4 ms·

In the abstract, i understand, why anyone would post this. I get it, and maybe i'm getting older or something, but part of me equates posting this sort of thing

by nsfmc 16y ago

In the abstract, i understand, why anyone would post this. I get it, and maybe i'm getting older or something, but part of me equates posting this sort of thing with pointing at an acquaintance on the street with his fly down and having a laugh with your friends rather than telling him and having a chuckle after he's zipped up. But the whole self-righteous and incredibly passive-aggressive "man, i think these guys have a huge problem..." followed by the "man, these guys need to shape up" and "n00b mistake!" are unproductive to the extreme. I mean, find a bug, report it, move on. Maybe i've got some unrealistic notion of karma or general human benevolence or something, but it seems hard to believe that this is such a difficult path to take especially when nearly everyone commenting has to deal with bs of this sort day-in/out.

InclinedPlane 16y ago
This isn't a bug, it's a failure of basic security principles. Imagine if the super to your apartment complex accidentally mailed a box full of duplicate keys to a local methadone clinic. That's not an embarrassing mistake, it's a catastrophic error bordering on criminal negligence. Drawing attention to it is meant to not only deepen the embarrassment and thus encourage fixing the underlying problem so that it never happens again but also to let other people know (such as tumblr users) about the amateurishness of the tumblr operation and finally to encourage other developers out there to avoid making the same mistakes.
- smbwrs 16y ago
  You lost me at "bordering on criminal negligence". They gave away a lot of details about how their internal systems are structured, but surprisingly little as far as actual usable data. Passwords can be changed, API keys can be disabled and regenerated, local IP addresses can be switched up. No user data was revealed. How is this even close to criminal, let alone catastrophic? This is pants-down embarrassing, at worst.
  - deleted 16y ago
    [deleted]
  - zacharypinter 16y ago
    I think he was referring to his (rather extreme) metaphor which fits the phrase "bordering on criminal negligence" much more closely than tumblr: "Imagine if the super to your apartment complex accidentally mailed a box full of duplicate keys to a local methadone clinic."
  - InclinedPlane 16y ago
    I meant in reference to the analogous hypothetical. Tumblr isn't guilty of criminal negligence, but they are guilty of a very serious failing of basic security precautions. Luckily there are other layers of security at play preventing this from being a catastrophic disaster for tumblr. However, if a group of thieves break into your bank and drill into your vault you do not go home and rest easy because they only managed to drill through two feet of your vault's hardened steel and there was an entire 3 or 4 inches more. Less so if you'd done something dumb like leave the keys to the vault in a coffeeshop.
    - j2d2j2d2 16y ago
      I think you fail to give them credit for what they're attempting. Security is the focus of many readers of HN, but Tumblr's focus is the user experience. This isn't to say security isn't important, but they're rushing to make Tumblr as fun to use as possible so they can survive. Yes, they received money. They also have monstrous growth. Now they can afford to expand the engineering processes beyond, "get it working" to "make it work really well and securely". Good things are still to come from Tumblr so let's go easy on them when they use duct tape instead an arc welder.
      - nettdata 16y ago
        Security isn't something you just bolt on after the fact, it's part of the design, and involves so much more than just code. If they failed to take security into account in the early stages, never mind implement it at the beginning of development, then odds are they won't be implementing it effectively any time soon, especially with the rate at which they'll be expected to keep growing and adding functionality. This kind of issue that they're showing now could (and probably should) have been detected and handled early on, even with a simple third-party code review. And the fact that they are as big as they are, and growing as quickly as they are, means that they should have an increased sense of responsibility when it comes to security and protecting their users.
        j2d2j2d2 16y ago
        The existence of one bug doesn't imply complete disaster everywhere. It should be treated as an anecdote. Good science demands it. Good science would also suggest Tumblr should get some experts to help them discover anything else that might be lingering, which they're planning to do. Much like a peer review process. Your attitude is important for those in the security industry as it pushes things forward, but remember that not everyone has the time to spend on it that you might. It can either be an asset or the bane of your existence. As an asset, you get paid for the things you understand because others don't. As the bane of your existence, you fight society for not knowing what you know. Tumblr is hiring. Maybe you should apply and help them fix it?
- ignifero 16y ago
  You are so right. this isnt about some kiddo being a smartass by not even hiding some of the keys. It's heroes like Him who save us from catastrophic errors bordering on criminal negligence. Guys like him will descent into the Fukishima reactors to save humanity. Songs will be written to remember his life. Personally, i farted.
- deleted 16y ago
  [deleted]
revorad 16y ago
I agree with you, but the problem is we will never know about the times when others may have found a bug, reported it and moved on. In this kind of situation, it's only the negative stories which will get out.
true_religion 16y ago
If someones fly is unzipped, I'd point it out because that's the sort of accident that can happen to even the most competent and discerning. If someones pants are sagged around their knees, I expect them to have noticed this themselves, and by walking around in public they've accepted the possibility of ridicule. I consider having a non-beta site to be 'walking around in public', and revealing code and internal data (however small) when there is a malformed request to be 'walking around in public with your pants sagged at your knees'. ----- That said, rappers don't have to buy belts and maybe the culture of the 'new economy' is such that some people do not have to value security.
- aneth 16y ago
  You wouldn't take a photo and project it on a wall. You'd whisper into an ear.
adrinavarro 16y ago
Just in case… I'm really really sorry in case I shouldn't have done this. I think I already said that, but when I saw this I wasn't as lucid as I am right now and just thought about dropping it here as nobody in my twitter TL would have done anything. Yet I have worked in a lot of different environments with PHP over the time and this never happened to me (but I was close to). It's a big, big mistake, not just a tiny error.

