10 ms·

Dropbike: Data Breaches and Free Bike Rides

147 points by d4l3k 8y ago

kapauldo 8y ago
Wow what a great write up. I respect your engineering and writing skills.
stockkid 8y ago
This is pretty cool. But i feel that there's nothing "show hn" about it.
- DC-3 8y ago
  Doesn't the open API library qualify? Though maybe that should be reflected in the title.
  - d4l3k 8y ago
    Sorry if it's not a traditionally formatted Show HN. However, I did write an open source version of their app while doing this. https://github.com/d4l3k/opendropbike https://github.com/d4l3k/opendropbike It's not quite production ready, but does most of the basic things.
    - Globz 8y ago
      Don’t be sorry! This is such a great write up! Thank you for sharing and I hope they realise how lucky they are that you properly disclosed BOTH vulnerabilities with a 30 days notice before public disclosure. I hope they will follow your advice, or else I believe this won’t be the last vuln of this scope to hit them if they chose to ignore good security practice!
    - stockkid 8y ago
      I think it's a great write-up. Didn't mean to disparage your work.
ttty 8y ago
great find. I guess there are so many low sec companies
warent 8y ago
How disappointing that they wouldn't even give a simple "Thank you" for you going out of your way to actually inform them. Don't they realize you could've just harvested the user contact info for a quick buck and sold a cracked version of the app for weeks/months before they realized it? Okay, good job code monkey. Now move along, we have to get back to focusing on our shitty business.
- d4l3k 8y ago
  Oh, the guy from support was fairly polite. I cut down his responses a bit for the sake of brevity but I'll clear that up. For example the initial exchange was: > Hey Tristan, thanks for reaching out to us about this. We really appreciate you telling us about this. We don't have a bug bounty scheme, but I've forwarded your feedback to our software team. Thanks again, Tristan.
- questionasked 8y ago
  Out of interest, how does one go about selling user contact info like that?
tomglynch 8y ago
Can't access the link - any one provide a mirror for me?
- tomglynch 8y ago
  Mirror: https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/ https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/
- saagarjha 8y ago
  https://fn.lc/post/dropbike/ https://fn.lc/post/dropbike/
hardwaresofton 8y ago
This is super tangential to the content of the post, but can we take a moment to bask in the use of React Native here -- and the fact that it wasn't obvious it was a React Native app until the OP took the app apart? Solutions like React Native, NativeScript and Flutter are providing real developers alternatives to trudging through bullshit on two separate app platforms just to deliver a similar looking experience to two walled gardens. This makes me happy. BTW - I'm not even a React fan, I think it's over-engineered/not as simple as it should be. However it is/was a paradigm-shift type project and the divorce from the DOM model to enable support for something like React Native was a great move as well.
- ReverseCold 8y ago
  You can tell it's react native if it lags (at all). No native app should lag on a modern phone. I wrote an app that locally loops over 5MB of JSON and then sorts it based on a datetime string (which is converted to a date class) - and it does this every few seconds. You can't tell that this is happening though, because the phone doesn't lag. It doesn't even use a significant amount of battery. It just works. I wrote the same app in React Native + NativeBase earlier, and even though I implemented that in a smarter way, the app still lagged. Even just a general react native app that doesn't do anything weird just feels "off" sometimes. Source: Wrote the same app 4 times (Swift, Java, React Native, Flutter) - Flutter was the clear winner, and a joy to work with.
  - jtchang 8y ago
    Did you see any lag when using Flutter?
    - ReverseCold 8y ago
      The "hot-reload" development builds (which I think run JIT) definitely do lag, but my production bundle is almost indistinguishable from a native app.
      - hardwaresofton 8y ago
iask 8y ago
Nice work! Dropbike - send this candidate an email saying “You, sir, are hired”.
deleted 8y ago
[deleted]
kibwen 8y ago
I'm going to tip my hand here and admit that I upvoted this before ever reading the post simply because I've never seen an IPFS link in the wild before. :)
- favadi 8y ago
  ... and the page doesn't load for me at this moment.
  - d4l3k 8y ago
    You can also access it via the normal website: https://fn.lc/post/dropbike/ https://fn.lc/post/dropbike/ (or via AMP cache: https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/ https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/) I've had IPFS support on my website for a while now and figured since one of the top HN posts was about porting a blog to IPFS I'd share the IPFS link.
  - tudelo 8y ago
    Loads for me :)
  - geerlingguy 8y ago
    Yeah... just sits loading forever here too.
  - prophesi 8y ago
    Yeah, ipns links are pretty slow compared to ipfs links. The best practice is to have a domain using dnslink[0] which always points to the most recent IPFS hash on a gateway with the content already pinned. I believe this is what the IPFS team does for their blog, using a combination of a static site generator and web hooks. [0]: https://github.com/ipfs/go-dnslink https://github.com/ipfs/go-dnslink
    - d4l3k 8y ago
      Oh, that's pretty neat! I hadn't seen that before. Does dnslink work with browsers at all?
Smushman 8y ago
Nicely done friend! Learned everything from your writeup too!
lgierth 8y ago
Link without IPNS, for those who hit cold caches: - https://ipfs.io/ipfs/QmTUZvRskteBwACHPAepefPLDKhJctWmY6E2XJG9v78oij https://ipfs.io/ipfs/QmTUZvRskteBwACHPAepefPLDKhJctWmY6E2XJG... - ipfs://QmTUZvRskteBwACHPAepefPLDKhJctWmY6E2XJG9v78oij (with ipfs-companion)
- d4l3k 8y ago
  The issue with just sharing the /ipfs/ version instead of /ipns/ is that I can no longer update the site and I just made a small edit to clarify some stuff so that link is already out of date. As an alternative, I'd recommend either my website: https://fn.lc/post/dropbike/ https://fn.lc/post/dropbike/ or the cloudflare AMP cache https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/ https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/
  - lgierth 8y ago
    You're right - I basically timestamped the then-current version of the name into a hacker news comment :)
  - deleted 8y ago
    [deleted]
HiroshiSan 8y ago
This is a great example of one of the pitfalls of iterating quickly if not done properly.
Semaphor 8y ago
Sorry for the tangent, but I find it highly ironic that an ipfs site does not work without allowing "ampproject.org"…

