How big of a client is Fiverr? Surely Cloudinary would have alerts for an enterprise client leaking stuff?
Just insane
Tell HN: Fiverr left customer files public and searchable
61–70 of 252 posts
Re: Tell HN: Fiverr left customer files public and searchable
#62Re: Tell HN: Fiverr left customer files public and searchable
#63Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.
Teachers have to be licensed and keep up on licensing. Plumbers. Electricians. Lawyers. Doctors. Hell, I have to get a license to run my own business. Why shouldn't software come with a branch for licenses if you're working with sensitive data?
Hairdressers!
Re: Tell HN: Fiverr left customer files public and searchable
#64Re: Tell HN: Fiverr left customer files public and searchable
#65Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.
> should require some kind of genuine software engineering certification Wouldn't change a thing, other than add another hassle you have to pay for to do your job. This is the result of carelessness, not someone who didn't know that private data should be private because they weren't certified.
This is the result of somebody who has no idea how the fuck the tech they're using works. They surely knew it should be private, but they did not know that they were making it publicly available because they were blindly fumbling their way around in a job beyond their competence level. There is a 0% chance this was ordinary carelessness, in the form of "I know better but don't care enough", this is so clearly a case of "I don't know what I'm doing".
Re: Tell HN: Fiverr left customer files public and searchable
#66[flagged]
It's exactly how it works, pages don't just magically appear in Google's index.
You need links to pages either from your own website or backlinks from other websites. Alternatively if the page is in your sitemap then Google will typically pick it up or you can manually submit it for indexing. For important pages you would typically want internal links, backlinks, and have it in your sitemap.
Re: Tell HN: Fiverr left customer files public and searchable
#67There are health stuff too... and they are not even paying attention to this matter
https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...
Re: Tell HN: Fiverr left customer files public and searchable
#68Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.
> should require some kind of genuine software engineering certification Wouldn't change a thing, other than add another hassle you have to pay for to do your job. This is the result of carelessness, not someone who didn't know that private data should be private because they weren't certified.
It's so much worse in the industry, the truth is that many people literally have no idea how to secure things, what to secure, why to secure it - they pay no attention and are plainly ignorant of the state of the world and oftentimes just stupid.
I worked at a company where a customer called confused because when they googled our company as they did every day to login to their portal they found that drivers licenses we stored were available on the public internet.
The devs literally didn't know about direct object access and thought obfuscation was enough, didn't know about how robots.txt worked, didn't know about google webmaster shit, didn't know about sitemaps, they were just the cheapest labor the company could find who could do the thing.
This is a huge portion of outsourced labor in my experience, not because they are worse overseas in any respect, but because the people looking for cheap labor were always looking for the cheapest labor and had no idea how that applied to the actual technical work of running their business.
Re: Tell HN: Fiverr left customer files public and searchable
#69I've been boycotting Fiverr, so I'm glad I'm not caught up in this. And judging by their response to this issue, I'm glad I've been boycotting it.
Re: Tell HN: Fiverr left customer files public and searchable
#70Extremely bad stuff here. Can't believe it's been 7 hours now and you can still pull up people's complete prepared tax returns right from a Google search. This should be a business-ending breach of trust and good practices, but I worry there's probably a lack of regulatory might or will to make anything happen.