Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in the Feeld dating app

fortbridge.co.uk

Post reply on HN
Print view View original

51–60 of 150 posts

Re: Vulnerabilities in the Feeld dating app

#51

Post by bugtodiffer »

jfoutz wrote: post #44
ifdefdebug wrote: post #39

Earlier quoted context omitted.

yeah now imagine another engineer go "my first bridge just fell apart the first time a real truck tried to cross over it lol" or "man my first plane crashed so hard"...

Ya know, the Roman tradition was, you gotta stand under the bridge while the army marches over it. If it collapses, you die too. Maybe there's something to having nudes of that dev. Real engineering is expensive. And hard. moving atoms around is tough. I've never cut stone, but I've melted and cast copper and aluminum. That's real and dangerous work. Computation is cheap and plentiful. And I kinda like having full co…

> How do you think people should get skilled up?

You didn't ask me but I can give you my answer: not on prod and with a lot of reviews!

Re: Vulnerabilities in the Feeld dating app

#52

Post by advael »

dotps1 wrote: post #48
advael wrote: post #45

Earlier quoted context omitted.

It's been observed by many that making bad things seems to be a lot more profitable these days than making good things

It's always been like that. The costs involved with maintaining garbage are infinitely more than maintaining something well built. This is why software is so lucrative.. because the true cost of the software isn't how much you pay for it .. it's "how much is it going to cost you to change to something else?"

A great argument against relying on any software you can't control if ever I heard one

Re: Vulnerabilities in the Feeld dating app

#53

Post by yosito »

xenospn wrote: post #25
1_1xdev1 wrote: post #12

Earlier quoted context omitted.

I used the app briefly a few months prior to their discovery. The app was riddled with bugs. Things like chats not loading (received the push notification, but in the app not visible until force quit/reload). I’m not surprised it took them so long to remediate. I would guess a shoestring contractor dev team.

This is what happens when both founders are not technical. I use the app and it was obvious from day one it’s been designed and implemented by the lowest bidder.

Not necessarily the lowest bidder. It's quite easy for a consulting company that is bad at development to make a convincing pitch to a nontechnical founder as long as they're better at sales than they are at development.

Re: Vulnerabilities in the Feeld dating app

#54

Post by shiroiushi »

fire_lake wrote: post #33
tdeck wrote: post #28

Earlier quoted context omitted.

However little you're willing to take they can hire a less competent person cheaper.

You would hope that a mission driven company like them would care. Or at least, a profit driven company would care about scaring away users.

As decades of Windows blue screens proved, shitty software won't scare away users if the software can provide a service or capability that the users can't easily get elsewhere.

Re: Vulnerabilities in the Feeld dating app

#56

Post by luxcem »

marcus_holmes wrote: post #32

Hot take: this is a problem with GraphQL. GraphQL allows your front-end to query your data. Which is cool. But from the backend this is all really opaque (and usually implemented by a 3rd party library that has no idea about your access control). Unless you're going to implement your access control in the database itself (not the worst idea, certainly better than doing it in the front end), then it's very hard to unw…

Any third party GraphQL library worth its salt should implement some kind of ACL. It seems to be the case with the most popular ones [1] [2]. One simple idea is to implement authorization in the data models. GraphQL delegate ~get~ and ~list~ to ressource model that could implement authorization based on the context of the request.

[1] https://www.apollographql.com/docs/apollo-server/security/au...

[2] https://docs.graphene-python.org/projects/django/en/latest/a...

Re: Vulnerabilities in the Feeld dating app

#57

Post by mewpmewp2 »

strken wrote: post #36
marcus_holmes wrote: post #32

Hot take: this is a problem with GraphQL. GraphQL allows your front-end to query your data. Which is cool. But from the backend this is all really opaque (and usually implemented by a 3rd party library that has no idea about your access control). Unless you're going to implement your access control in the database itself (not the worst idea, certainly better than doing it in the front end), then it's very hard to unw…

It's pretty easy. Treat each resolver that retrieves data like it's a REST endpoint and secure it, and add a query allowlist that you append items to during your CI builds. You don't need to touch the AST or understand the context of the rest of the query. Just answer the question "can user ABC see the photos of user XYZ?" in the resolver that fetches the photos. If this is inefficient then prefetch some data or use…

Still I think this type of thing is much more likely to happen with GraphQL including various N + 1 and even worse performance issues.

Like if you imagine having junior engs they will be much more likely to make the mistake with GraphQL than otherwise and it is harder to review as well.

The permissions checking becomes a real spaghetti and difficult to understand in practice compared to just one by one checks.

Re: Vulnerabilities in the Feeld dating app

#58

Post by gregoriol »

advael wrote: post #45
intothemild wrote: post #35

They were in the press a lot this week, but for earning money. https://www.theguardian.com/technology/article/2024/sep/08/t...

It's been observed by many that making bad things seems to be a lot more profitable these days than making good things

It's not making bad, it's making cheaper/faster. They probably hired less experimented developers or didn't give them proper time to implement the features they wanted.

Re: Vulnerabilities in the Feeld dating app

#60

Post by forgotacc240419 »

qingcharles wrote: post #31
mjg59 wrote: post #9

Earlier quoted context omitted.

I wrote up finding some of these issues entirely independently: https://mjg59.dreamwidth.org/70061.html

So the question is -- how many others knew about this and were exploiting it without discussing it? :(

I didn't exactly know of it but I had enough glitches on that terrible app when I was using it that it was obvious there was info being sent that it didn't mean to and some atrocious performance issues that made it feel like it was crudely thrown together

Pretty sure I flagged something or another as a security issue but can't recall what it was

Post reply on HN