Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in the Feeld dating app

fortbridge.co.uk

Post reply on HN
Print view View original

141–150 of 150 posts

Re: Vulnerabilities in the Feeld dating app

#141

Post by mikrotikker »

elric wrote: post #99

The online dating space (I use the term liberally) is a huge fucking mess. There's only 2 or 3 companies with an offering that is anywhere near useful, and they're either evil, incompetent, or both. Maybe it's time for an open source federated dating service or something. Or at least something that doesn't sell your data, doesn't leak your nudes, or doesn't get you beaten up/raped/murdered. Probably easier said than…

I feel like ones nudity is something that should stay in analog form, where you have almost complete and absolute control over the distribution of it. If people want to make digital copies of their analog form that's their right to do, but they need to realize that no system is nor ever will be secure enough to prevent their inevitable release and distribution.

This is something that young people especially don't take into account; the potential and probable long term ramifications and embarrassment. Providing such a facility is merely inviting such negative effects.

Re: Vulnerabilities in the Feeld dating app

#142

Post by elric »

mikrotikker wrote: post #141
elric wrote: post #99

The online dating space (I use the term liberally) is a huge fucking mess. There's only 2 or 3 companies with an offering that is anywhere near useful, and they're either evil, incompetent, or both. Maybe it's time for an open source federated dating service or something. Or at least something that doesn't sell your data, doesn't leak your nudes, or doesn't get you beaten up/raped/murdered. Probably easier said than…

I feel like ones nudity is something that should stay in analog form, where you have almost complete and absolute control over the distribution of it. If people want to make digital copies of their analog form that's their right to do, but they need to realize that no system is nor ever will be secure enough to prevent their inevitable release and distribution. This is something that young people especially don't tak…

I see where you're coming from, but I don't agree. It should be possible for people to share stuff (nudity or anything else, really) with the people they want, without worrying that $incompentCompany will leak it for all to see.

That, and a bit of embarrassment isn't really all that bad. The problem is that the leaked stuff keeps on circulating :-(

I have a pet theory that seeing more "real" people in the nude is good for your body image. There's a lot less nudity than there was 30 years ago (from movies to locker rooms and everything in between), there's a lot more shame, and everyone is wistfully staring at Instagram garbage.

Re: Vulnerabilities in the Feeld dating app

#143

Post by robertlagrant »

pistoleer wrote: post #118
robertlagrant wrote: post #108

Earlier quoted context omitted.

I don't see how that statement follows mine. Can you connect them at all?

I thought you were making the comparison that a pentester is like a missile shot at a bridge whereas the internet is the army walking over the bridge.

Oh, I see. No, the missile is a hacker attacking your software remotely. Bridges are just accepted that they will collapse if deliberately attacked by a determined attacker. Software is held to a higher standard, not a lower one.

Re: Vulnerabilities in the Feeld dating app

#144

Post by _wbrb »

nailer wrote: post #117
xenospn wrote: post #25

Earlier quoted context omitted.

This is what happens when both founders are not technical. I use the app and it was obvious from day one it’s been designed and implemented by the lowest bidder.

The founder used attend node.js events in London. Not sure why you think he’s non technical.

Attending node.js events does not mean you are technical. A lot of people, I would say most people in my experience, go those events to connect with technical talent.

Re: Vulnerabilities in the Feeld dating app

#145

Post by strken »

pistoleer wrote: post #97
strken wrote: post #36

Earlier quoted context omitted.

It's pretty easy. Treat each resolver that retrieves data like it's a REST endpoint and secure it, and add a query allowlist that you append items to during your CI builds. You don't need to touch the AST or understand the context of the rest of the query. Just answer the question "can user ABC see the photos of user XYZ?" in the resolver that fetches the photos. If this is inefficient then prefetch some data or use…

How do you guys bridge the abstraction gap/wall between resolvers to prevent N+1 queries? I have the suspicion that GraphQL is great for exposing a really generic API, useful when you have no idea what shape the front end will take (how often is that?). But it comes at a heavy price; genericity is always the opposite of specialization. And optimization can only occur during specialization. Having worked with it for a…

Putting a dataloader in front of batch APIs usually works okay. You end up with round trips but they're 1+1 and inside the data centre. I've used AST traversal to compute joins a couple of fields ahead + custom resolvers that only load their data if it wasn't loaded by the parent, but I don't think that's necessary to get decent performance and I wouldn't do it again unless there was a real business need.

I agree that genericity is often the opposite of specialisation. I disagree that it's a heavy price. REST is pretty general. To my mind specialist APIs are things like streaming video, file uploads, anything that relies on caching in an intermediate layer, etc. and these are all examples of where you'd follow the established standards and add some RESTful routes/services. I don't think it's sacrilege to upload files in a different way to how you load your user dashboard or your interface for editing project permissions.

Re: Vulnerabilities in the Feeld dating app

#146

Post by xenospn »

nailer wrote: post #117
xenospn wrote: post #25

Earlier quoted context omitted.

This is what happens when both founders are not technical. I use the app and it was obvious from day one it’s been designed and implemented by the lowest bidder.

The founder used attend node.js events in London. Not sure why you think he’s non technical.

Because a technical person would immediately find all of the glaring flaws and issues with their app and fix it promptly. Unless they’re incompetent. Which might be worse than non-technical.
Post reply on HN