Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Fiverr left customer files public and searchable

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 252 posts

Re: Tell HN: Fiverr left customer files public and searchable

#141

Post by fsflover »

Aurornis wrote: post #74
applfanboysbgon wrote: post #65

Earlier quoted context omitted.

This is the result of somebody who has no idea how the fuck the tech they're using works. They surely knew it should be private, but they did not know that they were making it publicly available because they were blindly fumbling their way around in a job beyond their competence level. There is a 0% chance this was ordinary carelessness, in the form of "I know better but don't care enough", this is so clearly a case…

Any time someone tries to suggest certification as a solution I ask the same question: How would it have solved this problem? Would the certification require someone to take an official certification test for the framework used? And therefore we’re only allowed to use frameworks which have certification tests available? If you want to write some new software, do you have to generate a certification for it and get tha…

How did original engineering certification prevent dangerous constructions? Did it force everyone to use a Big Company?

Re: Tell HN: Fiverr left customer files public and searchable

#142

Post by walletdrainer »

AndroTux wrote: post #26
walletdrainer wrote: post #18

[flagged]

It kind of is, though. Google doesn't randomly try to visit every URL on the internet. It follows links. Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.

> Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.

So? That’s indeed how Google works.

Google does not work how OP describes it.

I’ve investigated similar incidents in the past on other platforms, it was always user error causing links to be public.

Re: Tell HN: Fiverr left customer files public and searchable

#143

Post by itsmemattchung »

impish9208 wrote: post #10

This is crazy! So many tax and other financial forms out in the open. But the most interesting file I’ve seen so far seems to be a book draft titled “HOOD NIGGA AFFIRMATIONS: A Collection of Affirming Anecdotes for Hood Niggas Everywhere”. I made it to page 27 out of 63.

Don't know how you stumbled on this (or what you searched for) but this book is gold, has me laughing out loud:

> "I wake up happy, dancing all in the mirror and shit. My confidence is so high I’m practicing how to accept a job I haven’t even applied for yet."

Re: Tell HN: Fiverr left customer files public and searchable

#144

Post by morpheuskafka »

viaredux wrote: post #132

I am a freelancer on Fiverr, this is VERY concerning. The amount of PII that I have sent over Fiverr, after sending NDA's is potentially all out in the public. I hope there will be accountability for this. IMO Fiverr has had terrible management for years! They simply do not care about their freelancers (and apparently also not about their customers).

One founder of Fiverr's LinkedIn photo is in a racecar and posted about supply chain security a week ago.

The other also runs an insurance company (Lemonade) and just posted his drink to celebrate their 1B customers.

I never used their platform but tried a couple jobs on Upwork and drove Uber for 1000 trips. It is absolutely enraging how the CEO class lives day to day like they are some sort of "visionary" for taking a cut of other people's work while taking zero responsibility for even their own app's quality.

At one point the Uber app still told you to call a phone number for some support paths that had a recording telling you to use the app instead. Companies have systematically cut any kind of support, testing, and apparently security.

This also ties in nicely with the Delve debacle about how perfunctory those security certifications are.

Re: Tell HN: Fiverr left customer files public and searchable

#145

Post by Ekaros »

bombcar wrote: post #60
bad_haircut72 wrote: post #56

Earlier quoted context omitted.

Normalize "vibe-plumbing"

Both plumbing and wiring are “easier” in a way than programming-as they’ll violently and potentially explosively let you know if you messed up; whereas programming lets you be blissfully unaware until you see your data plastered across the nightly news.

There are many failure cases that are slow. Especially with water. Let say they sag a bit and connection is poor. It might slowly start leaking over months causing structural damage or at least dampness and microbiological effects.

Re: Tell HN: Fiverr left customer files public and searchable

#146

Post by bblb »

dewey wrote: post #106
TkTech wrote: post #89

Earlier quoted context omitted.

Personally, this is the funniest one to me. It turns out Fiverr uses cloudinary for their internal documents as well. (Note: this one is not confidential and is public information) https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...

Shows you how much these certifications are worth in reality.

Absolutely worthless pieces of paper. We had the ISO 270001 and the physical security "walk tour" or whatever it's called; I could've outsourced that to a bunch of preschoolers walking around the offices and data center rooms and would've gotten the same result. The only _actually_ working way to protect your org is to continuously attack your own systems and see what part of it breaks or leaks data.

Re: Tell HN: Fiverr left customer files public and searchable

#147

Post by tdeck »

tag2103 wrote: post #51
janoelze wrote: post #48

it's been 5 hours. even manual action to take down the most sensitive files should have completed about 3 hours ago at most. what is happening.

Nothing- they are just hoping this will blow over.

Admit no fault, ignore the criticism, keep doing the same thing, receive no consequences. I wonder how the folks at Fiverr's Tel Aviv HQ learned this strategy.

Re: Tell HN: Fiverr left customer files public and searchable

#148

Post by 21asdffdsa12 »

viaredux wrote: post #139
tdeck wrote: post #134

Earlier quoted context omitted.

Amazing that a company whose whole brand is based on hiring people for $5 turns out to not respect the workers who created value on their platform.

I get your criticism, however, there was a lot of talent working on the platform for many years. I was averaging 150 USD per project, significantly more than 5 USD. Last year Fiverr started to push AI to the detriments of their freelancers, as well as a new "success score" metric, but never specifying how these metrics are calculated, making it very hard for freelancers to do something about it. This caused many acco…

There were also a ton of ArtIsts of the "Take the job, generate it with AI, throw the slop" rip and run kind of artistry.

Re: Tell HN: Fiverr left customer files public and searchable

#149

Post by tdeck »

21asdffdsa12 wrote: post #148
viaredux wrote: post #139

Earlier quoted context omitted.

I get your criticism, however, there was a lot of talent working on the platform for many years. I was averaging 150 USD per project, significantly more than 5 USD. Last year Fiverr started to push AI to the detriments of their freelancers, as well as a new "success score" metric, but never specifying how these metrics are calculated, making it very hard for freelancers to do something about it. This caused many acco…

There were also a ton of ArtIsts of the "Take the job, generate it with AI, throw the slop" rip and run kind of artistry.

Even before AI I remember reading that many of the "custom designed" logos on Fiverr were just ripoffs of existing trademarks.

Re: Tell HN: Fiverr left customer files public and searchable

#150

Post by nkrisc »

TZubiri wrote: post #119

I don't get why disclosing is considered acceptable, it seems like racketeering to me, "pay up or else I'll make this hypothetical issue an actual issue for you" When I reported an issue and gotten no response, I sat on it for 6 years, reported it again and they took the whole site down without reaching out to me, never quite got it, but if people are doing this, it makes sense not to acknowledge any report and just…

What’s hypothetical? All this is and has been publicly accessible.

Have bad actors already found it? Who knows?

So if Fiverr isn’t going to fix it then the next best thing is to warn people.

Post reply on HN