Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Home Depot GitHub token exposed for a year, granted access to internal systems

techcrunch.com

Post reply on HN
Print view View original

51–60 of 169 posts

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#51

Post by freedomben »

rao-v wrote: post #34

I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens. It seems like a cheap and simple thing to offer your customers a little extra safety. Anybody interested in starting a platform agnostic service to do this?

They definitely do have automation to scan for this already. I've seen plenty of alerts (fortunately all false positives that triggered on example keys that weren't real). I don't know how comprehensive it is, but it does exist.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#52

Post by antonvs »

wiredfool wrote: post #25
SoftTalker wrote: post #16

Earlier quoted context omitted.

It's probably a default ordering or an ordering by an unshown database ID value. It's a small enough set that it doesn't really matter for practical purposes, but I guess it does betray a lack of attention to detail.

It’s simple alphabetic.

3/8 doesn’t come before 3/4 alphabetically.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#53

Post by progbits »

tomjakubowski wrote: post #9
craftkiller wrote: post #8

Earlier quoted context omitted.

If you go to the home depot page for torque wrenches and click the filter for drive size, you get this list: 1/2 in 1/4 in 1 in 3/8 in 3/4 in Specialty Here is the same list in decimal to make the insanity plainly obvious: 0.5 0.25 1 0.375 0.75 What sadistic lunatic made that sort order?! It's not based on size and it's not alphabetic.

I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/

Mouser et al also do it right for mixed unit lists, eg. component dimensions are shown in their specified units but sorted as: 11mm, 12mm, 0.5in, 13mm, ...

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#54

Post by pacoWebConsult »

jjice wrote: post #38
tomjakubowski wrote: post #9

Earlier quoted context omitted.

I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/

I'd expect nothing less from them. The right thing to do here is to implement a sorting key for different categories here. Since McMaster-Carr seems to be going to a category when you search, they seem to have better control over the available filters. I've found that on a site like Amazon or Walmart that'll let you do a more freeform sort, the filter options becomes absolutely god awful. Well done by McMaster-Carr.…

The schemas for Amazon and Walmart's product information are absolutely bonkers and constantly missing features that they demand be provided.

Here's the XML Schema Definition for "Product" on Amazon [1]

This is joined on each of the linked category schemas included at the type, of which each has unique properties that ultimately drive the metadata on a particular listing for the SKU. Its wrought with inconsistency, duplicated fields, and oftentimes not up-to-date with required information.

Ultimately, this product catalog information gets provided to Amazon, Walmart, Target, and any other large 3rd party marketplace site as a feed file from a vendor to drive what product they can then list pricing and inventory against (through similar feeds).

You are right that the control McMaster-Carr has on their catalog is the strategic and technological advantage.

[1]: https://images-na.ssl-images-amazon.com/images/G/01/rainier/...

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#55

Post by brewtide »

garyfirestorm wrote: post #24
porphyra wrote: post #12

Earlier quoted context omitted.

I feel like the home depot website is fine. It's a lot better than most other shops, I've had a good experience finding the aisle and location of items, and it's generally accurate with the amount in stock at each location. If you didn't enable precise location or have bad cell signal then that is hardly the fault of the website.

its generally in HD stores you never have cell signal or wifi

I bought a water heater that had a large (1k!) instant rebate that you had to scan, sign up on website and show the emailed coupon to the person during cashing out. Took me 25 minutes wandering around the store to get enough reception to actually do this process. Made me chuckle, thinking how having it online only but before point of sale in the store was such a terrible, terrible idea.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#56

Post by rockostrich »

tomjakubowski wrote: post #9
craftkiller wrote: post #8

Earlier quoted context omitted.

If you go to the home depot page for torque wrenches and click the filter for drive size, you get this list: 1/2 in 1/4 in 1 in 3/8 in 3/4 in Specialty Here is the same list in decimal to make the insanity plainly obvious: 0.5 0.25 1 0.375 0.75 What sadistic lunatic made that sort order?! It's not based on size and it's not alphabetic.

I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/

McMaster-Carr's website is actually pretty impressive given how unassuming it is. It does a ton of pre-loading on hover and caching to make it feel like you're just navigating a static site. I didn't even realize that the page had a loading state until I enabled throttling from my network tab and immediately clicked on a link as soon as I hovered over it.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#57

Post by wholinator2 »

pacoWebConsult wrote: post #54
jjice wrote: post #38

Earlier quoted context omitted.

I'd expect nothing less from them. The right thing to do here is to implement a sorting key for different categories here. Since McMaster-Carr seems to be going to a category when you search, they seem to have better control over the available filters. I've found that on a site like Amazon or Walmart that'll let you do a more freeform sort, the filter options becomes absolutely god awful. Well done by McMaster-Carr.…

The schemas for Amazon and Walmart's product information are absolutely bonkers and constantly missing features that they demand be provided. Here's the XML Schema Definition for "Product" on Amazon [1] This is joined on each of the linked category schemas included at the type, of which each has unique properties that ultimately drive the metadata on a particular listing for the SKU. Its wrought with inconsistency, d…

Very interesting how nearly half the list is (assumedly) every single chemical listed under California Prop 65. Do they really need to specify exactly which chemical it is? I've seen thousands of prop 65 warnings in my life but I've literally never seen it tell me what chemical its warning me about. I just commented to a friends a couple weeks ago i wished they'd tell me what so i could look it up myself!

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#58

Post by pkaye »

VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

Its hard to locate anything in their stores these days and its even harder to find any staff. So what I do is order for pickup and let them do the work.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#59

Post by hinkley »

tomjakubowski wrote: post #9
craftkiller wrote: post #8

Earlier quoted context omitted.

If you go to the home depot page for torque wrenches and click the filter for drive size, you get this list: 1/2 in 1/4 in 1 in 3/8 in 3/4 in Specialty Here is the same list in decimal to make the insanity plainly obvious: 0.5 0.25 1 0.375 0.75 What sadistic lunatic made that sort order?! It's not based on size and it's not alphabetic.

I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/

Is it weird that I kinda want to work there?

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#60

Post by rurp »

VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

I literally couldn't load their website with my previous Pixel phone. The performance was so terrible it would grind to a halt and freeze or crash.
Post reply on HN