News for hackers. Stuff that matters.
Re:OkCupid's “Removed” Visitor API by Implicated on Monday April 09, 2018 @02:36PM (#16795673)
How does this even happen?

How can the developers behind an endpoint like this not confirm/test that it requires permissions/authentication to consume? (I mean, look at all that data...)

Amateurs I can understand - but OKCupid has been around long enough they shouldn't be employing people of that nature.

Is there no code review process?

This is just nuts.

Re:OkCupid's “Removed” Visitor API by icedchai on Monday April 09, 2018 @03:27PM (#16796147)
"Visitors" was actually a feature up until a few months back. They probably removed it from the front-end, but left it in the back-end. This is very, very common. There would be not much to "review."
Re:OkCupid's “Removed” Visitor API by 616c on Monday April 09, 2018 @07:31PM (#16797893)
I do appsec for a living now and it is amusing how few people question stuff. I have made a name in a small firm by finding something easy, but usually severe, and coaching coworkers who had no idea. Of them I one of the most junior, and we replaced security people from before and the most senior has been here 2-3 years. Some of the stuff I'm busy writing up has 5-10 precedence in the company and upsets lazy culture and repeat copy pasta.

And I will tell you on sprints where anyone is busy that team introduces something sloppy or nutty when one of us does not watch closely and ask, sometimes both. But when I point things out people are eager to roll it back.

Never attribute to evil that which comes from ... you get the idea!

Re:OkCupid's “Removed” Visitor API by saudioger on Monday April 09, 2018 @02:55PM (#16795856)
It's easy to fall into this:

It works so no one complains.

Re:OkCupid's “Removed” Visitor API by tytytytytytytyt on Monday April 09, 2018 @03:42PM (#16796279)
It's certainly not outlandish that this happened. Have you never been employed as a programmer?
Re:OkCupid's “Removed” Visitor API by Implicated on Monday April 09, 2018 @03:54PM (#16796378)
I am, and have been. That's why it's so outlandish to me - I keep user data in mind all the time. Finding out you're leaking sensitive personal data is a slippery slope I (nor my clients) want to go down.

Are you implying that it's not outlanding for professional programmers to not have these things in mind?

Re:OkCupid's “Removed” Visitor API by tytytytytytytyt on Monday April 09, 2018 @05:45PM (#16797269)
Data leaks like these happen with some frequency, which is why they are not outlandish.

> That's why it's so outlandish to me - I keep user data in mind all the time.

You keeping data in mind has no bearing on whether or not data leaks are outlandish. You don't seem to understand what the word means, tbh.

> Are you implying that it's not outlanding for professional programmers to not have these things in mind?

No, I directly implied that your real or feigned surprise at this happening makes it look like you don't understand the industry. If you're familiar with the industry it shouldn't be a surprise that this happens.

Re:OkCupid's “Removed” Visitor API by Fifer82 on Monday April 09, 2018 @04:16PM (#16796583)
I can only speak for myself, having never worked for massive clients with deep pockets. I care more than my employers. "does spending time on that make moniez?" "I mean...." "Then no, let's do that cool loading spinner as it is all about user experience".