9 ms·
> anyone else, feeling a deep anger rising, when reading this in 2021? Look at most of the stories on the front-page of HN these days. Often some shiny tool to
by dreyfan 5y ago
> anyone else, feeling a deep anger rising, when reading this in 2021?
Look at most of the stories on the front-page of HN these days. Often some shiny tool to allow front-end JS devs to write and deploy full-stack applications automatically upon commit. I guarantee you they’re making similar newbie mistakes. Instead of SFTP it’ll be a serverless endpoint that returns entire User records, unhashed password and all, without any sort of auth check.
- tinco 5y agoThis has nothing to do with newbie mistakes. GoDaddy has been a household name for decades. This was not a newbie mistake, this was negligence and refusal to invest in modern technologies. I'd rather risk it with the newbies, modern stacks usually have good tutorials and standard solutions to most security sensitive problems. Last time I dodged a product because its website looked like it was designed in the early 2000's it was SolarWinds just over a year ago..
- acdha 5y agoAnd they’ve been this bad continuously since the 90s, too, so clearly the market does not have a positive feedback loop for security. I’m feeling nostalgic remembering helping clients migrate away from their breached shared hosting around the turn of the century, especially how this ended up being cheaper because GoDaddy was way over market rates.
- sombremesa 5y agoYep, just left a company where the contractors building out a core solution had just such an endpoint where you could get anyone's data, and worse, personal photos. And of course, every API key and secret was just hanging out in the repo as well.