4 ms·

Did you or your friend happen to report this to them before posting it here?

• oldgregg 19y ago
  yeah he said he told them. I would have more sympathy if it was an obscure hole, but something this big is just disrespectful to their users.
  • pius 19y ago
    This is a pretty critical exploit . . . you'd think they'd take the app down or at least change the admin URL while this is resolved. I shouldn't at this moment still be able to reset an arbitrary user's password by going to that URL.
    • oldgregg 19y ago
      ...and how many people have found it and not said anything? we've all used poorly secured admins here and there, but /admin seems particularly egregious.
      • pius 19y ago
        ...and how many people have found it and not said anything? Scary.
        • simen 19y ago
          It was only open for an hour.
          • pius 19y ago
            No, it was only open and public for an hour. It could have been open for months, maybe longer.
            • simen 19y ago
              It was the result of a change today, right before it hit Hacker News (so sayeth Marco of tumblr in the #tumblrs irc channel, anyway; I believe him).
              • pius 19y ago
                Ah.
              • jlam 19y ago
                As we know, hackers regularly turn random door knobs to see which doors open. Logs i can see show more black hat attempts than white hat, so either OldGregg's friend got lucky or a few exploits might have already been made.
  • sanswork 19y ago
    Cool just making sure because it is still up and you would assume something like this would be taken down immediately.
  • snorkel 19y ago
    Disrespectful to their users? Tumblr is free. I don't think they owe their users absolute iron clad security.