5 ms·
Criminal negligence levels of failure, especially given the category of app.
by throwuxiytayq 2y ago
Criminal negligence levels of failure, especially given the category of app.
- ghostpepper 2y agoWow you weren't kidding. These are vulns that would have been embarrassing a decade ago.
- Incipient 2y agoI think the timeline is the more damaging part too. Not only was their design woefully inadequate, they don't seem to care.
- 1_1xdev1 2y agoI used the app briefly a few months prior to their discovery. The app was riddled with bugs. Things like chats not loading (received the push notification, but in the app not visible until force quit/reload). I’m not surprised it took them so long to remediate. I would guess a shoestring contractor dev team.
- xenospn 2y agoThis is what happens when both founders are not technical. I use the app and it was obvious from day one it’s been designed and implemented by the lowest bidder.
- yosito 2y agoNot necessarily the lowest bidder. It's quite easy for a consulting company that is bad at development to make a convincing pitch to a nontechnical founder as long as they're better at sales than they are at development.
- RHSman2 2y agoReplace ‘founder’ with organization
- nailer 2y agoThe founder used attend node.js events in London. Not sure why you think he’s non technical.
- xenospn 2y agoBecause a technical person would immediately find all of the glaring flaws and issues with their app and fix it promptly. Unless they’re incompetent. Which might be worse than non-technical.
- _wbrb 2y agoAttending node.js events does not mean you are technical. A lot of people, I would say most people in my experience, go those events to connect with technical talent.
- itake 2y agoThe problem is they probably don’t have full time developers. They probably built the app once years ago via a dev shop and then never updated it again. The talent moved on and updating it is expensive now.
- benoau 2y agoCost minimizing aligns well with the criminal-negligence theory. In fact every egregious security issue I've come across, like plain text passwords, public S3 buckets, publicly-accessible internal tools... it all directly correlates to being cheap in my experience.
- forgotacc240419 2y agoThey had turnover of £39m last year and profits of £5.5m (double the previous year, quite good for a UK business of this scale). If they don't have full time devs it'll be shocking, certainly had the money to sort crap like this out
- tirpen 2y agoThey (or someone they hired) actually rewrote their whole app about a year ago, I remember seeing lots of people complaining about how much worse and buggier it got after the rewrite. I have no idea if the back end was also replaced then or if the vulnerabilities were present in the previous version as well.
- aitchnyu 2y agoI was that cheap contractor. My bosses were oblivious to anything but schedule and bugs surfacing to the client's reviewer. Guess threats of imprisonment in US and EU and data and insurance for data (if photos are not suitable for LinkedIn, you pay eye-watering prices) will be only deterrent. Of course, the incentives shouldn't promote coverups.