21–30 of 85 posts
Did you or your friend happen to report this to them before posting it here?
yeah he said he told them. I would have more sympathy if it was an obscure hole, but something this big is just disrespectful to their users.
Earlier quoted context omitted.
a little harsh maybe....developers make mistakes...probably just forgot about it while trying to get the initial release out the door.... its not like tumblr is a bank or the DoD
Forgetting to secure the admin panel isn't a little mistake though and is easy enough to detect "Hey, I didn't have to log in to an admin account to use the admin panel thats weird". Saying security is less important because it's not a bank doesn't make sense because it's issues like this that can cost a company it's existence.
It is a problem, just saying that I vote the developer keeps his job cause i like tumblr
You can essentially take control of Tumblr.
I actually don't know what Tumblr is. Is it a twitter clone or something?
The perverse irony of all of this is that the incident reminded me that I've got a Tumblr account. Before today, I hadn't logged in for over a year!
Earlier quoted context omitted.
Forgetting to secure the admin panel isn't a little mistake though and is easy enough to detect "Hey, I didn't have to log in to an admin account to use the admin panel thats weird". Saying security is less important because it's not a bank doesn't make sense because it's issues like this that can cost a company it's existence.
This doesnt sound like the whole admin panel... its possible nobody has even used this panel since testing... It is a problem, just saying that I vote the developer keeps his job cause i like tumblr
If that's true, the lead developer should be fired on the spot. They use that "good" old "security by obscurity". I thought this technique was dead long ago....
Oh well, everyone overlooks something that seems obvious to someone else, I guess.
What the hell is Tumblr? And what happened to vowels?
Also has a great bookmarklet and a neat api.
Probably better to let Tumblr know first, then us. Edit: just confirmed that it works. Basically let's you search users by id or email then give you ability to change their email/reset password.
Admin dashboard: http://img.skitch.com/20080415-ef6k9c8hpbasi9g137j6u4iqrs.jp...
Clicking "password": http://img.skitch.com/20080415-day5r87i8tbt9iaqrtf73tpnnd.jp...
Clicking "email": http://img.skitch.com/20080415-bg12j2y7wxmeqn44pmctcs69e3.jp...
And clicking "edit" tumblog: http://img.skitch.com/20080415-cg7iwrmc7gu2a58qkmcnfre6ka.jp...
Don't worry, I didn't do anything!
