News for hackers. Stuff that matters.

A comment on Feeld dating app – Your nudes and data were publicly available. Parent comment

Re:Feeld dating app – Your nudes and data were publicly avai... by valenterry on Thursday September 12, 2024 @03:00AM (#41518255)
Yeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code changes should really not have touched anything server side or even anything security relevant in the beginning.
[ Parent | on HN ]
Re:Feeld dating app – Your nudes and data were publicly avai... by benoau on Thursday September 12, 2024 @03:15AM (#41518309)
I agree they should just quit but that requires experience to understand too. By the time they've learned that, they have also learned that client-side access controls are decorative.
[ Parent | on HN ]
Re:Feeld dating app – Your nudes and data were publicly avai... by hackernewds on Thursday September 12, 2024 @03:09AM (#41518282)
right*
[ Parent | on HN ]
Re:Feeld dating app – Your nudes and data were publicly avai... by consteval on Thursday September 12, 2024 @10:44AM (#41521582)
They shouldn't have to - the architecture should be made in such a way that permission checks are done without you specifically having to call them every time. This is the entire reason middleware exists!
[ Parent | on HN ]
Re:Feeld dating app – Your nudes and data were publicly avai... by valenterry on Thursday September 12, 2024 @11:05AM (#41521796)
Well, but apparently they let people create the architecture who just shouldn't have touched the backend code. That's the whole point. Since it was not just a single endpoint or so - it was everywhere!
[ Parent | on HN ]