10/06/denmarks-id-register-spills-more-peoples-details-than-the-country-has-residents/5301307">which exposed the personal details of 8.8m people</a>. Per the Register article, a cybersecurity specialist correctly pointed out that treating your ID number as if it were a secret was a terrible idea in the first place, but unfortunately, so many systems have grown up around the idea that full knowledge of your state issued ID number as proof of identity, that the security expert is screaming into the wind. They're right, but it's going to take a lot to change.Okay, Denmark's social security service was hacked. What's so funny about that?Well, the mechanism of the hack appears to go thusly. First, third party companies have access to the database, which they can use to send notifications to their customers via CPR. That connection is secured with a password, and one of those third parties secured their account with the kind of password you'd use to protect the precious air of the planet Druidia. Also known as the kind of <a href="https://www.youtube.com/watch?v=a6iW-8xPw3k&pp=ygUocGFzc3dvcmQgc29tZSBpZGlvdCBoYXMgb24gdGhlaXIgbHVnZ2FnZQ%3D%3D">password some idiot would put on their luggage</a>: "123456". (<a href="https://politiken.dk/danmark/art11016363/%C2%BBOh-my-god%C2%AB-Fynsk-virksomhed-havde-mindst-tre-profiler-med-adgangskoden-123456">paywalled, Danish article</a>).The hacker accessed the system on September 10th, and spent ten days searching through the system. The intrusion wasn't detected until October 2nd, when CPR went to send an invoice to the third party company and noticed, "Boy, that's more searches than they have customers." Now, obviously, CPR should have never even allowed such a low complexity password, but also, the third party company shouldn't have used such a low security password.Now, if you'll excuse me, I have to change the combination on my luggage. I jest, in America, you aren't legally allowed to put a secure lock on your luggage, every lock you travel with has to be openable by the TSA, which is one of the reasons why I never check a bag if I can help it. In other news, I'm not particularly fond of blockchain stuff. Mostly, the whole distributed ledger seems like a solution in search of problems, and "trading tokens as if they're money" is the best thing anybody's been able to come up with. Back in my consulting days, when blockchains were all over the news, I was consulting with a large retailer, and they were exploring using blockchain in their supply chain. "How does that work?" I asked innocently. "It'll have blockchain in it." "Sure, but what does the blockchain get you?" "We'll be using blockchain. If there's like, an e. coli outbreak, we can trace where it came from." "Couldn't you get that out of a regular database?" "But this'll have blockchain."In any case, blockchain companies getting hacked and having all their users' assets stolen is practically a daily occurrence. Not really notable. But a recent hack <a href="https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/">is legitimately interesting</a>.A company, called Ledger, sells "hardware wallets". Instead of storing your keys on some third party's servers (where it'll get hacked and you'll lose all your "money"), you store them on a hardware device that you put in a safe. It's not connected to the internet, and thus is unhackable. Or so you'd think. But if enough people are buying those devices, a supply chain attack becomes potentially very lucrative. And that's exactly what happened. Someone in the <a href="https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis">supply chain</a> cracked a bunch of these devices open, and inserted new hardware. They attached a microcontroller to the screen leads, that allowed it to read what was on the screen (and thus detect when the screen was displaying a recovery code that could be used to access the wallet), and a cellular modem that allowed it to literally phone home with that information.In total, these hackers walked away with the equivalent of nearly $100M in cryptocurrency.All the devices passed through Ledger, where they were inspected before being sold. Presumably, they were sealed with tamper-resistant packaging. It's plausible that the tamperer was downstream from here and the customers didn't fully inspect the packaging. Even your most savvy user generally doesn't check that kind of thing, and I suspect a lot of these customers aren't actually all that savvy. But also, companies in the crypto space tend to be... we'll say, more eager than cautious, so I wouldn't be surprised if the tampering happened upstream and didn't get caught by their inspection process.Security is hard in the best case. It's much harder when you're putting the final onus of security on end users who may have thousands or even millions of dollars locked behind a single key. Or when passwords are hard, so you pick an easy one to remember. Easy Reader Version: in an objective sense, Spaceballs is one of Mel Brooks' lesser contributions to the parody genre. On the other hand, if you're seven years old when you watch it, and are a child obsessed with Star Wars, it'll leave a mark in your brain that you can't escape. <div> [Advertisement] Plan Your .NET 9 Migration with Confidence Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. <a href="https://inedo.com/support/whitepapers/dotnet-guide?utm_campaign=dotnet&utm_source=tdwtf-footer">Download Free Guide Now!