Live data from Hacker News

Wyze security incident update

forums.wyze.com

91–100 of 161 posts

Re: Wyze security incident update

#91
post #90

> Wyze blamed "a third-party caching client library that was recently integrated into our system" for the trouble. Yes, of course. Blame a third party library which was probably created by an open source maintainer instead of testing your own systems.

Also "was recently integrated" - by ... magic?

Re: Wyze security incident update

#93
post #90

> Wyze blamed "a third-party caching client library that was recently integrated into our system" for the trouble. Yes, of course. Blame a third party library which was probably created by an open source maintainer instead of testing your own systems.

Of course, the reason this keeps happening is the infrastructure is designed to let it happen in certain cases. Notice how they explicitly say, they need to fix it in the front end. They can't fix it in the backend because that would break eavesdropping.

Re: Wyze security incident update

#94
post #90

> Wyze blamed "a third-party caching client library that was recently integrated into our system" for the trouble. Yes, of course. Blame a third party library which was probably created by an open source maintainer instead of testing your own systems.

[deleted]

Re: Wyze security incident update

#99

This actually looks like a concurrency bug in their request handling code that may have stored the user id and camera id in shared variables, under load the wrong camera id is seen by a user. At least based on the description of what they say happened.

Yeah sounds like an issue with garbage collection/freeing up memory.
Post reply on HN