Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Home Depot GitHub token exposed for a year, granted access to internal systems

techcrunch.com

Post reply on HN
Print view View original

61–70 of 169 posts

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#61

Post by hinkley »

VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

> the "current store" now points to a random location somewhere in a different state

I thought that was just me. It gets the first, maybe the second digit of the zip code right and that's about it.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#62

Post by Rebelgecko »

VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

Someone made their own version of the HD app that works much better:

https://www.reddit.com/r/Tools/comments/1opufvq/a_lightweigh...

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#63

Post by dudeWithAMood »

rao-v wrote: post #34

I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens. It seems like a cheap and simple thing to offer your customers a little extra safety. Anybody interested in starting a platform agnostic service to do this?

I think there are crawlers that do that. Somehow I accidentally had a commit with an openai key in it, and when I published an open source repo with that commit within ~20 seconds I got an email from openai someone had retired my exposed key.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#64

Post by darrylb42 »

TallGuyShort wrote: post #44
VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

I've never had an employee know what a tool is, much less where to find it. All they're doing is doing this process on a slower, ruggedized phone. I literally watched someone Google "masonry bit" right in front of me.

Though they should be on in store wifi. The big steel box store is a faraday cage that doesn't let the internet in.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#65

Post by sowbug »

VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

Or when the site tells you your store doesn't have a part in stock, but neglects to tell you that they do have 350 of the identical part, different brand, in stock. Because who would ever buy a 1/2-inch close Halex rigid conduit close nipple in-store right now when they could wait a few days for a 1/2-inch close Commercial Electric rigid conduit nipple?

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#66

Post by LTL_FTC »

freedomben wrote: post #43
garyfirestorm wrote: post #24

Earlier quoted context omitted.

its generally in HD stores you never have cell signal or wifi

This is definitely true and makes the experience shittier than it otherwise would be, but even with a great signal/connection it frequently loads so slowly that I've long run out of patience.

I have gotten in the habit of looking up what isle and bay the thing I need is before I get there, and then I screenshot it because too many times the page has needed to reload and start over

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#67

Post by denysvitali »

VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

Someone should use their GH token to fix their website

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#68

Post by patagurbon »

porphyra wrote: post #12
VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

I feel like the home depot website is fine. It's a lot better than most other shops, I've had a good experience finding the aisle and location of items, and it's generally accurate with the amount in stock at each location. If you didn't enable precise location or have bad cell signal then that is hardly the fault of the website.

Their internal setup was also an absolute mess as of 4 years ago. A horrific hybrid of extremely legacy systems and new systems created around COVID which are both nicer and also deeply lacking in features we needed as floor workers.

I understand that upgrading and migrating to new systems takes time but this process never seemed like it involved anyone on the ground.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#69

Post by patagurbon »

TallGuyShort wrote: post #44
VTimofeenko wrote: post #4

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

I've never had an employee know what a tool is, much less where to find it. All they're doing is doing this process on a slower, ruggedized phone. I literally watched someone Google "masonry bit" right in front of me.

The store I worked at for a while had a surprising number of real bearded experts, alongside at least a few younger folks who really understood the internal systems. It was great, but clearly was eroding as the experts retired and young folks with no experience were hired to replace them.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#70

Post by dboreham »

rockostrich wrote: post #56
tomjakubowski wrote: post #9

Earlier quoted context omitted.

I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/

McMaster-Carr's website is actually pretty impressive given how unassuming it is. It does a ton of pre-loading on hover and caching to make it feel like you're just navigating a static site. I didn't even realize that the page had a loading state until I enabled throttling from my network tab and immediately clicked on a link as soon as I hovered over it.

Even more impressive is that it's something like 20 years old, and was basically the way it is now 20 years ago.
Post reply on HN