Live data from Hacker News

Home Depot GitHub token exposed for a year, granted access to internal systems

techcrunch.com

31–40 of 169 posts

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#31

Earlier quoted context omitted.

I feel like the home depot website is fine. It's a lot better than most other shops, I've had a good experience finding the aisle and location of items, and it's generally accurate with the amount in stock at each location. If you didn't enable precise location or have bad cell signal then that is hardly the fault of the website.

its generally in HD stores you never have cell signal or wifi

[deleted]

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#32

Wow, the non-response/communication at any time by Home Depot to all parties involved in trying to help them, is staggering.

Too busy going all-in on Flock cameras. This was the nail in the coffin for me. [0] https://deflock.me/map#map=17/33.639428/-111.976540

Not entirely unsurprising due to the theft issues they face

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#33

Earlier quoted context omitted.

It’s simple alphabetic.

Is "slash" (/) before or after "space" ( ) ... or both... before and after it? Is 8 before or after 4 in the alphabet?

Before. _E_ight vs _F_our.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#34
I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens.

It seems like a cheap and simple thing to offer your customers a little extra safety.

Anybody interested in starting a platform agnostic service to do this?

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#35

Earlier quoted context omitted.

Is "slash" (/) before or after "space" ( ) ... or both... before and after it? Is 8 before or after 4 in the alphabet?

Before. _E_ight vs _F_our.

But _T_wo is also before _F_our

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#36
post #34

I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens. It seems like a cheap and simple thing to offer your customers a little extra safety. Anybody interested in starting a platform agnostic service to do this?

[deleted]

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#37

Earlier quoted context omitted.

It’s simple alphabetic.

Is "slash" (/) before or after "space" ( ) ... or both... before and after it? Is 8 before or after 4 in the alphabet?

No, there's no reasonable ordering going on.

If it were ordered by ordinal values, "/" is 47 and " " is 32, so "1 in" would come before "1/2 in".

It's not alphabetized by letter word. Because while "Eight" comes before "Four", "Specialty" would come before "Three".

No matter which way you attempt to order it, something is out of order.

Softtalker probably got it right. This is some default or id sort.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#38

Earlier quoted context omitted.

If you go to the home depot page for torque wrenches and click the filter for drive size, you get this list: 1/2 in 1/4 in 1 in 3/8 in 3/4 in Specialty Here is the same list in decimal to make the insanity plainly obvious: 0.5 0.25 1 0.375 0.75 What sadistic lunatic made that sort order?! It's not based on size and it's not alphabetic.

I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/

I'd expect nothing less from them. The right thing to do here is to implement a sorting key for different categories here. Since McMaster-Carr seems to be going to a category when you search, they seem to have better control over the available filters.

I've found that on a site like Amazon or Walmart that'll let you do a more freeform sort, the filter options becomes absolutely god awful.

Well done by McMaster-Carr. I assume they control their inventory a bit more than a marketplace like Home Depot, Walmart, or Amazon, so that's also an advantage.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#39

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

Indeed, Home Depot's software is generally so bad. I remember around 2017/2018 time frame when they started showing up to big tech conferences (especially K8s and React.js conferences) really trying to modernize. I spent a few minutes talking to the people manning the booth (which were surprisingly high ranking in the company, at least by title), and came away thinking "I'm glad you're making an effort, but y'all really have no idea what you're doing." The left hand and the right hand had completely different ideas/priorities about how to accomplish their goals. I didn't want to make any judgments on a simple conversation at a conference, but at this point I think time has shown that it was pretty representative of how they were approaching it internally, and unsurprisingly it did not work out super well.

Now that said, I don't want to minimize the difficulty in modernizing software at a corp like HD. It's wildly more difficult than most people can appreciate. I've consulted for companies trying to do it, and there are lots of challenges with legacy systems, migrations, and plenty of non-technical challenges as well.

Shout out to Wal-mart for genuinely kicking ass at this though. I'm quickly becoming an Onn fanboy. Genearlly speaking, great products at great prices, from their USB cables up to their smart speakers and more. You can really tell from the product design and implementation that they are letting the nerds geek out and have fun! That in turn enables me to do the same :-)

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#40

Earlier quoted context omitted.

Their in-store WiFi is a repeater more or less. It's one of those bullshit forced auto-join networks that you can't opt out of (at least on iOS). Because that's not a massive vector for phishing or anything.

This is a network carrier setting, the issue is that T-Mobile (and maybe others) pushes a profile that does this as part of their network configuration.

Right, so you can't opt-out of it.
Post reply on HN