</a></div><div style="clear: left;"></div></div> Feature Articles https://thedailywtf.com/articles/the-frist-line-of-defense Thu, 15 Oct 2026 06:30:00 GMT <div>We don't cover a lot of security issues here, simply because they're not usually funny. But sometimes, they are. So here's a quick hit about some recent ones.We start with a very bad month for the Danish social security system, the Central Register of Persons (CPR). Last week, they detected a breach <a href="https://www.theregister.com/security/2026/10/06/denmarks-id-register-spills-more-peoples-details-than-the-country-has-residents/5301307">which exposed the personal details of 8.8m people</a>. Per the Register article, a cybersecurity specialist correctly pointed out that treating your ID number as if it were a secret was a terrible idea in the first place, but unfortunately, so many systems have grown up around the idea that full knowledge of your state issued ID number as proof of identity, that the security expert is screaming into the wind. They're right, but it's going to take a lot to change.Okay, Denmark's social security service was hacked. What's so funny about that?Well, the mechanism of the hack appears to go thusly. First, third party companies have access to the database, which they can use to send notifications to their customers via CPR. That connection is secured with a password, and one of those third parties secured their account with the kind of password you'd use to protect the precious air of the planet Druidia. Also known as the kind of <a href="https://www.youtube.com/watch?v=a6iW-8xPw3k&pp=ygUocGFzc3dvcmQgc29tZSBpZGlvdCBoYXMgb24gdGhlaXIgbHVnZ2FnZQ%3D%3D">password some idiot would put on their luggage</a>: "123456". (<a href="https://politiken.dk/danmark/art11016363/%C2%BBOh-my-god%C2%AB-Fynsk-virksomhed-havde-mindst-tre-profiler-med-adgangskoden-123456">paywalled, Danish article</a>).The hacker accessed the system on September 10th, and spent ten days searching through the system. The intrusion wasn't detected until October 2nd, when CPR went to send an invoice to the third party company and noticed, "Boy, that's more searches than they have customers." Now, obviously, CPR should have never even allowed such a low complexity password, but also, the third party company shouldn't have used such a low security password.Now, if you'll excuse me, I have to change the combination on my luggage. I jest, in America, you aren't legally allowed to put a secure lock on your luggage, every lock you travel with has to be openable by the TSA, which is one of the reasons why I never check a bag if I can help it. In other news, I'm not particularly fond of blockchain stuff. Mostly, the whole distributed ledger seems like a solution in search of problems, and "trading tokens as if they're money" is the best thing anybody's been able to come up with. Back in my consulting days, when blockchains were all over the news, I was consulting with a large retailer, and they were exploring using blockchain in their supply chain. "How does that work?" I asked innocently. "It'll have blockchain in it." "Sure, but what does the blockchain get you?" "We'll be using blockchain. If there's like, an e. coli outbreak, we can trace where it came from." "Couldn't you get that out of a regular database?" "But this'll have blockchain."In any case, blockchain companies getting hacked and having all their users' assets stolen is practically a daily occurrence. Not really notable. But a recent hack <a href="https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/">is legitimately interesting</a>.A company, called Ledger, sells "hardware wallets". Instead of storing your keys on some third party's servers (where it'll get hacked and you'll lose all your "money"), you store them on a hardware device that you put in a safe. It's not connected to the internet, and thus is unhackable. Or so you'd think. But if enough people are buying those devices, a supply chain attack becomes potentially very lucrative. And that's exactly what happened. Someone in the <a href="https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis">supply chain</a> cracked a bunch of these devices open, and inserted new hardware. They attached a microcontroller to the screen leads, that allowed it to read what was on the screen (and thus detect when the screen was displaying a recovery code that could be used to access the wallet), and a cellular modem that allowed it to literally phone home with that information.In total, these hackers walked away with the equivalent of nearly $100M in cryptocurrency.All the devices passed through Ledger, where they were inspected before being sold. Presumably, they were sealed with tamper-resistant packaging. It's plausible that the tamperer was downstream from here and the customers didn't fully inspect the packaging. Even your most savvy user generally doesn't check that kind of thing, and I suspect a lot of these customers aren't actually all that savvy. But also, companies in the crypto space tend to be... we'll say, more eager than cautious, so I wouldn't be surprised if the tampering happened upstream and didn't get caught by their inspection process.Security is hard in the best case. It's much harder when you're putting the final onus of security on end users who may have thousands or even millions of dollars locked behind a single key. Or when passwords are hard, so you pick an easy one to remember. Easy Reader Version: in an objective sense, Spaceballs is one of Mel Brooks' lesser contributions to the parody genre. On the other hand, if you're seven years old when you watch it, and are a child obsessed with Star Wars, it'll leave a mark in your brain that you can't escape. <div> [Advertisement] Plan Your .NET 9 Migration with Confidence Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. <a href="https://inedo.com/support/whitepapers/dotnet-guide?utm_campaign=dotnet&utm_source=tdwtf-footer">Download Free Guide Now!