Live data from Hacker News

OkCupid's “Removed” Visitor API

zdware.com

61–70 of 91 posts

Re: OkCupid's “Removed” Visitor API

#61
post #29

The thing that impresses me most is how quickly OkCupid removed public access to that API.

Eh, comment out a route and deploy.

That's all well and good for a tech demo, but things rarely seem to be that simple in systems as big/old as OkCupid. I guess this time, it was.

Re: OkCupid's “Removed” Visitor API

#62
post #16

Earlier quoted context omitted.

I have to wonder how effective paying for a dating site really is. Presumably if you find a partner through the site you stop paying? Aside from a token few they can blog about, what's their incentive to be successful?

OKCupid actually did a blog post about this, which they have since deleted. Here's a copy of it. http://static.izs.me/why-you-should-never-pay-for-online-dat...

[deleted]

Re: OkCupid's “Removed” Visitor API

#63

Earlier quoted context omitted.

It's certainly not outlandish that this happened. Have you never been employed as a programmer?

I am, and have been. That's why it's so outlandish to me - I keep user data in mind all the time. Finding out you're leaking sensitive personal data is a slippery slope I (nor my clients) want to go down. Are you implying that it's not outlanding for professional programmers to not have these things in mind?

Data leaks like these happen with some frequency, which is why they are not outlandish.

> That's why it's so outlandish to me - I keep user data in mind all the time.

You keeping data in mind has no bearing on whether or not data leaks are outlandish. You don't seem to understand what the word means, tbh.

> Are you implying that it's not outlanding for professional programmers to not have these things in mind?

No, I directly implied that your real or feigned surprise at this happening makes it look like you don't understand the industry. If you're familiar with the industry it shouldn't be a surprise that this happens.

Re: OkCupid's “Removed” Visitor API

#65
post #53

"stalk_time" makes me feel very uncomfortable. Names matter.

The original name of the feature actually was "stalkers" — that's how it was presented to users before 2010 or so. The site had a lot of dark humor then. The word "stalk" also works as a clarifying synonym for "visit" in the code because "visit" could refer e.g. to the user's visit to the site itself.

Re: OkCupid's “Removed” Visitor API

#66
post #53

"stalk_time" makes me feel very uncomfortable. Names matter.

The original name of the feature actually was "stalkers" — that's how it was presented to users before 2010 or so. The site had a lot of dark humor then. The word "stalk" also works as a clarifying synonym for "visit" in the code because "visit" could refer e.g. to the user's visit to the site itself.

The payload for the visitor API payload was an object containing an array whose key was `stalkers`, so still the same!

Re: OkCupid's “Removed” Visitor API

#67
post #44

About seven years ago I met my wife on OkCupid. The only reason why I messaged her back (after had messaging with her several months earlier) was because of the frontend visitor feature. She had visited my profile randomly again. Turns out she said she accidentally clicked on to my profile intended to see someone else. I haven't used OkC since then, but I thought I'd share that in the context of this blog post ;-)

That's pretty awesome!

The site has changed quite a bit then. Now you would of never been able to message her unless she "liked" you.

Re: OkCupid's “Removed” Visitor API

#68
post #59

Earlier quoted context omitted.

mind elaborating?

I assume they mean the radius was a parameter in the URL so changing it was easy, e.g. replace &search_radius=5 with &search_radius=1.

What I'm asking is what parameter are they changing to look at the hottest people.

Re: OkCupid's “Removed” Visitor API

#69
post #44

About seven years ago I met my wife on OkCupid. The only reason why I messaged her back (after had messaging with her several months earlier) was because of the frontend visitor feature. She had visited my profile randomly again. Turns out she said she accidentally clicked on to my profile intended to see someone else. I haven't used OkC since then, but I thought I'd share that in the context of this blog post ;-)

I have a similar story. My current girlfriend was living in another city about three hours away, I never would have seen her profile in my possible "matches" because I wasn't looking in that city. She did a search query for an author we both like, and my profile came up. If she didn't "visit" my profile and pique my interest I likely never would've met her! I'm sad to think that with the changes OKC have made recently (haven't used it since I met my GF obviously) people will have less luck finding people. They want to turn it into a Tinder clone.

Re: OkCupid's “Removed” Visitor API

#70

> However, they gave no answer for why unnecessary data was being provided. I mean, it was obviously a bug, right? I imagine the only "explanation" would involve detailing the origin and nature of the bug which would be unwise until they've gone through all their other endpoints to ensure that there's not another instance of this same information leaking.

I don’t think that this was a bug. Most probably, they have those DTO objects for viewing and editing. In that scenario the correct thing to do would be to create a new DTO object that exposes only the necessary information, but this is an extra effort.
Post reply on HN