Never Give Your Information To 10 Minute Old Startups

#1

Post by RKearney » Sat, Oct 06, 2012, 2:27 AM UTC

Never Give Your Information To 10 Minute Old Startups
blog.ryankearney.com

Re: Never Give Your Information To 10 Minute Old Startups

#2

Post by paulhauggis » Sat, Oct 06, 2012, 2:31 AM UTC

I'm shocked at the security flaws in this system. It's so easy to prevent..

Re: Never Give Your Information To 10 Minute Old Startups

#3

Post by citricsquid » Sat, Oct 06, 2012, 2:38 AM UTC

Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.

Re: Never Give Your Information To 10 Minute Old Startups

#4

Post by hellosmithy » Sat, Oct 06, 2012, 2:42 AM UTC

Wow. That's taking the idea of an MVP a little too far. Just goes to show worth doing a little research before handing over any real information to a new service like this.

Re: Never Give Your Information To 10 Minute Old Startups

#5

Post by amalag » Sat, Oct 06, 2012, 2:44 AM UTC

Was wondering how it was "compromised", thanks for posting this.

Re: Never Give Your Information To 10 Minute Old Startups

#6

Post by adgar2 » Sat, Oct 06, 2012, 2:45 AM UTC

It might be time for pg and co. to reconsider the idea that engineering doesn't matter and that startups are just about people. This is pathetic.

Re: Never Give Your Information To 10 Minute Old Startups

#7

Post by alyx » Sat, Oct 06, 2012, 2:46 AM UTC

To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.

Re: Never Give Your Information To 10 Minute Old Startups

#8

Post by adgar2 » Sat, Oct 06, 2012, 2:47 AM UTC

citricsquid wrote: post #3

Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.

> I don't think I've encountered a site that had accounts edited this way before.

Any site that employs the pattern of specifying user account routes using the user's primary key in the URL needs to implement authorization. This site clearly skipped that step.

To me, this looks like the stereotypical bare-bones rails deployment by a newbie.

Re: Never Give Your Information To 10 Minute Old Startups

#9

Post by natrius » Sat, Oct 06, 2012, 2:47 AM UTC

citricsquid wrote: post #3

Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.

The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but it is (or was) easy to overlook.

Re: Never Give Your Information To 10 Minute Old Startups

#10

Post by philwelch » Sat, Oct 06, 2012, 2:48 AM UTC

alyx wrote: post #7

To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.

If it's accessible on the public internet and asks for something as secure as API keys, that is when you should worry about security, not when it's "meant to be picked up by HN".