3 ms·
According to Business Insider, LivingSocial's CEO's has said this is not a problem: http://www.businessinsider.com/livingsocial-server-flaw-2011-1 http://www.bu
by liuhenry 16y ago
According to Business Insider, LivingSocial's CEO's has said this is not a problem: http://www.businessinsider.com/livingsocial-server-flaw-2011-1 http://www.businessinsider.com/livingsocial-server-flaw-2011...
"Tim O'Shaughnessy: Just saw your post come through based on Martin Tobias' post and he is off on a several things, but in short, there is no widescale problem of users purchasing more than 1 gift card voucher.
Here are some specifics:
First, when a user first hits "buy", we do a pre-authorization of their card but hold off on settlement until later in the day after the deal is closed. We generally do this for a variety of reasons, but a primary reason is that if a user happens to earn that day's deal for free through our Me + 3 program, we don't want to have to charge their card back. Instead we wait to see who has earned a free deal and then process the cards.
A by-product of doing the pre-auth first and the settlement later, is that we can do server side validation (i.e. check for gamers) anytime through the day until the settlement occurs and we've reconciled the transaction. What does this mean? It means that today people who think they've "found a loophole" just haven't been told by us yet that they're violating the one purchase per person rule. We intentionally had that happen today because we expected people to game the system and didn't want to get into a game of cat and mouse all day. That 50-75% of the purchases were gamed is laughable.
The "code hack" Martin refers to changes things on the client side, but not our server side. Optically it will look like someone has changed their purchase number, but we have the number already locked on the server side."
- hdctambien 16y agoThat fact that they fixed the problem seems to be counter to the CEO's statement that it wasn't actually a problem. They clearly weren't validating all of the form inputs on the server side. Hopefully this was a learning experience for the engineering team.
- alanfalcon 16y agoYou have a 24 hour window for a deal like this and you know it costs you $10 for everyone who games the system. So you let the hackers think they've won then after the 24 hours is up, reveal that they've lost. Instead of finding creative and more difficult ways to game the system, the hackers wasted their 24 hours partying and getting drunk and so LivingSocial wins. Probably not exactly how it went down, but it's a good story.