by nsfmc 16y ago

InclinedPlane 16y ago

This isn't a bug, it's a failure of basic security principles. Imagine if the super to your apartment complex accidentally mailed a box full of duplicate keys to a local methadone clinic. That's not an embarrassing mistake, it's a catastrophic error bordering on criminal negligence. Drawing attention to it is meant to not only deepen the embarrassment and thus encourage fixing the underlying problem so that it never happens again but also to let other people know (such as tumblr users) about the amateurishness of the tumblr operation and finally to encourage other developers out there to avoid making the same mistakes.

smbwrs 16y ago
You lost me at "bordering on criminal negligence". They gave away a lot of details about how their internal systems are structured, but surprisingly little as far as actual usable data. Passwords can be changed, API keys can be disabled and regenerated, local IP addresses can be switched up. No user data was revealed. How is this even close to criminal, let alone catastrophic? This is pants-down embarrassing, at worst.
- deleted 16y ago
  [deleted]
- zacharypinter 16y ago
  I think he was referring to his (rather extreme) metaphor which fits the phrase "bordering on criminal negligence" much more closely than tumblr: "Imagine if the super to your apartment complex accidentally mailed a box full of duplicate keys to a local methadone clinic."
- InclinedPlane 16y ago
  I meant in reference to the analogous hypothetical. Tumblr isn't guilty of criminal negligence, but they are guilty of a very serious failing of basic security precautions. Luckily there are other layers of security at play preventing this from being a catastrophic disaster for tumblr. However, if a group of thieves break into your bank and drill into your vault you do not go home and rest easy because they only managed to drill through two feet of your vault's hardened steel and there was an entire 3 or 4 inches more. Less so if you'd done something dumb like leave the keys to the vault in a coffeeshop.
  - j2d2j2d2 16y ago
    I think you fail to give them credit for what they're attempting. Security is the focus of many readers of HN, but Tumblr's focus is the user experience. This isn't to say security isn't important, but they're rushing to make Tumblr as fun to use as possible so they can survive. Yes, they received money. They also have monstrous growth. Now they can afford to expand the engineering processes beyond, "get it working" to "make it work really well and securely". Good things are still to come from Tumblr so let's go easy on them when they use duct tape instead an arc welder.
    - nettdata 16y ago
      Security isn't something you just bolt on after the fact, it's part of the design, and involves so much more than just code. If they failed to take security into account in the early stages, never mind implement it at the beginning of development, then odds are they won't be implementing it effectively any time soon, especially with the rate at which they'll be expected to keep growing and adding functionality. This kind of issue that they're showing now could (and probably should) have been detected and handled early on, even with a simple third-party code review. And the fact that they are as big as they are, and growing as quickly as they are, means that they should have an increased sense of responsibility when it comes to security and protecting their users.
      - j2d2j2d2 16y ago
        The existence of one bug doesn't imply complete disaster everywhere. It should be treated as an anecdote. Good science demands it. Good science would also suggest Tumblr should get some experts to help them discover anything else that might be lingering, which they're planning to do. Much like a peer review process. Your attitude is important for those in the security industry as it pushes things forward, but remember that not everyone has the time to spend on it that you might. It can either be an asset or the bane of your existence. As an asset, you get paid for the things you understand because others don't. As the bane of your existence, you fight society for not knowing what you know. Tumblr is hiring. Maybe you should apply and help them fix it?
ignifero 16y ago
You are so right. this isnt about some kiddo being a smartass by not even hiding some of the keys. It's heroes like Him who save us from catastrophic errors bordering on criminal negligence. Guys like him will descent into the Fukishima reactors to save humanity. Songs will be written to remember his life. Personally, i farted.
deleted 16y ago
[deleted]

revorad 16y ago

I agree with you, but the problem is we will never know about the times when others may have found a bug, reported it and moved on. In this kind of situation, it's only the negative stories which will get out.

true_religion 16y ago

If someones fly is unzipped, I'd point it out because that's the sort of accident that can happen to even the most competent and discerning. If someones pants are sagged around their knees, I expect them to have noticed this themselves, and by walking around in public they've accepted the possibility of ridicule. I consider having a non-beta site to be 'walking around in public', and revealing code and internal data (however small) when there is a malformed request to be 'walking around in public with your pants sagged at your knees'. ----- That said, rappers don't have to buy belts and maybe the culture of the 'new economy' is such that some people do not have to value security.

aneth 16y ago
You wouldn't take a photo and project it on a wall. You'd whisper into an ear.

adrinavarro 16y ago

Just in case… I'm really really sorry in case I shouldn't have done this. I think I already said that, but when I saw this I wasn't as lucid as I am right now and just thought about dropping it here as nobody in my twitter TL would have done anything. Yet I have worked in a lot of different environments with PHP over the time and this never happened to me (but I was close to). It's a big, big mistake, not just a tiny error.