3 ms·
> Don't they have any sort of vulnerability assessment or security code review? I bet people just don't realize that the frontend code could end up being a sou
by vesinisa 6y ago
> Don't they have any sort of vulnerability assessment or security code review?
I bet people just don't realize that the frontend code could end up being a source of major data confidentiality vulnerability. The threat modeling, auditing etc. usually just concentrates on attack scenarios involving the backend to save money and keep frontend development a bit lighter on the security review process side.
Does not make it excusable of course, just means their threat modeling was inadequate. But probably explains how this was able to sip into production.
- Aeolun 6y agoI dunno, you don’t need to be particularly concerned with security to understand that you do not need a facebook tracking pixel on your ‘paying customer’ UI.
- jeffasinger 6y agoFacebook will be pitching to your Marketing folks that's exactly where you need it. Facebook want data on what actions users took before signing up, which users actually signed up and started paying, and how that relates to revenue. This UI is exactly where they can determine these types of actions. Whether this actually makes Facebook better at marketing or not is a good question.
- beshrkayali 6y agoThat's why it's a killer mistake to let "marketing folk" dictate _anything_ that has to do with the app. They can suggest, but not dictate. If this points to anything it'd the dysfunctional development process at Backblaze.
- coldtea 6y ago>That's why it's a killer mistake to let "marketing folk" dictate _anything_ that has to do with the app. Killer mistake of your revenue, or killer mistake of what we'd prefer apps to be?
- dnzm 6y agoIn this case it's certainly going to cost them some revenue, not to mention the EU might slap them with a nice GDPR fine for leaking PII.