4 ms·
If you visit the direct link: http://www.getmagicnow.com/access.php http://www.getmagicnow.com/access.php without adding an email address it still says that "Yo
by subless 12y ago
If you visit the direct link: http://www.getmagicnow.com/access.php http://www.getmagicnow.com/access.php without adding an email address it still says that "You've been placed on the waiting list!". Simple error, but easy to fix so there is no confusion. Great service!
- downandout 12y agoIf you visit this link, you can pay them $5,000: http://getmagicnow.com/pay.php?p=500000 http://getmagicnow.com/pay.php?p=500000 Payment pages should really be linked to an order ID of some sort, without which customers shouldn't be allowed to pay. Otherwise, lots of things can go wrong. Depending on how they have configured things on the server side, a customer could change the amount being paid and the system would consider the ticket paid, cheating them out of money. Or a customer could follow an old link and wind up paying twice if they thought it didn't go through the first time.
- jboggan 12y agoIf you visit this link, they can pay you $5,000: https://magic.bettir.com/?p=-500000 https://magic.bettir.com/?p=-500000
- octatoan 12y agoWait, what?
- codygman 12y agoWhoa, seriously? I'm going to guess you're joking since they probably implemented "customer order of amount x".
- jboggan 12y agoEdit: they've fixed this now. I'm not joking, click on it and try to pay. It shows an invoice of ($5,000), a.k.a. $5000 negative dollars. I didn't enter real payment information to see what happens next because of really idiotic interpretations of what constitutes "hacking", but it is a really bad design choice on their part that took me about half a second to find. Founder, if you're reading this: was this an in-house build or did you outsource this?
- edmack 12y agoThe answer is probably they spent around two days building this before demand grew left them zero time to improve infrastructure. Which is more or less good.
- jboggan 12y agoLess good? Infrastructure breaking because of load is one thing (concurrency/DB issues) but nothing like this should ever be exposed to the user on general principle.
- lalm 12y agohttps://i.imgur.com/yJDY3m2.png https://i.imgur.com/yJDY3m2.png
- ryanlol 12y agoStripe doesn't let you send money to cards.
- jboggan 12y agoI'm glad to know Stripe's API is sane but you cannot ever rely on that when designing something like this!