Wow, someone could have used the data from internal systems to do some serious insider trading
Home Depot GitHub token exposed for a year, granted access to internal systems
91–100 of 169 posts
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#92Earlier quoted context omitted.
If you’ve ever tried to find an employee in one of their stores, this won’t be very surprising.
Purely anecdotal, but I found Lowe's generally had much better customer service. But maybe it's just where I live
Purely anecdotal as well but it really feels like a quantity over quality thing between the two. It takes significantly longer to find someone in orange, but they’re as helpful as I can reasonably expect. Whereas Lowe’s employees tend to be both useless and annoying.
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#93Earlier quoted context omitted.
Purely anecdotal, but I found Lowe's generally had much better customer service. But maybe it's just where I live
That was true for a long time, but before that, Home Depot's customer service was terrific too. I think that's a cost that gets cut by a focus on shareholder value. Local hardware stores are still going to be better, with the caveat it may take a decade before they smile when you walk in.
> with the caveat it may take a decade before they smile when you walk in.
That’s damn good customer service right there, if you ask me. The fake-chipper act makes me want to dive into a wood chipper…
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#94Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search
Exactly, their site and apps are trash.
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#95it's easy to scan for publicly known services, really difficult to understand if a random string that says key somewhere is actually a random internal api key
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#96Earlier quoted context omitted.
I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/
I'd expect nothing less from them. The right thing to do here is to implement a sorting key for different categories here. Since McMaster-Carr seems to be going to a category when you search, they seem to have better control over the available filters. I've found that on a site like Amazon or Walmart that'll let you do a more freeform sort, the filter options becomes absolutely god awful. Well done by McMaster-Carr.…
[deleted]
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#97Earlier quoted context omitted.
If you’ve ever tried to find an employee in one of their stores, this won’t be very surprising.
Purely anecdotal, but I found Lowe's generally had much better customer service. But maybe it's just where I live
Same here in Cincinnati. Lowe's is far better than Home Depot. Everyone at HD clearly hates their job. Probably not their fault.
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#98jesus christ
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#99Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search
I've never had an employee know what a tool is, much less where to find it. All they're doing is doing this process on a slower, ruggedized phone. I literally watched someone Google "masonry bit" right in front of me.
I asked an employee for something by part number and described it. The answer he gave was "why the hell would you want that anyways? I've worked here 13 years and never seen one". I found it on a shelf a few levels up and used a grounding rod from the electrical section to spear it and bring it down to ground level
Re: Home Depot GitHub token exposed for a year, granted access to internal systems
#100it's easy to scan for publicly known services, really difficult to understand if a random string that says key somewhere is actually a random internal api key
which is why a lot of services now prefix they keys with a fixed string like pat_, sk_,