News for hackers. Stuff that matters.
Re:HBO Max accidentally sent an integration email test to users by jffry on Friday June 18, 2021 @01:22AM (#27547613)
This incident doesn't necessarily indicate that they were using prod data in a test system.

I can plausibly imagine that there's some separate system that takes an identifier for some list of customers, and some template, and blasts out emails. Such a system could exist to help manage compliance issues with e.g. unsubscribe requests.

If so, and with a few "shortcuts" taken in making test environments for integration testing, I could envision a scenario where this incident happens that don't involve the test having direct access to real user data.

Re:HBO Max accidentally sent an integration email test to users by jspash on Friday June 18, 2021 @03:47AM (#27548255)
HBO Max sounds like a big company (I've heard of HBO, and "Max" sounds big to me). But it is possible they are using something like Mailchimp for their mailing list and don't do it in house. I'm just guessing here - a quick look at the headers would reveal this.

And with a confusing and horrendous UI such as Mailchimp's, it's quite easy to send a test email to the "live list". VERY easy indeed.

We've done it twice now. Once to about 10,000 emails and another to almost the entire list of 800,000. Luckily the template we were testing was 95% complete and not many people noticed. It just looked like the email got truncated with gibberish at the end.

Re:HBO Max accidentally sent an integration email test to users by chrisbolt on Friday June 18, 2021 @05:54AM (#27548853)
They use SendGrid. From the headers, abmail.mail.hbomax.com resolves to u6146175.wl176.sendgrid.net.