3 ms·

I's kind of incredible how common this specific kind of vulnerability is. I have to assume the developers of these systems just hope that no one will notice?

crecker 4y ago
I'm not the author of the article. But I think developers thought "ahaha who's going to checkout? Someone that has developer tools in airplane? Good joke bob!"
HideousKojima 4y ago
Just because a vulnerability is common and easy to avoid won't stop lazy and/or incompetent devs from making it. I mean SQL injection is still incredibly common despite being easily mitigated by really basic knowledge and despite being handled properly by the most common data access libraries in every single programming language.
amackera 4y ago
These types of fails are generally due to incompetence, in my experience.
- jaywalk 4y ago
  This one is 100% due to incompetence. There was no attempt at anything resembling security.
  - hackbinary 4y ago
    I'm not sure what your experience is, but mine is over multiple decades over multiple companies over multiple continents, and in general, corporate management, project management, and business analysts are not concerned about security. Instead, they are interested in delivering buttons, fields, and streamlined workflows. Technical debt and library upgrades? Os upgrades? Forget about it. They need to deliver value back to the business in terms of faster business processes. Only when the business is hacked or they fail compliance does the business leadership start to care. Blaming the people with the hands on the tools is not fair when the business will not give the resources to do their work properly.
    - 20after4 4y ago
      This is sadly 100% accurate, in my experience.
brazzy 4y ago
No, the developers simply don't realize that there is a vulnerability, even though they have the required knowledge because they look at the code with the "how do I implement this feature" mindset (which is their job), not a "how could this be abused" mindset.
- marapuru 4y ago
  In addition to the comment above, this mindset is strengthened by time squeezes in development. Which lead to sales, project managers and product owners who prevent developers from actually looking into this.
rwmj 4y ago
I've seen development environments that try to abstract away the underlying web mechanisms[1], which can make it very hard to tell what's really going on at the request level. Combine that with incurious developers, deadlines and a need to ship anything that works and this is what you get. [1] I'm thinking in particular of Ars Digita's second system effect Java replacement for their original Tcl environment. It tried to turn everything into late 1990s Java buzzwords and was completely opaque, as well as being comically inefficient.

crecker 4y ago

I'm not the author of the article. But I think developers thought "ahaha who's going to checkout? Someone that has developer tools in airplane? Good joke bob!"

HideousKojima 4y ago

Just because a vulnerability is common and easy to avoid won't stop lazy and/or incompetent devs from making it. I mean SQL injection is still incredibly common despite being easily mitigated by really basic knowledge and despite being handled properly by the most common data access libraries in every single programming language.

amackera 4y ago

These types of fails are generally due to incompetence, in my experience.

jaywalk 4y ago
This one is 100% due to incompetence. There was no attempt at anything resembling security.
- hackbinary 4y ago
  I'm not sure what your experience is, but mine is over multiple decades over multiple companies over multiple continents, and in general, corporate management, project management, and business analysts are not concerned about security. Instead, they are interested in delivering buttons, fields, and streamlined workflows. Technical debt and library upgrades? Os upgrades? Forget about it. They need to deliver value back to the business in terms of faster business processes. Only when the business is hacked or they fail compliance does the business leadership start to care. Blaming the people with the hands on the tools is not fair when the business will not give the resources to do their work properly.
  - 20after4 4y ago
    This is sadly 100% accurate, in my experience.

brazzy 4y ago

No, the developers simply don't realize that there is a vulnerability, even though they have the required knowledge because they look at the code with the "how do I implement this feature" mindset (which is their job), not a "how could this be abused" mindset.

marapuru 4y ago
In addition to the comment above, this mindset is strengthened by time squeezes in development. Which lead to sales, project managers and product owners who prevent developers from actually looking into this.

rwmj 4y ago

I've seen development environments that try to abstract away the underlying web mechanisms[1], which can make it very hard to tell what's really going on at the request level. Combine that with incurious developers, deadlines and a need to ship anything that works and this is what you get. [1] I'm thinking in particular of Ars Digita's second system effect Java replacement for their original Tcl environment. It tried to turn everything into late 1990s Java buzzwords and was completely opaque, as well as being comically inefficient.