5 ms·

This super smart team didn't even know how to configure Cloudflare. Non-US access got blocked with a captcha. This same company disabled downloading their app i

This super smart team didn't even know how to configure Cloudflare. Non-US access got blocked with a captcha. This same company disabled downloading their app if you weren't in the US. And then the site would plaster big scary banners telling you a ZIP code was mandatory and if you weren't in the US, beware! Who comes up with this stuff? Somehow, with all that money raised, they failed to realise there'd be some customers using freight forwarders. When I went to purchase, the site stopped working, just providing some sort of generic error page. I called them up. A lady told me they were "performing maintenance" (middle of day). The website provided zero indication; just appeared broken. Shipping took a while. I'm certain they have smart people. But my anecdotal experience was that things were a bit clueless and not even remotely close to the level of taking on Amazon in any way.

notyourwork 10y ago
You seem to forget its a startup and not a well oiled industry giant that has been around for ~20 years. Maintenance to fix a security critical bug in the middle of the day to remain in compliance for credit card processing could have been a reason for this nuisance. Lots of factors and variables.
nommm-nommm 10y ago
>Non-US access got blocked with a captcha Walmart.com blocks the VPN I use with a generic 403 Forbidden.
fowlerpower 10y ago
I'm not sure I understand, or rather I don't think you understand their business model... I think they set up their CloudFlare 100% correctly. Jet does not sell outside the U.S., they have no plans to ever sell outside they U.S. Most of the cyber attacks against them are from outside the U.S. Their entire business plan is cutting cost out of the supply chain inside the U.S. By bundling items together in the same box and saving the consumer in the U.S. Money. The entire point is to reduce the risk footprint, when most startups are being hacked left and right jet is being very smart by throwing captchas and saying to everyone outside the U.S. we don't want your scammy business.
- MichaelGG 10y ago
  They do sell to people that are outside of the US. They just sell via freight forwarders. In Central America (and probably all over) there are many businesses that exist entirely to service customers. The biggest bank in the country I'm in now (Guatemala) gives people credit cards and a Miami address specifically marketed to buy stuff off Amazon. You'd think with all that money spent, they'd have recognized this. FWIW, they eventually fixed it, a week or two (or so) after several poorly-written emails I sent them. So I think it is more likely to be the result of bad thinking, or just being unaware of the situation. Furthermore, if their anti-hacking defense relies on a captcha or not being able to easily download their app, they're beyond screwed. I don't think they are that incompetent, it might have been, at best, oversight. Probably the fault is at least partially on Cloudflare, though. Trump's read-only campaign website throws up a captcha at least to Guatemala. And GT isn't known as a centre of any hackers, to say the least. So if they have high profile sites like that which are misconfigured, perhaps they don't do enough review or customer education.
  - fowlerpower 10y ago
    The captchas serve to stop bot nets and DDoS attackers who are all over the world. It is why many sites throw those up. It is not a miss configuration. It is a smart move.
    - MichaelGG 10y ago
      It is 100% the wrong thing to do. On a static page like Trump's website, it is absolutely unacceptable that it ever shows a captcha to obtain readonly information. They are already handling the TCP connection, they are sending back the static assets (custom error page). They just don't send the main content. Unless it's under a current attack, and even then it should go by IP or something. Visiting from an IP never used before should now throw up a captcha. Nor should it continue to do so on repeated visits. It's broken, full stop. Edit: I mention Trump's site because it's a reasonably high profile, static, site that I've seen CF blocking on. Also, FWIW, after I sent several emails to Jet, they seemed to reverse course and their app and site are available. Seems like an oversight/not knowing to me. CF's defaults are not very good so they probably didn't change them. CF should review their customers and suggest better defaults, at least to high end clients.

notyourwork 10y ago

You seem to forget its a startup and not a well oiled industry giant that has been around for ~20 years. Maintenance to fix a security critical bug in the middle of the day to remain in compliance for credit card processing could have been a reason for this nuisance. Lots of factors and variables.

nommm-nommm 10y ago

>Non-US access got blocked with a captcha Walmart.com blocks the VPN I use with a generic 403 Forbidden.

fowlerpower 10y ago

I'm not sure I understand, or rather I don't think you understand their business model... I think they set up their CloudFlare 100% correctly. Jet does not sell outside the U.S., they have no plans to ever sell outside they U.S. Most of the cyber attacks against them are from outside the U.S. Their entire business plan is cutting cost out of the supply chain inside the U.S. By bundling items together in the same box and saving the consumer in the U.S. Money. The entire point is to reduce the risk footprint, when most startups are being hacked left and right jet is being very smart by throwing captchas and saying to everyone outside the U.S. we don't want your scammy business.

MichaelGG 10y ago
They do sell to people that are outside of the US. They just sell via freight forwarders. In Central America (and probably all over) there are many businesses that exist entirely to service customers. The biggest bank in the country I'm in now (Guatemala) gives people credit cards and a Miami address specifically marketed to buy stuff off Amazon. You'd think with all that money spent, they'd have recognized this. FWIW, they eventually fixed it, a week or two (or so) after several poorly-written emails I sent them. So I think it is more likely to be the result of bad thinking, or just being unaware of the situation. Furthermore, if their anti-hacking defense relies on a captcha or not being able to easily download their app, they're beyond screwed. I don't think they are that incompetent, it might have been, at best, oversight. Probably the fault is at least partially on Cloudflare, though. Trump's read-only campaign website throws up a captcha at least to Guatemala. And GT isn't known as a centre of any hackers, to say the least. So if they have high profile sites like that which are misconfigured, perhaps they don't do enough review or customer education.
- fowlerpower 10y ago
  The captchas serve to stop bot nets and DDoS attackers who are all over the world. It is why many sites throw those up. It is not a miss configuration. It is a smart move.
  - MichaelGG 10y ago
    It is 100% the wrong thing to do. On a static page like Trump's website, it is absolutely unacceptable that it ever shows a captcha to obtain readonly information. They are already handling the TCP connection, they are sending back the static assets (custom error page). They just don't send the main content. Unless it's under a current attack, and even then it should go by IP or something. Visiting from an IP never used before should now throw up a captcha. Nor should it continue to do so on repeated visits. It's broken, full stop. Edit: I mention Trump's site because it's a reasonably high profile, static, site that I've seen CF blocking on. Also, FWIW, after I sent several emails to Jet, they seemed to reverse course and their app and site are available. Seems like an oversight/not knowing to me. CF's defaults are not very good so they probably didn't change them. CF should review their customers and suggest better defaults, at least to high end clients.