Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Fiverr left customer files public and searchable

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 252 posts

Re: Tell HN: Fiverr left customer files public and searchable

#41

Post by morpheuskafka »

applfanboysbgon wrote: post #39
Loughla wrote: post #35

Earlier quoted context omitted.

So who has more incentive to lie, fiverr or OP?

Is this even a question? Obviously, the company that has publicly posted people's tax forms on the internet is very trustworthy and we should eagerly believe everything they say. I don't think it even comes down to "lying". It's possible that they genuinely believe they didn't receive contact, but given that they are verifiably completely and totally incompetent and have no right to be employed in their current role,…

@janoelze -- that was my thought too, though less so that they wouldn't share a claim of not being notified at all with a third party, but more that those kind of things need to go through legal/comms/etc not whoever runs the security mailbox. if the person running the email box is not the CISO, surely they at least need the CISOs approval to say something beyond a thank you or followup questions? (and if they are the CISO, then they have bigger things to worry about then replying...)

Re: Tell HN: Fiverr left customer files public and searchable

#43

Post by xtracto »

AndroTux wrote: post #26
walletdrainer wrote: post #18

[flagged]

It kind of is, though. Google doesn't randomly try to visit every URL on the internet. It follows links. Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.

Exactly , that's whyb"non public" github gists work. They are public, but not indexed anywhere "by default "

Re: Tell HN: Fiverr left customer files public and searchable

#44

Post by coldtea »

Loughla wrote: post #36
applfanboysbgon wrote: post #22

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.

Teachers have to be licensed and keep up on licensing. Plumbers. Electricians. Lawyers. Doctors. Hell, I have to get a license to run my own business. Why shouldn't software come with a branch for licenses if you're working with sensitive data?

We're going the other way: now any random vibe coded slop is the norm.

Re: Tell HN: Fiverr left customer files public and searchable

#45

Post by coldtea »

fnimick wrote: post #34
applfanboysbgon wrote: post #22

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.

At least I'm sure LLM tools deploying code to production won't result in this happening more frequently. "Make sure it's secure. Make no mistakes."

"You were right, mistakes have been made!"

Re: Tell HN: Fiverr left customer files public and searchable

#47

Post by trollbridge »

gregsadetsky wrote: post #33

I wrote to security@fiverr.com and they just replied: "You’re the second person to flag this issue to us Please note that our records show no contact with Fiverr security regarding this matter ~40 days ago unlike the poster claims. We are currently working to resolve the situation"

Gee, that response doesn't sound defensive at all.

Re: Tell HN: Fiverr left customer files public and searchable

#49

Post by trollbridge »

morpheuskafka wrote: post #24
applfanboysbgon wrote: post #22

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.

They may be part of it, but as a publicly traded company, there's got to be a at least a few people there with a fancy pedigree (not that that actually means they are good at their job or care). But if such a test existed, they presumably would have passed it. They also have an ISO 27001 certificate (they try to claim a bunch of AWSs certs by proxy on their security page, which is ironic as they say AWS stores most o…

A while ago I had a customer come to me who had a simple Shopify site and fell for a phishing type of attack where someone simply had an email like "shopify_security at gmail" and kept telling her she needed to apply all kinds of changes. They laundered the payments through Fiverr.

Then they would install WordPress plugins to make the site worse and claim even more "work" was needed.

I documented the entire thing, including my own credentials, and sent it off to Fiverr. Fiverr's response was everything was fine and there was nothing they could do about it, even though it was obvious fraud.

Google never did anything about it either, nor did Shopify.

Given how they handled such a minor situation like that... I guess it shouldn't be surprising they're just asleep at the switch for a major one like this.

Re: Tell HN: Fiverr left customer files public and searchable

#50

Post by trollbridge »

morpheuskafka wrote: post #38
gregsadetsky wrote: post #33

I wrote to security@fiverr.com and they just replied: "You’re the second person to flag this issue to us Please note that our records show no contact with Fiverr security regarding this matter ~40 days ago unlike the poster claims. We are currently working to resolve the situation"

I have uploaded the email here: https://gist.github.com/aidanbh/3da7cecb3e2496e5c5110b88f21b... (technically, I guess that doesn't prove anything other than it is in my Sent folder? it has a message ID but I guess only the purelymail admin could confirm that) In any event, this should never have required an outside reminder. The indexing issue may be something non obvious. But the core decision not to use signed/expi…

I've contacted fiverr before about obvious fraud being conducted through their platform, and they just sent me in endless loops of "open a ticket". "No, e-mail us about it." "No, e-mail us at our security contact about it." Crickets, and then a response saying to please open a ticket.

Basically, they aren't set up for anyone to actually contact them and expect a resolution.

Post reply on HN