Live data from Hacker News

Tell HN: Fiverr left customer files public and searchable

news.ycombinator.com

231–240 of 252 posts

Re: Tell HN: Fiverr left customer files public and searchable

#231

This is crazy! So many tax and other financial forms out in the open. But the most interesting file I’ve seen so far seems to be a book draft titled “HOOD NIGGA AFFIRMATIONS: A Collection of Affirming Anecdotes for Hood Niggas Everywhere”. I made it to page 27 out of 63.

Link please :pray:

Now returns Null for me, but looks like it was https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...

Also, a version of this appears to be currently sold on Amazon for $15 USD.

Re: Tell HN: Fiverr left customer files public and searchable

#233
The Cloudinary fix that nobody in this thread is naming is actually two lines. Upload the asset with type set to authenticated instead of the default upload type, and generate a signed URL server side with sign_url true whenever alogged in user requests it. Once the asset is authenticated the public URL stops resolving entirely, so even the Google indexed copies go cold. The reason Fiverr cannot just turn this on now is that they already have years of stored messages where every reference is the default public delivery type, and switching the existing media library from public to authenticated breaks every existing URL across the whole platform. That is the architectural brittleness someone upthread was pointing at, and it is also why the only realistic path forward for them is rotating new uploads to authenticated and accepting that the historical exposure is permanent. What would actually catch this category of mistake earlier, an SDK default that refused to upload anything as public unless you opt in?

Re: Tell HN: Fiverr left customer files public and searchable

#235
post #181

Earlier quoted context omitted.

> They should be fined out of existence for such breaches and they would quickly change tune. Looks like this is a great opportunity for an object lesson. Let’s see how it goes… As far as certification stuff… Civil engineering has had licensing forever. That’s because Bad Things Happen, when they make mistakes. I do think that it would be a good idea to score/certify critical infrastructure stuff. That might involve…

Also if you are personally liable of gross negligence, you will: 1. Get paid more (as less fake "engineers" are available for the responsibility). 2. Push back harder (or at least document in detail) on malpractice during development. Manager did not listen to your warnings? Document it and when shit hits the fan, the manager gets the stick instead of you. Hitting companies with monetary fines does not work. Hitting…

> Hitting companies with monetary fines does not work. Hitting the employees with jail time will make sure they don't sign on dangerous or known problematic systems.

What!? So, when you can't switch jobs because the market is bad or for any other reason, your choices are: 1) quit and lose the income (which you can't afford) or 2) sign on whatever and accept the risk of jail time?

Re: Tell HN: Fiverr left customer files public and searchable

#236
post #224

Earlier quoted context omitted.

I'm confused about what you're saying - are you saying that your parents risked getting a court summons though they weren't at fault? Surely the entire point of the court system is to determine who, if anyone, is at fault.

They didn't get a court summons but the court did call and send the plaintiff's filing. They were clearly not in the wrong in that case but it was still a hassle and quite a confusion. The point is people can sue you even if it's BS and you still need to respond. In this case leaving a paper trail of having accessed unauthorized confidential information looks a lot like being in the wrong, so the potential hassle is…

HN saves

Re: Tell HN: Fiverr left customer files public and searchable

#237

Earlier quoted context omitted.

some kind of genuine software engineering certification That only gives those in power another way to push people into toeing the line. There's enough corporate authoritarianism these days as it is already. Give Stallman's "Right to Read" a read. His dystopia is exactly where we're going to be headed quickly if we keep demanding someone to "do something". "The optimal amount of fraud is nonzero." "Those who give up f…

You're responding to literally 7 words out of context. > Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification FAANG, Fortune 500, etc., almost universally go out of their way to violate user freedom in pursuit of profit. Regulation is practically the only way to force megacorps to respect users' rights and improve their security, as evidence…

If the megacorps are going in that direction of being strictly regulated, the rest of the industry will follow. It's the general movement of the Overton Window that's the underlying issue.

Re: Tell HN: Fiverr left customer files public and searchable

#238

Earlier quoted context omitted.

You're responding to literally 7 words out of context. > Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification FAANG, Fortune 500, etc., almost universally go out of their way to violate user freedom in pursuit of profit. Regulation is practically the only way to force megacorps to respect users' rights and improve their security, as evidence…

If the megacorps are going in that direction of being strictly regulated, the rest of the industry will follow. It's the general movement of the Overton Window that's the underlying issue.

No, they won't. No one in their right mind "wants" ISO27001, ISO9001, SOC or multiple PITA certifications.

Companies do that because they want to attract certain kind of customers and have enough spare manpower and money to go through this all year long.

....or they want to hold a very sensitive data that requires *proven* processes, trainings and skills.

My firm has several of these and we have to keep full compliance team and *always* have some auditor on site.

No one does it just because.

Re: Tell HN: Fiverr left customer files public and searchable

#239

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.

Unfortunately everything is going in the opposite direction.

We are in the age of AI-slop AI-everything AI-break-it AI-fix-it.

Software companies are competing with each other on how low they can push the quality and still get away with it.

There's no reward or incentive for paying attention to the details or the quality. In fact you will get penalised for it.

Post reply on HN