Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never Give Your Information To 10 Minute Old Startups

blog.ryankearney.com

Post reply on HN
Print view View original

101–110 of 185 posts

Re: Never Give Your Information To 10 Minute Old Startups

#101

Post by danielweber »

olalonde wrote: post #100
Silhouette wrote: post #22

10 minutes? Never give your information to a business that made a mistake like this, ever . That wasn't merely a "security vulnerability". It was also a demonstration that the people running the business have absolutely no idea what they are doing when it comes to security, privacy, or testing and release processes. (Actually, there is an alternative explanation, which is even worse: they knew and didn't care. I pref…

> It was also a demonstration that the people running the business have absolutely no idea what they are doing when it comes to security, privacy, or testing and release processes. I'm pretty sure a lot of successful startups were started by people who had "absolutely no idea what they were doing". Give them a break...

Yeah, if we couldn't do business with people who ever released software with security holes, none of us would have jobs.

The big fuck-up is when they told anyone with key problems to contact the guy who found the issue. That's why we should consider them unprofessional. The security holes were accidents. The blamestorm was deliberate.

Re: Never Give Your Information To 10 Minute Old Startups

#102

Post by adgar2 »

spamizbad wrote: post #87
adgar2 wrote: post #6

It might be time for pg and co. to reconsider the idea that engineering doesn't matter and that startups are just about people. This is pathetic .

Honestly, this isn't even a matter of engineering. I don't know the rails solution, but a quick-and-dirty solution in other frameworks is to use a decorator on your controller/views that does something like: if request.session.userId == action.userId: pass else: return SecurityExceptionResult The example above is like 10 mins to code and put under test once you fill it in with the necessary stuff- You're probably goi…

What do you call the role of the individual whose job it is to implement account management? Do you not call that person an engineer? If not - whose responsibility would you say it is to ensure shit like this doesn't happen?

Re: Never Give Your Information To 10 Minute Old Startups

#103

Post by [deleted] »

smeagol wrote: post #68
jspthrowaway wrote: post #49

Earlier quoted context omitted.

Contacted a PR person in between the last thread and this one, I'm guessing? That's a rapid 180. You have a long way to go in my mind, in terms of fixing the initial response. You probably have help now, which is great, but your initial kneejerk demonstrates underlying trouble to me which you need to fix. You're in a tough spot, too, because you can't delete those godawful comments without looking suspicious.

huh? you realize this was a pet project right? we're two dudes with no jobs.

[deleted]

Re: Never Give Your Information To 10 Minute Old Startups

#105

Post by grey-area »

unreal37 wrote: post #50
clockstrikesten wrote: post #45

Earlier quoted context omitted.

You speak of "responsible disclosure", but what about "responsible launch"? If a backend is coded this poorly, it betrays irreparable and highly dangerous levels of idiocy, laziness, and lack of foresight in the ones who coded it. Everyone deserves to be informed of this blunder so they know to avoid this group like the plague. Public ridicule and preemptive destruction of the brand is the only conscionable reaction.

It sounds like it wasn't launched yet. The founders say they built it for themselves and their friends to start. Someone discovered the URL and posted it to Hacker News. They probably should have shut it down or disabled registrations once it got out until it was tested.

It sounds like it wasn't launched yet. The founders say they built it for themselves and their friends to start. Someone discovered the URL and posted it to Hacker News.

It should not have been on the public internet without access control for editing/viewing personal information like this - as soon as a site is visible on the internet there are bots trying all conceivable urls on it and scraping for information. If you look in your logs for any server you'll find all sorts of php,aspx etc urls as bots try to find vulnerabilities, no matter what you're running. I'm sure there'll be some Rails scrapers out there too though perhaps they're not too common yet.

There are probably a lot of other holes if they left the user security so wide open.

Re: Never Give Your Information To 10 Minute Old Startups

#106

Post by danielweber »

notatoad wrote: post #74
alyx wrote: post #7

To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.

still... developing an application and then bolting on some security over top of it later seems like a recipe for disaster. And pushing it to a public server before any security has been implemented is a very stupid thing to do.

It may have been a prototype they quickly wrote, and planned to do a heartier implementation later. And when they suddenly got onto HN's front page, a whole bunch of excitement happened and they completely forgot that this was just a prototype.

"Pushing it to a public server" is really minor. Mozilla had this issue, too, when they had a new filename technically available on a server and someone jumped the gun and told the whole world that the new version was ready. Well, it wasn't. A bunch of kids whined that it was all Mozilla's fault for having a file available on their public server, but while it's arguable that a service that is reachable by URL has no expectation of privacy, it's a hell of a lot harder to argue that having a service reachable by URL implies a warranty that it is safe to use.

Friends in the 90's would run telnet and web servers with "Username:" "Password:" "Credit Card Number:" prompts. It was funny to watch that some people would type in apparently real data, although we never verified.

Re: Never Give Your Information To 10 Minute Old Startups

#108

Post by angryasian »

seldo wrote: post #90

Those who know me will laugh to see me continuing to beat this dead horse, but this is a really great example of why ORM+scaffolding is an anti-pattern, by which I mean it seems like a good idea at first, but the costs outweigh the benefits. It's absolutely true that you can use ORM and scaffolding patterns in a totally secure way. But the problem is that the defaults are insecure -- every table can be accessed, ever…

I think it has less to do with ORM and more to do with laziness. Its really one line in the controller, if loggedin user is not the user trying to edit redirect.

Re: Never Give Your Information To 10 Minute Old Startups

#109

Post by mattrandle »

Its got nothing to do with the age of the startup, and everything to do with the quality of the engineering. You see problems like this and worse in companies that have been around for years.

It would have been more responsible to privately notify the owner of the site rather than karma whoring a blog post to top of HN.

Re: Never Give Your Information To 10 Minute Old Startups

#110

Post by gambler »

angryasian wrote: post #108
seldo wrote: post #90

Those who know me will laugh to see me continuing to beat this dead horse, but this is a really great example of why ORM+scaffolding is an anti-pattern, by which I mean it seems like a good idea at first, but the costs outweigh the benefits. It's absolutely true that you can use ORM and scaffolding patterns in a totally secure way. But the problem is that the defaults are insecure -- every table can be accessed, ever…

I think it has less to do with ORM and more to do with laziness. Its really one line in the controller, if loggedin user is not the user trying to edit redirect.

It's not just laziness. 99% of all framework tutorials I've seen out there completely ignores even basic authentication/authorization issues, which are universal to all real websites. This lack of attention to details is cultivated.
Post reply on HN