3 ms·

Just make your own website, as long as you've done it before and are intimately familiar with all the dangerous defaults built in to our collective tech. Perha

by Lammy 6y ago

Just make your own website, as long as you've done it before and are intimately familiar with all the dangerous defaults built in to our collective tech. Perhaps they aimed too high too fast (dunno, never even went there), but I just can't bring myself to make beginner-shaming a core pillar of my criticism.

bobthepanda 6y ago
How many beginner websites require you to verify with your social and back and front scans of your license? There's beginner shaming and then there's going above and beyond with intrusive PII collection.
- DetroitThrow 6y ago
  There's also the aspect this was a company founded by billionaires and FAANG engineers which means an even slightly reasonable person wouldn't classify the project as one made by "beginners".
DetroitThrow 6y ago
A company founded by billionaires and FAANG engineers, operating for multiple years, and having had millions of users shouldn't be... "Beginner shamed"... for creating services wildly irresponsible with user data? Small or "beginner" web payment companies are required to think more responsibly about user data; the state of Parler in January 2021 was ridiculous and users who were effectively doxxed should be outraged.
- gabereiser 6y ago
  This. We should have higher standards to what we will tolerate from beginners. Teach and guide them to not make things open to the public. Mentor the next gen engineers on security. For god sakes check a jwt claim...
- lawnchair_larry 6y ago
  You might not realize how many companies make this mistake and worse. Dropbox? LinkedIn? What is it you think was wildly irresponsible exactly? Not stripping exif data? Facebook did that too. And has had many account takeover bugs.
JCharante 6y ago
If I was the CTO or CIO then to CYA I would pay some security consultant $700/hr for a 2hr briefing on the best practices for handling user data. A beginner should know that experts are knowledgeable, and a bunch of FAANG and VCs should have known that. Then when the consultant mentions having rate limits for media to protect against scraping, you would look into seeing if you're already doing that. It's not rocket science it's just a webapp
- nerpderp82 6y ago
  I made some photo sharing PoCs about 10 years ago. Step 1 was strip exif data at the earliest possible point. It isn't just the CEO, there were any number of people that could have applied the basic level of diligence to this problem. Clowns.
fatbird 6y ago
No entity with as much funding as Parler had is a beginner. If the actual principals are beginners, they have the wherewithal to hire seasoned experts and listen to them. Either they didn't hire them, or they didn't listen to them. The beginner's mistake isn't the technical failures of working the stack; it's the organizational failure to usefully apply millions of dollars to basic operational best practices. They're clowns, and deserve to be laughed at as such.
ashtonkem 6y ago
I wouldn’t be comfortable with “beginner shaming” a private blog. But they didn’t set out to create a blog, they set out to create a Twitter competitor. Their negligence is going to get their customers hurt and possibly jailed. I’m very comfortable condemning them for their incompetence.
kelnos 6y ago
When said "beginners"[0] are responsible for the loss of tons of private user data, I don't think that's acceptable, understandable, or easily dismissed. Perhaps shaming is not the most appropriate response, but there should be repercussions. Legal and financial ones, preferably. [0] As others pointed out in sibling comments, these people are not "beginners" by any stretch of the imagination.

by Lammy 6y ago

bobthepanda 6y ago

How many beginner websites require you to verify with your social and back and front scans of your license? There's beginner shaming and then there's going above and beyond with intrusive PII collection.

DetroitThrow 6y ago
There's also the aspect this was a company founded by billionaires and FAANG engineers which means an even slightly reasonable person wouldn't classify the project as one made by "beginners".

DetroitThrow 6y ago

A company founded by billionaires and FAANG engineers, operating for multiple years, and having had millions of users shouldn't be... "Beginner shamed"... for creating services wildly irresponsible with user data? Small or "beginner" web payment companies are required to think more responsibly about user data; the state of Parler in January 2021 was ridiculous and users who were effectively doxxed should be outraged.

gabereiser 6y ago
This. We should have higher standards to what we will tolerate from beginners. Teach and guide them to not make things open to the public. Mentor the next gen engineers on security. For god sakes check a jwt claim...
lawnchair_larry 6y ago
You might not realize how many companies make this mistake and worse. Dropbox? LinkedIn? What is it you think was wildly irresponsible exactly? Not stripping exif data? Facebook did that too. And has had many account takeover bugs.

JCharante 6y ago

If I was the CTO or CIO then to CYA I would pay some security consultant $700/hr for a 2hr briefing on the best practices for handling user data. A beginner should know that experts are knowledgeable, and a bunch of FAANG and VCs should have known that. Then when the consultant mentions having rate limits for media to protect against scraping, you would look into seeing if you're already doing that. It's not rocket science it's just a webapp

nerpderp82 6y ago
I made some photo sharing PoCs about 10 years ago. Step 1 was strip exif data at the earliest possible point. It isn't just the CEO, there were any number of people that could have applied the basic level of diligence to this problem. Clowns.

fatbird 6y ago

No entity with as much funding as Parler had is a beginner. If the actual principals are beginners, they have the wherewithal to hire seasoned experts and listen to them. Either they didn't hire them, or they didn't listen to them. The beginner's mistake isn't the technical failures of working the stack; it's the organizational failure to usefully apply millions of dollars to basic operational best practices. They're clowns, and deserve to be laughed at as such.

ashtonkem 6y ago

I wouldn’t be comfortable with “beginner shaming” a private blog. But they didn’t set out to create a blog, they set out to create a Twitter competitor. Their negligence is going to get their customers hurt and possibly jailed. I’m very comfortable condemning them for their incompetence.

kelnos 6y ago

When said "beginners"[0] are responsible for the loss of tons of private user data, I don't think that's acceptable, understandable, or easily dismissed. Perhaps shaming is not the most appropriate response, but there should be repercussions. Legal and financial ones, preferably. [0] As others pointed out in sibling comments, these people are not "beginners" by any stretch of the imagination.