147 points by d4l3k 8y ago

kapauldo 8y ago

Wow what a great write up. I respect your engineering and writing skills.

stockkid 8y ago

This is pretty cool. But i feel that there's nothing "show hn" about it.

DC-3 8y ago
Doesn't the open API library qualify? Though maybe that should be reflected in the title.
- d4l3k 8y ago
  Sorry if it's not a traditionally formatted Show HN. However, I did write an open source version of their app while doing this. https://github.com/d4l3k/opendropbike https://github.com/d4l3k/opendropbike It's not quite production ready, but does most of the basic things.
  - Globz 8y ago
    Don’t be sorry! This is such a great write up! Thank you for sharing and I hope they realise how lucky they are that you properly disclosed BOTH vulnerabilities with a 30 days notice before public disclosure. I hope they will follow your advice, or else I believe this won’t be the last vuln of this scope to hit them if they chose to ignore good security practice!
  - stockkid 8y ago
    I think it's a great write-up. Didn't mean to disparage your work.

ttty 8y ago

great find. I guess there are so many low sec companies

warent 8y ago

How disappointing that they wouldn't even give a simple "Thank you" for you going out of your way to actually inform them. Don't they realize you could've just harvested the user contact info for a quick buck and sold a cracked version of the app for weeks/months before they realized it? Okay, good job code monkey. Now move along, we have to get back to focusing on our shitty business.

d4l3k 8y ago
Oh, the guy from support was fairly polite. I cut down his responses a bit for the sake of brevity but I'll clear that up. For example the initial exchange was: > Hey Tristan, thanks for reaching out to us about this. We really appreciate you telling us about this. We don't have a bug bounty scheme, but I've forwarded your feedback to our software team. Thanks again, Tristan.
questionasked 8y ago
Out of interest, how does one go about selling user contact info like that?

tomglynch 8y ago

Can't access the link - any one provide a mirror for me?

tomglynch 8y ago
Mirror: https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/ https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/
saagarjha 8y ago
https://fn.lc/post/dropbike/ https://fn.lc/post/dropbike/

hardwaresofton 8y ago

This is super tangential to the content of the post, but can we take a moment to bask in the use of React Native here -- and the fact that it wasn't obvious it was a React Native app until the OP took the app apart? Solutions like React Native, NativeScript and Flutter are providing real developers alternatives to trudging through bullshit on two separate app platforms just to deliver a similar looking experience to two walled gardens. This makes me happy. BTW - I'm not even a React fan, I think it's over-engineered/not as simple as it should be. However it is/was a paradigm-shift type project and the divorce from the DOM model to enable support for something like React Native was a great move as well.

