You speak of "responsible disclosure", but what about "responsible launch"?
If a backend is coded this poorly, it betrays irreparable and highly dangerous levels of idiocy, laziness, and lack of foresight in the ones who coded it. Everyone deserves to be informed of this blunder so they know to avoid this group like the plague.
Public ridicule and preemptive destruction of the brand is the only conscionable reaction.
It sounds like it wasn't launched yet. The founders say they built it for themselves and their friends to start. Someone discovered the URL and posted it to Hacker News.
They probably should have shut it down or disabled registrations once it got out until it was tested.
> It sounds like it wasn't launched yet. [...] Someone discovered the URL and posted it to Hacker News.
Sorry, but if you put a public site on the Internet, somewhere it can be discovered, and you are prompting people to put in sensitive credentials on that site, then you have launched for practical purposes. You should be implementing security measures accordingly.
If you're not ready for that and just want to show friends, it's not exactly rocket science to add basic HTTP Auth to the site, lock it to specific IP addresses, or any number of other trivial measures that would have prevented this problem.
Friends are customers, too. One row in your database is a customer.
Before ever putting a service up on the public Internet (service defined here as "accepts arbitrary requests" and "delivers arbitrary responses"), I would hope every human being that knows his way around a text editor treats user data like the Dead Sea Scrolls. If you store a row in a database, you then think of every way that an unauthorized party can gain access to that row and close each in multiple ways. I can recite dozens of cases where user data hasn't been treated with the respect it deserves (i.e., every single Bitcoin disclosure due to newer developers running sites that are handling money).
If people took user data more seriously than they do in general, we'd have a lot less leaks. Imagine if this had gone undiscovered and the service took off? Imagine how many undiscovered vulnerabilities there are in there, with this track record to start?
I can't sympathize with this at all. I just can't.
It sounds like it wasn't launched yet. The founders say they built it for themselves and their friends to start. Someone discovered the URL and posted it to Hacker News.
It should not have been on the public internet without access control for editing/viewing personal information like this - as soon as a site is visible on the internet there are bots trying all conceivable urls on it and scraping for information. If you look in your logs for any server you'll find all sorts of php,aspx etc urls as bots try to find vulnerabilities, no matter what you're running. I'm sure there'll be some Rails scrapers out there too though perhaps they're not too common yet.
There are probably a lot of other holes if they left the user security so wide open.
I don't get this. Ensuring that users can't edit/access the profiles of other users is trivial in most frameworks.
It shouldn't be something that slips through testing. If you aren't doing that from the start, something is seriously wrong with how you're building out your application.
I see this implied repeatedly by everyone, so could someone explain how customers on the ground using Apple Maps are somehow providing Apple with any data that could improve the maps?
For example if you find lots of People driving in a consistent manner on what is not already a road on your map then it needs to become one. You can do this ordered by number the number of people per unmapped road segment to have the most effect.
Another example, if you find that everyone drives off the road in a certain area then comes back on a little farther down and that no one drives the intervening segment, then the road probably needs to be adjusted.
Apple intentionally cripples their browser here and there to nudge developers toward creating actual apps that are served through the App Store and to discourage them from making things that can load through the browser.
The site owner recently revealed he pushes 3500000 GB per month. My lowball estimate puts that at roughly $77,000 per month, just under a million dollars per year to keep the site running. There are no ads on /b/, which is the main board, representing I'd guess 95% of the entire site's traffic.
That, combined with the plausibility of the following, leads me to believe he receives massive government subsidies:
I think $77k might be overshooting the mark a bit.
I once ran a site that pushed about 40TB a month (about 1% of 4chan) and it cost me $100/month to run. If you extrapolate that figure out (ignoring the fact that bandwidth gets cheaper the more you use), 4chan could cost as little as $10k a month to run.
If the allegations in the screenshot you posted are true (tl;dr: since 2008, the /b/ board is run by law enforcement as a sting operation), several prosecutions would have already run their course in the four years since the alleged start of the sting operation. Court decisions being open and including the details of the sting, we would have heard about it, wouldn't we? I think the press would have had a field day with that.
get on google and type X -> top suggested result Y:
CrossRider a -> "CrossRider adware"; CrossRider d -> "CrossRider delete"; CrossRider m -> "CrossRider malware"; CrossRider r -> "CrossRider removal"; CrossRider s -> "CrossRider spyware"; CrossRider u -> "CrossRider uninstall"; CrossRider v -> "CrossRider virus"; CrossRider w -> "CrossRider web apps virus"
No. What's absurd is that Amber Yust reaped all the benefits of having blue eyes in her profession for most of her life, and then proceeded to author this article about how it's wrong to assume that people in her profession have blue eyes, written with all the fury of someone who had brown eyes for their entire life.
I say this because she has a Y chromosome and only updated her driver's license to read Female one year ago.
I was not making an argument; I was stating a fact. Refraining from addressing someone's statement other than to label it "ad hominem" is itself an ad hominem argument, however.
The major thrust of her article is where she presents herself as the typical specimen proving that women both exist in the tech world in large numbers and are oppressed by pronouns in comments on the internet. Unfortunately, her chromosomes, as well as the male privilege she spent the majority of her life reaping the benefits from, make her the ultimate antithesis of her own point, and she does the opposite of dispelling any stereotypes people may harbor.
