Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Airbnb on Android just send a “Test, Test dev" push notification message

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 100 posts

Re: Airbnb on Android just send a “Test, Test dev" push notification message

#81

Post by TheAceOfHearts »

woevdbz wrote: post #77
5tormTrooper wrote: post #72

Somewhere a junior is sweating buckets.

Maybe. But given the culture at most of these places I'd expect the junior to be explained that it's ok, everybody makes mistakes. Some engineering manager is probably sweating bigger buckets over their failure to properly secure casual human access to prod stuff, which is definitely not ok. Meanwhile the both of them are really really relieved that the notification contents were completely innocuous and not some sic…

The only cause for outrage would be if someone got fired for what appears to be an honest mistake.

Re: Airbnb on Android just send a “Test, Test dev" push notification message

#83

Post by joper90 »

TheAceOfHearts wrote: post #81
woevdbz wrote: post #77

Earlier quoted context omitted.

Maybe. But given the culture at most of these places I'd expect the junior to be explained that it's ok, everybody makes mistakes. Some engineering manager is probably sweating bigger buckets over their failure to properly secure casual human access to prod stuff, which is definitely not ok. Meanwhile the both of them are really really relieved that the notification contents were completely innocuous and not some sic…

The only cause for outrage would be if someone got fired for what appears to be an honest mistake.

Unless its the CIO/CSO for shite secret management policies.

Re: Airbnb on Android just send a “Test, Test dev" push notification message

#84

Post by axby »

joper90 wrote: post #71

This to me means the devs have access to the prod keys, even to the external services... not good.

How big is their dev team? Does their app change much? Could they have contracted it out and now only have one or two people who still push updates to it?

Re: Airbnb on Android just send a “Test, Test dev" push notification message

#85

Post by joper90 »

axby wrote: post #84
joper90 wrote: post #71

This to me means the devs have access to the prod keys, even to the external services... not good.

How big is their dev team? Does their app change much? Could they have contracted it out and now only have one or two people who still push updates to it?

its AirBnB.. they should have this stuff sorted! Dev/prod should be completely separate with the vaults/secrets management in prod having the correct keys with only a few peeps having access (in a break glass situation). Dev's should not have the keys to put into code to push to a prod external service...

There is zero reason why any dev (or worse external dev team) should have access to prod secrets, or the ability to push out via prod. (unless someone cocked up the config for the dev/staging push notification tooling, again requires a level of access)

Re: Airbnb on Android just send a “Test, Test dev" push notification message

#86

Post by woevdbz »

SoeMyzlack wrote: post #34
axby wrote: post #22

Earlier quoted context omitted.

Interesting, but why would an attacker push a notification like this to so many people? Or did not many people get it? Could I be targeted, along with the others in this thread? If the attacker really intended to send the notification to everyone (or even 10%), wouldn't that very likely get the attention of Airbnb, and then they'd know about the issue and be able to mitigate it? Edit: assuming everyone got it, this s…

Could be a POC for an attacker. If they got the ability to send out custom push notifications in the future they could contain malicious links.

If it was a poc they just lost the ability to build the real attack by being way too noticeable. This issue has likely already been mitigated and will be patched up within days if not hours. Much more likely to be an honest mistake.

Re: Airbnb on Android just send a “Test, Test dev" push notification message

#87

Post by alefith »

Everyone is blaming the process, secrets of prod etc. I'm saying, there's a test campaign problem, or, more probably, a lack of a human tester. Someone made a test in dev, it got put to the test, and wen through to prod. No real security leak or anything, just a product not properly tested. Like 99% of the internet. Who has the time and money to refactor, doc and test?

It's like climate change: let's all drive full speed into a wall, while tinkering with the stereo system of the car.

Post reply on HN