Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in the Feeld dating app

fortbridge.co.uk

Post reply on HN
Print view View original

41–50 of 150 posts

Re: Vulnerabilities in the Feeld dating app

#41

Post by hackernewds »

valenterry wrote: post #40
Cu3PO42 wrote: post #17

Earlier quoted context omitted.

Ultimately, I don't disagree. However, I also try to make it a habit to not blame people for not knowing something. This presents as a structural problem in that company: they needed to hire people who do know how to secure server code and put them into a position to do so. Blame the company and those who decided to save every last penny in personnel cost.

Yeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code changes should really not have touched anything server side or even anything security relevant in the beginning.

right*

Re: Vulnerabilities in the Feeld dating app

#43

Post by benoau »

valenterry wrote: post #40
Cu3PO42 wrote: post #17

Earlier quoted context omitted.

Ultimately, I don't disagree. However, I also try to make it a habit to not blame people for not knowing something. This presents as a structural problem in that company: they needed to hire people who do know how to secure server code and put them into a position to do so. Blame the company and those who decided to save every last penny in personnel cost.

Yeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code changes should really not have touched anything server side or even anything security relevant in the beginning.

I agree they should just quit but that requires experience to understand too. By the time they've learned that, they have also learned that client-side access controls are decorative.

Re: Vulnerabilities in the Feeld dating app

#44

Post by jfoutz »

ifdefdebug wrote: post #39
jfoutz wrote: post #21

Earlier quoted context omitted.

Eternal September. Everyone starts somewhere, it’s just all the time now. In ten years, the dev will explain to a junior how bad they messed up, and why they have to validate this way. Well, I don’t know, but that’s what I hope.

yeah now imagine another engineer go "my first bridge just fell apart the first time a real truck tried to cross over it lol" or "man my first plane crashed so hard"...

Ya know, the Roman tradition was, you gotta stand under the bridge while the army marches over it. If it collapses, you die too. Maybe there's something to having nudes of that dev.

Real engineering is expensive. And hard. moving atoms around is tough. I've never cut stone, but I've melted and cast copper and aluminum. That's real and dangerous work.

Computation is cheap and plentiful. And I kinda like having full control of "stuff". But maybe we do need licensing or personal liability. If I could wave a magic wand, and make that exist, I don't really know what rules I'd put in place.

How do you think people should get skilled up?

Re: Vulnerabilities in the Feeld dating app

#46

Post by fragmede »

ifdefdebug wrote: post #39
jfoutz wrote: post #21

Earlier quoted context omitted.

Eternal September. Everyone starts somewhere, it’s just all the time now. In ten years, the dev will explain to a junior how bad they messed up, and why they have to validate this way. Well, I don’t know, but that’s what I hope.

yeah now imagine another engineer go "my first bridge just fell apart the first time a real truck tried to cross over it lol" or "man my first plane crashed so hard"...

That's an interesting idea. Bridge builders and flight sims are used in industry to test to see if a bridge design will fail or if a plane will crash. They're not limited to oversimplified and fun video games.

I wonder if there's a market for a "write a CRUD app and let it loose on the Internet and watch it get pwned" simulator/game.

Re: Vulnerabilities in the Feeld dating app

#47

Post by namaria »

Cu3PO42 wrote: post #17
dfedbeef wrote: post #15

Earlier quoted context omitted.

You shouldn't be touching the server-side code if you find this hard to keep straight.

Ultimately, I don't disagree. However, I also try to make it a habit to not blame people for not knowing something. This presents as a structural problem in that company: they needed to hire people who do know how to secure server code and put them into a position to do so. Blame the company and those who decided to save every last penny in personnel cost.

People getting paid to create software should know better then these basic mistakes.

Re: Vulnerabilities in the Feeld dating app

#48

Post by dotps1 »

advael wrote: post #45
intothemild wrote: post #35

They were in the press a lot this week, but for earning money. https://www.theguardian.com/technology/article/2024/sep/08/t...

It's been observed by many that making bad things seems to be a lot more profitable these days than making good things

It's always been like that.

The costs involved with maintaining garbage are infinitely more than maintaining something well built.

This is why software is so lucrative.. because the true cost of the software isn't how much you pay for it .. it's "how much is it going to cost you to change to something else?"

Re: Vulnerabilities in the Feeld dating app

#49

Post by bugtodiffer »

benoau wrote: post #22
dfedbeef wrote: post #15

Earlier quoted context omitted.

You shouldn't be touching the server-side code if you find this hard to keep straight.

Junior developer probably opened a Jira ticket, saw a UI of a permission dialog, and did exactly that task with nobody senior enough to know better. That's how you reproduce the bugs that were in-fashion 15 - 20 years ago in my experience!

Seems like a solid development cycle.

Junior tries something -> hit production

I do not see multiple issues with this.

Re: Vulnerabilities in the Feeld dating app

#50

Post by rahkiin »

marcus_holmes wrote: post #32

Hot take: this is a problem with GraphQL. GraphQL allows your front-end to query your data. Which is cool. But from the backend this is all really opaque (and usually implemented by a 3rd party library that has no idea about your access control). Unless you're going to implement your access control in the database itself (not the worst idea, certainly better than doing it in the front end), then it's very hard to unw…

I did not have this issue when using HotChocolate. You can easily give authorization rules to entities or properties of entities which will automatically be handled. Also to mutations
Post reply on HN