4 ms·

I recall seeing a talk given by Jeff Bezos years ago at some university where he described the early versions of the Amazon web site. One of the more interestin

by ziggus 5y ago

I recall seeing a talk given by Jeff Bezos years ago at some university where he described the early versions of the Amazon web site. One of the more interesting bugs was one that allowed a customer to enter a negative quantity of items to order, which meant that Amazon would credit your account and wait for you to send them the books. I think it's fixed now.

LeoPanthera 5y ago
There were web stores in the early 90s where the price of an item was contained within a hidden form field and not verified when you added it to your cart, allowing you to buy things for arbitrary prices, or sometimes zero.
- InefficientRed 5y ago
  Browser based games were another wild west. The basic move was to post something mildly controversial in your "profile page" -- which often used the MySpace style of "whatever HTML you want" -- along with a cookie logger. Then be obnoxius in chat/forums. Pretty soon, an admin would visit your profile to check out the offending content and ban your account. In the process, they would give you their admin cookie. I was a dev/admin for a few of these browser-based games and would also poke at other people's games, so I was saw both sides of the arms race. That wild west still exists in browser based games, which were labors of love with large enough user bases to keep the steam going but not commercially viable enough to justify any sort of actual investment. There are still a half dozen or so browser based games running on huge piles of PHP written by middle schoolers and high schoolers in the mid to late 2000s. Many still have XSS and SQL injections lurking in forgotten little corner features.
  - joeframbach 5y ago
    The ones I vaguely remember are AlienAA and Outwar. I can't believe these are still running. I haven't even thought about them in almost 20 years.
- philliphaydon 5y ago
  Similar with early PayPal integration. I played a mmorpg for a while and figured out that when buying credits and they sent the request to PayPal it was a post. Using Firefox tamper data I would modify the request to submit $1 and on return set it to $20. Had a similar hack occur on a clients website at work. They sold flowers I think, and gift cards. But the max value was like $30 and we got gift cards for $100/$1000 but they only paid $1. I wasn’t invoked in that bug report but I suspect it was a similar issue. The good old days.
- shepherdjerred 5y ago
  My university's webstore has this exact flaw even today
- TowerTall 5y ago
  I gave my sister a very nice upgrade on her first internet connection 25 years ago when the order form with the ISP had that the same feature. You could change the speed on any plans they offered. Ordered the cheapest plan but changed the form hidden speed field to maximum. It worked perfectly for many years without us ever being contacted by the ISP regarding this.
nlawalker 5y ago
> wait for you to send them the books I think the story was that in the really early days, orders were fulfilled by hand by humans looking at a screen or a printed page. No one was expecting to see a negative value, so in the fast-paced fulfillment workflow, the negative sign was missed or interpreted as a separator. Your account would get credited and you'd receive a book!
- PaulDavisThe1st 5y ago
  False version. The negative quantity part was partially true, but it didn't result in you getting a book. Source: guy that wrote the code.
  - hasmolo 5y ago
    this is great, i hope you don't have to work anymore!
  - xtracto 5y ago
    Thanks for JACK, Ardour and all your work in open source through the years :) > I was the 2nd programmer at Amazon, Shit... I seriously hope you got some equity haha. Right place, right time.
    - PaulDavisThe1st 5y ago
      I got enough to be able to not work for 10 years, and stayed home to raise my daughter. That was worth far more to me than the US$5B or so my stock would have been worth today, or the even larger valuation had I not left after 14 months. It's been a good life, and I'm infinitely prouder of Ardour than anything I ever did at Amazon.
bluedino 5y ago
A couple years ago I had a user report a bug where they couldn't remove items from their cart. I couldn't reproduce it. Hopped on a WebEx, and they were trying to add -1 of the item to their cart. I understood how they thought it could work, but can't recall a site where it actually worked that way.

by ziggus 5y ago

LeoPanthera 5y ago

There were web stores in the early 90s where the price of an item was contained within a hidden form field and not verified when you added it to your cart, allowing you to buy things for arbitrary prices, or sometimes zero.

InefficientRed 5y ago
Browser based games were another wild west. The basic move was to post something mildly controversial in your "profile page" -- which often used the MySpace style of "whatever HTML you want" -- along with a cookie logger. Then be obnoxius in chat/forums. Pretty soon, an admin would visit your profile to check out the offending content and ban your account. In the process, they would give you their admin cookie. I was a dev/admin for a few of these browser-based games and would also poke at other people's games, so I was saw both sides of the arms race. That wild west still exists in browser based games, which were labors of love with large enough user bases to keep the steam going but not commercially viable enough to justify any sort of actual investment. There are still a half dozen or so browser based games running on huge piles of PHP written by middle schoolers and high schoolers in the mid to late 2000s. Many still have XSS and SQL injections lurking in forgotten little corner features.
- joeframbach 5y ago
  The ones I vaguely remember are AlienAA and Outwar. I can't believe these are still running. I haven't even thought about them in almost 20 years.
philliphaydon 5y ago
Similar with early PayPal integration. I played a mmorpg for a while and figured out that when buying credits and they sent the request to PayPal it was a post. Using Firefox tamper data I would modify the request to submit $1 and on return set it to $20. Had a similar hack occur on a clients website at work. They sold flowers I think, and gift cards. But the max value was like $30 and we got gift cards for $100/$1000 but they only paid $1. I wasn’t invoked in that bug report but I suspect it was a similar issue. The good old days.
shepherdjerred 5y ago
My university's webstore has this exact flaw even today
TowerTall 5y ago
I gave my sister a very nice upgrade on her first internet connection 25 years ago when the order form with the ISP had that the same feature. You could change the speed on any plans they offered. Ordered the cheapest plan but changed the form hidden speed field to maximum. It worked perfectly for many years without us ever being contacted by the ISP regarding this.

nlawalker 5y ago

> wait for you to send them the books I think the story was that in the really early days, orders were fulfilled by hand by humans looking at a screen or a printed page. No one was expecting to see a negative value, so in the fast-paced fulfillment workflow, the negative sign was missed or interpreted as a separator. Your account would get credited and you'd receive a book!

PaulDavisThe1st 5y ago
False version. The negative quantity part was partially true, but it didn't result in you getting a book. Source: guy that wrote the code.
- hasmolo 5y ago
  this is great, i hope you don't have to work anymore!
- xtracto 5y ago
  Thanks for JACK, Ardour and all your work in open source through the years :) > I was the 2nd programmer at Amazon, Shit... I seriously hope you got some equity haha. Right place, right time.
  - PaulDavisThe1st 5y ago
    I got enough to be able to not work for 10 years, and stayed home to raise my daughter. That was worth far more to me than the US$5B or so my stock would have been worth today, or the even larger valuation had I not left after 14 months. It's been a good life, and I'm infinitely prouder of Ardour than anything I ever did at Amazon.

bluedino 5y ago

A couple years ago I had a user report a bug where they couldn't remove items from their cart. I couldn't reproduce it. Hopped on a WebEx, and they were trying to add -1 of the item to their cart. I understood how they thought it could work, but can't recall a site where it actually worked that way.