</a></div><div style="clear: left;"></div></div> Representative Line: A Diamond in the Rough https://thedailywtf.com/articles/a-diamond-in-the-rough <div>Mandy's co-worker recently learned about virtual inheritance in C++. It's become their new favorite button to push, and they only use virtual inheritance.Virtual inheritance is one workaround for the "<a href="https://en.wikipedia.org/wiki/Multiple_inheritance#The_diamond_problem">diamond problem</a>", where you have an inheritance tree that "recombines" via multiple inheritance: when a child class has a Hapsburg-esque parentage, it's hard to decide which inherited methods are being invoked or overridden.In C++, imagine you have class A, which gets derived into classes B and C. Class D then uses multiple inheritance to inherit from B and C. In practice, this means that D inherits from A twice, and would have two internal copies of all of A's members.If, on the other hand, you have B and C inherit virtually (<code>class B : public virtual A</code>), then class D will only actually inherit a single copy of A.If you're reading this and going, "Boy, this just sounds like another reason to avoid multiple inheritance," you're probably right. The important thing, though, is inheriting virtually impacts how your child classes will inherit. It only matters if you have child classes.Which brings us back to Mandy's co-worker. He read somewhere that defaulting to virtual inheritance all the time was safer, so he did that all the time. All. The. Time.Including in this case:<pre><code class="language-cpp">class SomeSpecificDerivedClass final : public virtual SomeBaseClass </code></pre>The class here is marked <code>final</code>. It can't be inherited from. The use of <code>virtual</code> accomplishes nothing. Easy Reader Version: Now that C++ has concepts, that's a much easier way to get type safety without loads of weird inheritance trees. <div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">BuildMaster</a> allows you to create a self-service release management platform that allows different teams to manage their applications. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">Explore how!</a></div><div style="clear: left;"></div></div> Representative Line https://thedailywtf.com/articles/a-diamond-in-the-rough Wed, 14 Oct 2026 06:30:00 GMT <div>Mandy's co-worker recently learned about virtual inheritance in C++. It's become their new favorite button to push, and they only use virtual inheritance.Virtual inheritance is one workaround for the "<a href="https://en.wikipedia.org/wiki/Multiple_inheritance#The_diamond_problem">diamond problem</a>", where you have an inheritance tree that "recombines" via multiple inheritance: when a child class has a Hapsburg-esque parentage, it's hard to decide which inherited methods are being invoked or overridden.In C++, imagine you have class A, which gets derived into classes B and C. Class D then uses multiple inheritance to inherit from B and C. In practice, this means that D inherits from A twice, and would have two internal copies of all of A's members.If, on the other hand, you have B and C inherit virtually (<code>class B : public virtual A</code>), then class D will only actually inherit a single copy of A.If you're reading this and going, "Boy, this just sounds like another reason to avoid multiple inheritance," you're probably right. The important thing, though, is inheriting virtually impacts how your child classes will inherit. It only matters if you have child classes.Which brings us back to Mandy's co-worker. He read somewhere that defaulting to virtual inheritance all the time was safer, so he did that all the time. All. The. Time.Including in this case:<pre><code class="language-cpp">class SomeSpecificDerivedClass final : public virtual SomeBaseClass </code></pre>The class here is marked <code>final</code>. It can't be inherited from. The use of <code>virtual</code> accomplishes nothing. Easy Reader Version: Now that C++ has concepts, that's a much easier way to get type safety without loads of weird inheritance trees. <div><img src="https://thedailywtf.com/images/inedo/buildmaster-icon.png" style="display:block; float: left; margin: 0 10px 10px 0;" /> [Advertisement] <a href="https://inedo.com/BuildMaster?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">BuildMaster</a> allows you to create a self-service release management platform that allows different teams to manage their applications. <a href="https://inedo.com/BuildMaster/download?utm_source=tdwtf&utm_medium=footerad&utm_term=2018&utm_content=Self_Service&utm_campaign=Buildmaster_Footer">Explore how!</a></div><div style="clear: left;"></div></div>