ReverseCold 8y ago
You can tell it's react native if it lags (at all). No native app should lag on a modern phone. I wrote an app that locally loops over 5MB of JSON and then sorts it based on a datetime string (which is converted to a date class) - and it does this every few seconds. You can't tell that this is happening though, because the phone doesn't lag. It doesn't even use a significant amount of battery. It just works. I wrote the same app in React Native + NativeBase earlier, and even though I implemented that in a smarter way, the app still lagged. Even just a general react native app that doesn't do anything weird just feels "off" sometimes. Source: Wrote the same app 4 times (Swift, Java, React Native, Flutter) - Flutter was the clear winner, and a joy to work with.
- jtchang 8y ago
  Did you see any lag when using Flutter?
  - ReverseCold 8y ago
    The "hot-reload" development builds (which I think run JIT) definitely do lag, but my production bundle is almost indistinguishable from a native app.
    - hardwaresofton 8y ago

iask 8y ago

Nice work! Dropbike - send this candidate an email saying “You, sir, are hired”.

deleted 8y ago

[deleted]

kibwen 8y ago

I'm going to tip my hand here and admit that I upvoted this before ever reading the post simply because I've never seen an IPFS link in the wild before. :)

favadi 8y ago
... and the page doesn't load for me at this moment.
- d4l3k 8y ago
  You can also access it via the normal website: https://fn.lc/post/dropbike/ https://fn.lc/post/dropbike/ (or via AMP cache: https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/ https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/) I've had IPFS support on my website for a while now and figured since one of the top HN posts was about porting a blog to IPFS I'd share the IPFS link.
- tudelo 8y ago
  Loads for me :)
- geerlingguy 8y ago
  Yeah... just sits loading forever here too.
- prophesi 8y ago
  Yeah, ipns links are pretty slow compared to ipfs links. The best practice is to have a domain using dnslink[0] which always points to the most recent IPFS hash on a gateway with the content already pinned. I believe this is what the IPFS team does for their blog, using a combination of a static site generator and web hooks. [0]: https://github.com/ipfs/go-dnslink https://github.com/ipfs/go-dnslink
  - d4l3k 8y ago
    Oh, that's pretty neat! I hadn't seen that before. Does dnslink work with browsers at all?

Smushman 8y ago

Nicely done friend! Learned everything from your writeup too!

lgierth 8y ago

Link without IPNS, for those who hit cold caches: - https://ipfs.io/ipfs/QmTUZvRskteBwACHPAepefPLDKhJctWmY6E2XJG9v78oij https://ipfs.io/ipfs/QmTUZvRskteBwACHPAepefPLDKhJctWmY6E2XJG... - ipfs://QmTUZvRskteBwACHPAepefPLDKhJctWmY6E2XJG9v78oij (with ipfs-companion)

d4l3k 8y ago
The issue with just sharing the /ipfs/ version instead of /ipns/ is that I can no longer update the site and I just made a small edit to clarify some stuff so that link is already out of date. As an alternative, I'd recommend either my website: https://fn.lc/post/dropbike/ https://fn.lc/post/dropbike/ or the cloudflare AMP cache https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/ https://fn-lc.amp.cloudflare.com/c/s/fn.lc/post/dropbike/
- lgierth 8y ago
  You're right - I basically timestamped the then-current version of the name into a hacker news comment :)
- deleted 8y ago
  [deleted]

HiroshiSan 8y ago

This is a great example of one of the pitfalls of iterating quickly if not done properly.

Semaphor 8y ago

Sorry for the tangent, but I find it highly ironic that an ipfs site does not work without allowing "ampproject.org"…