Ok, its been about 10 hrs, so maybe you would be able to read this comment objectively:
1. An Ad-Hominem argument is one where you attack the other based on their credentials to have an opinion on an issue without commenting on the argument itself. That's specifically what you did.
2. >>"Refraining from addressing someone's statement other than to label it "ad hominem" is itself an ad hominem argument, however."
-- this is a weird piece of logic I must say. See definition of ad hominem above. Where did I challenge your "statement" by saying that you are not un-biased enough to have an opinion. If you still disagree, see http://paulgraham.com/disagree.html and let me know what I am missing
3. Let me respond to your main argument as well - you say that the fact she was a guy "does the opposite of dispelling any stereotypes people may harbor" - ONE - not everyone knows she was a guy. Therefore, most people would take the argument for what it is and think about it. TWO - even if people know she was a guy, why do you assume that other readers are primitive enough that they will let that be a factor? Note - they aren't seeing her in real life - they are just reading an article at their leisure.
Y chromosome does not equal male. In most cases it does but you can't make a blanket assumption that sex is entirely determined by chromosomes because it is not.
The stereotype is primarily accepted by two groups of males:
1. Men who believe women do not succeed in the tech world due to social pressures
2. Men who believe women do not succeed in the tech world due to differences that are genetic in nature
For the second group, author Amber Yust only fuels the fire of the stereotype, because she was born a man. For the first group, using herself as an example of a woman succeeding in the tech world is invalid, because she was a man for most of her life and benefitted from all the consequent privileges.
I find it dumbfounding that she wrote this article.
She is not presenting a story of "a woman succeeding in the tech world"; she is presenting a story of how everyone assumes anyone who writes a tech article is male.
It is like the New York Times saying, "men invented the Internet", or all the people who have written, "Why are there no women programmers?" There are women programmers (22% in the US according to the Department of Labor.) There were women involved in the creation of the net (8% of RFC 1336). Just because there is not equal representation no excuse for erasing those that do exist.
If you mentally turn everyone male unless they are speaking about gender it is unfair to then turn around and complain that women only ever speak about gender. When you were listening to them talk about other things it wasn't that they were men, it was that you assumed they were.
That is all about you, and has nothing to do with the cis* status of the people pointing it out.
I fail to see how it's irrelevant. In this article, someone who was a man until a year or two ago used herself as the perfect example of a woman who succeeds in the tech world.
Second, it's quite possible that being a transgender woman would subject the author to even more discrimination, so what's your point? That Yust doesn't count as a real woman succeeding in the tech world because she was born with male intellectual attributes?
Chromosomes are directly responsible for most developmental differences between living creatures. If someone uses this fact to convince themselves it's why women aren't seen in the tech world, Amber has done nothing to disprove it.
Amber has benefitted from male privilege for most of her life. If people believe male privilege, brogrammer environments, etc. are why women aren't seen in the tech world, Amber has done nothing to disprove it.
She is literally the worst possible piece of evidence to use to disprove the stereotype.
This is not a burner account and I am not transphobic.
Addressing only this part: "Chromosomes are directly responsible for most developmental differences between living creatures."
Chromosomes are only part of sex differentiation in utero. Many of the developing embryo's/fetus' sex characteristics, both neurological and physiological, are the result of how it responds to the particular mix of hormones it is exposed to at different developmental stages. Sometimes the levels of androgens and estrogens are not consistent throughout the entire development process so the baby can be born with neurological characteristics of one sex but physiological characteristics of the other.
In humans, at least, hormones are responsible for the majority of developmental differences. Chromosomes usually determine what hormones will be released at different stages of development, but this doesn't always hold true - e.g. de la Chapelle syndrome and complete androgen insensitivity syndrome.
Trans men and women usually undergo hormone replacement therapy which sends their body through a second puberty; they develop the secondary sex characteristics of their transitioned sex. These hormones also influence emotional responses and other psychological aspects in the same way they would influence a cis (non-trans) person.
Several studies [1] have shown that there are similarities in brain structure of trans individuals to their cis counterparts. The most common hypothesis used to explain physiological differences in trans individuals is that infants are exposed to androgen levels that are either too high or too low, causing the brain to sexually differentiate towards a different sex than other parts of the body.
So, while trans women may have benefited from male privilege in their lives pre-transition, they may not necessarily "think like men". (And the inverse is true for trans men.)
In addition, wages for trans women tend to fall post-transition, while wages for trans men increase. [2]
Amber faces the same sexism as all women, and her physiology and brain structure are likely quite different than those of a cis man. That she was assigned male at birth is less relevant than you think.
I can't think of someone more apt to share experiences and criticism about treatment of gender in an industry that someone who has literally experienced both sides of it first-hand. (edit: from an exterior appearance standpoint, obviously, but isn't that the very point of this discussion. People are inappropriately judged on their visible, expressed exterior gender rather than by the merit of their contributions?)
Google her. You'll see a lot of news about her suing the DMV over her gender.
At the very least, it confuses everything she says. She spent most of her life as a man, and succeeded as a man... And now she's trying to use her tech articles as an example of a woman succeeding. Some will take the message to be 'You can succeed as a woman, but only if everyone thinks you're a man.' and that's not the case.
* I don't know her and can't speak for how she thinks.
