Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never Give Your Information To 10 Minute Old Startups

blog.ryankearney.com

Post reply on HN
Print view View original

81–90 of 185 posts

Re: Never Give Your Information To 10 Minute Old Startups

#81

Post by adgar2 »

[deleted] wrote: post #79
adgar2 wrote: post #47

Earlier quoted context omitted.

I had to look up WePay on Google. The wikipedia page says they have 30 employees as of a year ago, did YC and 1 round of funding. I have to be honest - that doesn't demonstrate a high level of trust at all these days. It's sad, but true. Plus, if you say they're "ex-WePay," I assume they were just everyday developers for WePay, not critical resources.

[deleted]

> Assumptions make a...

"Head of Product" sounds like a product manager, it doesn't even sound like an engineer at all - this makes it even less surprising that these pathetic security holes existed.

Just to be clear, that means my assumptions you lambasted were generous. Not folly.

Re: Never Give Your Information To 10 Minute Old Startups

#82

Post by adgar2 »

larrys wrote: post #62
Silhouette wrote: post #22

10 minutes? Never give your information to a business that made a mistake like this, ever . That wasn't merely a "security vulnerability". It was also a demonstration that the people running the business have absolutely no idea what they are doing when it comes to security, privacy, or testing and release processes. (Actually, there is an alternative explanation, which is even worse: they knew and didn't care. I pref…

"Never give your information to a business that made a mistake like this, ever." Fwiw back in 1996 or 97 the UPS website did the same thing. By altering the tracking number you could see somewhat complete information on someone else's shipment. Since the tracking numbers ran in sequence from the shippers log books giving one tracking number from a competitor you could see all their customers. (To get that all you had…

All I can say to that is thank Christ it's not 1996 anymore.

Re: Never Give Your Information To 10 Minute Old Startups

#83

Post by ainsleyb »

JoeCortopassi wrote: post #40

Everyone here that is thinking of giving this company the benefit of the doubt needs to go read their (smeagle) responses to RKearney from the original thread. Here are some samples of the careless attitude behind this: ---- "if anyone's concerned about your AWS key, just destroy your IAM user and create a new one. that's what it was designed for." ---- In response to advice saying they should notify users by email:…

This is a severe lack of customer service. The least that can be done is a quick shutdown of the site until there's a good fix, an email to all customers (since legally they have to disclose the breach: http://en.wikipedia.org/wiki/Security_breach_notification_la...), and a thanks out to whomever reported the issue.

If you make a mistake, own up to it. Honesty is the best key to building a business, and I'm sure they've at least lost the HN trust for any product in the future.

Re: Never Give Your Information To 10 Minute Old Startups

#84

Post by AVTizzle »

adriand wrote: post #43
smeagol wrote: post #34

Earlier quoted context omitted.

we're incredibly sorry about all of this. honestly, this was all accidental. it was a pet project we started to toy with Glacier and a week later i accidentally hit the Like button sending a ping to my friends on FB. bless my friends for being so influential i guess. shame on us for using Rails carelessly. if you have any experience with startups, you'll know that 99% of the things you launch go nowhere--this project…

Classy response. Now here's your chance to take lemons and make lemonade. Clearly your pet project is something that people find really interesting and useful. So it went public before you intended and had some security flaws: oh well, that's in the past now. Write your mea culpa about how much you learned from this experience, hit the front page of HN again, sign up a bunch of users, and go get some venture capital.…

Couldn't agree more. There is a silver lining here is thick. Leverage it and win.

Re: Never Give Your Information To 10 Minute Old Startups

#85

Post by eagsalazar »

Well to be fair, people who gave their real AWS keys also acted as, if not more, foolishly than the devs.

From amazon: "For your protection, you should never share your secret access keys with anyone. In addition, industry best practice recommends frequent key rotation.

Learn more about Access Keys"

USE IAM USERS

Re: Never Give Your Information To 10 Minute Old Startups

#86

Post by adgar2 »

merijn481 wrote: post #55
merijn481 wrote: post #48

Ryan, your post is NOT an example of responsible disclosure. You could have written your post and posted it AFTER alerting the Ice Box Pro guys and waiting until they had the main issues fixed. Your post would still be a good post. In fact, you seem to weigh the importance of your post getting on HackerNews above the security of the people who tried Ice Box Pro. The creators of Ice Box Pro had good intentions and mes…

Ah, I see you did let them know and the vulnerability was fixed before you posted. Good. I recommend saying such a thing in your post because it helps people like me understand that you are in fact responsible about the disclosure.

According to timestamps, it took ~5 minutes for you to realize your mistake. It may be worth waiting those five minutes before posting, in the future.

Re: Never Give Your Information To 10 Minute Old Startups

#87

Post by spamizbad »

adgar2 wrote: post #6

It might be time for pg and co. to reconsider the idea that engineering doesn't matter and that startups are just about people. This is pathetic .

Honestly, this isn't even a matter of engineering.

I don't know the rails solution, but a quick-and-dirty solution in other frameworks is to use a decorator on your controller/views that does something like:

  if request.session.userId == action.userId:
    pass
  else:
    return SecurityExceptionResult
The example above is like 10 mins to code and put under test once you fill it in with the necessary stuff- You're probably going to want to log would-be security issues and gracefully handle the error.

With that said, user-identity does not belong in a URL. If you just did /user/edit (we assume all operations are performed on the logged in user) and then moved your security validation down a level to verify that session.userId == model.record.userId you'd be much better off.

Re: Never Give Your Information To 10 Minute Old Startups

#89

Post by ainsleyb »

sergiotapia wrote: post #59

Holy shit! I consider myself a mediocre programmer at best and even I wouldn't make such a dumb mistake. This is literally something only a amateur would do. I'm just awe struck that this would even happen. How?

What we've found is that there are 2 mindsets: building and breaking. When you're building a product it's super hard to switch to the breaking mindset of security, simply because mental context switching is expensive and mentally exhausting. The most important thing is to force yourself into that mode before posting anything publicly. If you don't have the security experience, have a friend or service (like ours) look it over. Data is one of the most important assets to your company (or project), and any sort of disclosure can shut you down permanently.

Re: Never Give Your Information To 10 Minute Old Startups

#90

Post by seldo »

Those who know me will laugh to see me continuing to beat this dead horse, but this is a really great example of why ORM+scaffolding is an anti-pattern, by which I mean it seems like a good idea at first, but the costs outweigh the benefits.

It's absolutely true that you can use ORM and scaffolding patterns in a totally secure way. But the problem is that the defaults are insecure -- every table can be accessed, every record is available, every field can be edited, and the URLs for doing so are (deliberately) easily guessable.

One of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration. Scaffolding breaks that rule.

Post reply on HN