How we spent $30k in Firebase in less than 72 hours

Re:How we spent $30k in Firebase in less than 72 hours by minitech on Thursday August 02, 2018 @03:40AM (#17669831)

SQL with no ORM. Harder to be unaware of what you’re querying when you have to write the queries.

Not using attempted magic like Firebase would also fix the problem where the home page transfers 9 MB of data from Firebase on top of the 1 MB JavaScript, which appears to be… their entire database or something?? Accessible to the frontend??? Censored excerpt from that response:

  "email":{"stringValue":"[email protected]"},"fechaDisponible":{"integerValue":"1527483600000"},"identification":{"nullValue":null},"key":{"stringValue":"1527560309061"},"listaNotificaciones":{"arrayValue":{"values":[{"stringValue":"[email protected]"},{"stringValue":"[email protected]"},{"stringValue":"[email protected]"},{"stringValue":"[email protected]"},{"stringValue":"[email protected]"},{"stringValue":"[email protected]"},{"stringValue":"[email protected]"},{"stringValue":"ivXXXXXXXXxd@gmail.

Also appears to expose, for each campaign, the poster’s bank name and date of birth.

And wastes a bunch of various resources making separate requests to a currency conversion service for each amount, as others have noted. And requests /null and /undefined. This might be the most irresponsible development I’ve ever seen.

[ Parent | on HN ]

Re:How we spent $30k in Firebase in less than 72 hours by gandhium on Thursday August 02, 2018 @12:06PM (#17672547)

Exposing contents of DB without even any SQL injections... I think they have no idea about network monitoring. They _have_ an idea about console, since they're logging stuff there extensively.

[ Parent | on HN ]