How can the developers behind an endpoint like this not confirm/test that it requires permissions/authentication to consume? (I mean, look at all that data...)
Amateurs I can understand - but OKCupid has been around long enough they shouldn't be employing people of that nature.
"Visitors" was actually a feature up until a few months back.
They probably removed it from the front-end, but left it in the back-end. This is very, very common. There would be not much to "review."
I do appsec for a living now and it is amusing how few people question stuff. I have made a name in a small firm by finding something easy, but usually severe, and coaching coworkers who had no idea. Of them I one of the most junior, and we replaced security people from before and the most senior has been here 2-3 years. Some of the stuff I'm busy writing up has 5-10 precedence in the company and upsets lazy culture and repeat copy pasta.
And I will tell you on sprints where anyone is busy that team introduces something sloppy or nutty when one of us does not watch closely and ask, sometimes both. But when I point things out people are eager to roll it back.
Never attribute to evil that which comes from ... you get the idea!
I am, and have been. That's why it's so outlandish to me - I keep user data in mind all the time. Finding out you're leaking sensitive personal data is a slippery slope I (nor my clients) want to go down.
Are you implying that it's not outlanding for professional programmers to not have these things in mind?
Data leaks like these happen with some frequency, which is why they are not outlandish.
That's why it's so outlandish to me - I keep user data in mind all the time.
You keeping data in mind has no bearing on whether or not data leaks are outlandish. You don't seem to understand what the word means, tbh.
Are you implying that it's not outlanding for professional programmers to not have these things in mind?
No, I directly implied that your real or feigned surprise at this happening makes it look like you don't understand the industry. If you're familiar with the industry it shouldn't be a surprise that this happens.
I can only speak for myself, having never worked for massive clients with deep pockets. I care more than my employers. "does spending time on that make moniez?" "I mean...." "Then no, let's do that cool loading spinner as it is all about user experience".
Comments
How does this even happen?
How can the developers behind an endpoint like this not confirm/test that it requires permissions/authentication to consume? (I mean, look at all that data...)
Amateurs I can understand - but OKCupid has been around long enough they shouldn't be employing people of that nature.
Is there no code review process?
This is just nuts.
"Visitors" was actually a feature up until a few months back. They probably removed it from the front-end, but left it in the back-end. This is very, very common. There would be not much to "review."
I do appsec for a living now and it is amusing how few people question stuff. I have made a name in a small firm by finding something easy, but usually severe, and coaching coworkers who had no idea. Of them I one of the most junior, and we replaced security people from before and the most senior has been here 2-3 years. Some of the stuff I'm busy writing up has 5-10 precedence in the company and upsets lazy culture and repeat copy pasta.
And I will tell you on sprints where anyone is busy that team introduces something sloppy or nutty when one of us does not watch closely and ask, sometimes both. But when I point things out people are eager to roll it back.
Never attribute to evil that which comes from ... you get the idea!
It's easy to fall into this:
It works so no one complains.
It's certainly not outlandish that this happened. Have you never been employed as a programmer?
I am, and have been. That's why it's so outlandish to me - I keep user data in mind all the time. Finding out you're leaking sensitive personal data is a slippery slope I (nor my clients) want to go down.
Are you implying that it's not outlanding for professional programmers to not have these things in mind?
Data leaks like these happen with some frequency, which is why they are not outlandish.
You keeping data in mind has no bearing on whether or not data leaks are outlandish. You don't seem to understand what the word means, tbh.
No, I directly implied that your real or feigned surprise at this happening makes it look like you don't understand the industry. If you're familiar with the industry it shouldn't be a surprise that this happens.
I can only speak for myself, having never worked for massive clients with deep pockets. I care more than my employers. "does spending time on that make moniez?" "I mean...." "Then no, let's do that cool loading spinner as it is all about user experience".