Live data from Hacker News

Home Depot GitHub token exposed for a year, granted access to internal systems

techcrunch.com

21–30 of 169 posts

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#21

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

Jokes on you, all the employees do is use their mobile site as well.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#22

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

I feel like the home depot website is fine. It's a lot better than most other shops, I've had a good experience finding the aisle and location of items, and it's generally accurate with the amount in stock at each location. If you didn't enable precise location or have bad cell signal then that is hardly the fault of the website.

I will not argue with the stock part. When the search _does_ finish, stock info is usually correct IME.

What grinds my gears is the speed of this search, regardless of the phone reception. Even on the desktop it feels like they have a bunch of interns running a sneakernet. Or the website is laden with pointless javascript that slows everything down before the search is actually performed.

I go to the same Home Depot every time. (Well I don't if I can help it, but that's beside the point). There is no reason they cannot store the preferred store in the localStorage or cookies or wherever else. Other stores have figured this out.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#23
post #6

Earlier quoted context omitted.

+1 also, when I'm in my local store it seems like cell connection goes to shit for some reason and then I have to jump on their in store wifi in order to search their website

They probably don't have any repeaters. All those metal shelves are going to interfere with the signal. I have the same experience.

Their in-store WiFi is a repeater more or less. It's one of those bullshit forced auto-join networks that you can't opt out of (at least on iOS). Because that's not a massive vector for phishing or anything.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#24

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

I feel like the home depot website is fine. It's a lot better than most other shops, I've had a good experience finding the aisle and location of items, and it's generally accurate with the amount in stock at each location. If you didn't enable precise location or have bad cell signal then that is hardly the fault of the website.

its generally in HD stores you never have cell signal or wifi

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#25

Earlier quoted context omitted.

If you go to the home depot page for torque wrenches and click the filter for drive size, you get this list: 1/2 in 1/4 in 1 in 3/8 in 3/4 in Specialty Here is the same list in decimal to make the insanity plainly obvious: 0.5 0.25 1 0.375 0.75 What sadistic lunatic made that sort order?! It's not based on size and it's not alphabetic.

It's probably a default ordering or an ordering by an unshown database ID value. It's a small enough set that it doesn't really matter for practical purposes, but I guess it does betray a lack of attention to detail.

It’s simple alphabetic.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#27

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

Jokes on you, all the employees do is use their mobile site as well.

MSFT Edging

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#28

Earlier quoted context omitted.

Purely anecdotal, but I found Lowe's generally had much better customer service. But maybe it's just where I live

Yeah I think it'll be location dependent. FWIW I've got both by me and they're equally terrible as far as the availability and knowledge of their employees. Lowes edges out Home Depot a tiny bit for me simply because I've never been accosted by a sanctioned in-store roaming sales person for solar or siding at Lowes (yet!).

> Yeah I think it'll be location dependent

I've found it to be very datetime dependent. I walking the aisles on a late Sunday night recently and the only time I saw an employee was at the self checkout before I left.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#29

Earlier quoted context omitted.

It's probably a default ordering or an ordering by an unshown database ID value. It's a small enough set that it doesn't really matter for practical purposes, but I guess it does betray a lack of attention to detail.

It’s simple alphabetic.

Is "slash" (/) before or after "space" ( ) ... or both... before and after it?

Is 8 before or after 4 in the alphabet?

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#30

Earlier quoted context omitted.

They probably don't have any repeaters. All those metal shelves are going to interfere with the signal. I have the same experience.

Their in-store WiFi is a repeater more or less. It's one of those bullshit forced auto-join networks that you can't opt out of (at least on iOS). Because that's not a massive vector for phishing or anything.

This is a network carrier setting, the issue is that T-Mobile (and maybe others) pushes a profile that does this as part of their network configuration.
Post reply on HN