etagwerker

I'm glad this topic if finally getting the attention it needs.

I really like Google's paper on technical debt: https://ieeexplore.ieee.org/document/10109339

I wrote an article with a summary of the key insights in that paper: https://www.ombulabs.com/blog/tech-debt-maturity-model.html

Hopefully, the more articles like this one, the more non-technical managers will finally give a shit about technical debt?

Ombu Labs (https://www.ombulabs.com) | Software Engineer | Philadelphia, PA; Buenos Aires (ARG); or REMOTE | Full Time

Ombu Labs, The Lean Software Boutique, is hiring a full-stack software engineer to work on our products and consulting projects.

What we do: We aim to write less software. We take YAGNI to the next level. We apply lean principles to our own products and our client's products.

Why us: You will be our 4th software engineer hire. We are a small/agile company passionate about open source, pair programming, Ruby/Rails, and continuous improvement.

Tech we use: Ruby, Javascript, React.js, Backbone.js, Rails, Sinatra, Cuba, AWS, Heroku, Git, Slack, Screenhero.

If you're interested, please apply here: https://www.ombulabs.com/jobs.

If you have any questions, feel free to message me.

Location: Philadelphia, PA

Remote: Yes

Willing to relocate: No

Technologies: Ruby, Rails, Sinatra, Cuba, Rack, Javascript, Node.js, Backbone.js, React.js, Angular.js, iOS, Android, HTML, CSS, AWS, Heroku.

Résumé/CV: https://www.ombulabs.com/#clients

Github: https://github.com/ombulabs

Blog: https://ombulabs.com/blog

Email: [email protected]

That is pretty embarrassing too and even a bigger vulnerability, but Dropbox released a statement about it.

I believe that owning up to your mistake and being transparent about it can only make your customers trust you more. What worries me is that Mercado Pago is huge and they never released a statement about this issue. I hope that they change this policy soon.

Maybe rookies wasn't the right word.

The fact that they allowed such a blatant vulnerability to reach production makes me question their test suite and development process. What else is wrong that we are not seeing?

I expect more transparency and professionalism from a company that processes $7.1 billion in transactions.

Yeah, Mercado Pago has been around more than Stripe, but they are still rookies when it comes to their platform's security.

See Stripe's Security section: https://stripe.com/help/security

I'm still trying to find Mercado Pago's Security section and security vulnerability protocol (e.g. Who do I contact when I find the next security hole?)

Using their authentication mechanism, a user should only get an access token with the right combination of client id and client secret.

For at least 7 hours, anyone could get an access token for any client id, without entering the right client secret. With that access token they could see a lot of information for any account.

I've updated the post title with your suggestions. Thanks!

Yes. I wish they were more like Github or Stripe about disclosing this sort of information.

This is usually how I do it for libraries:

* Read the README.

* Install it and start using it with a couple of sample cases. That will give you an idea of what it does.

* Read the test suite. This will give you a better idea of what the library does.

* Look at the directory structure. This should tell you where things are.

* Start reading the core files.

* Start looking at open issues. Try to solve one by adding a test and changing the code.

* Submit a pull request.