7 ms·

"The web app was so sensitive in nature I can’t really even describe the contents, but it was a big find by itself." Maybe that's true, and certainly the vulne

"The web app was so sensitive in nature I can’t really even describe the contents, but it was a big find by itself." Maybe that's true, and certainly the vulnerabilities described in more detail are already quite a big deal, but the author probably should have omitted the above quote from their post as it leaves the reader with some suspicion that perhaps this is a bit of a "Fish Story" (fisherman exaggerating the size of the fish they caught) https://www.urbandictionary.com/define.php?term=Fish%20Story https://www.urbandictionary.com/define.php?term=Fish%20Story

ballenf 4y ago
My first thought was that it was just an admin dashboard that was poorly attempted to be hidden by obscurity. It probably was thrown together during migration to work from home.
blueflow 4y ago
Its self-promotion. Basically an ad for themselves. IMHO as annoying as an ad, except HN allows me to downvote it.
- more_corn 4y ago
  I like it because it describes how specifically the vulnerabilities were found and what specifically they were. If you’re doing security review or building a secure tool there are 5 items for your checklist.
  - blueflow 4y ago
    They are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.
    - pixl97 4y ago
      You're assuming some companies have ways of testing their QA effectiveness. Especially in the case where your structural engineer is incompetent.
    - curiousllama 4y ago
      Think a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm) People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
      - blueflow 4y ago
        It works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal. Even the avionics and carmakers get software right, why cant we?
        thomjrob 4y ago
        What? Avionics and carmakers definitely don't get software right...
        paulryanrogers 4y ago
        Other engineering fields don't do independent third party testing? Do they deploy multiple times daily? Deal with vague sometimes contradictory client requirements? Do their tools and platforms change daily?
        curiousllama 4y ago
        Funny you mention carmakers. Wouldn’t a crash test be the carmaker equivalent to a penetration test?
        blueflow 4y ago
        crash tests verify what the designers already predicted. You don't blindly construct a car and then crash-test it to safety in a trial & error manner.

ballenf 4y ago

My first thought was that it was just an admin dashboard that was poorly attempted to be hidden by obscurity. It probably was thrown together during migration to work from home.

blueflow 4y ago

Its self-promotion. Basically an ad for themselves. IMHO as annoying as an ad, except HN allows me to downvote it.

more_corn 4y ago
I like it because it describes how specifically the vulnerabilities were found and what specifically they were. If you’re doing security review or building a secure tool there are 5 items for your checklist.
- blueflow 4y ago
  They are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.
  - pixl97 4y ago
    You're assuming some companies have ways of testing their QA effectiveness. Especially in the case where your structural engineer is incompetent.
  - curiousllama 4y ago
    Think a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm) People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
    - blueflow 4y ago
      It works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal. Even the avionics and carmakers get software right, why cant we?
      - thomjrob 4y ago
        What? Avionics and carmakers definitely don't get software right...
      - paulryanrogers 4y ago
        Other engineering fields don't do independent third party testing? Do they deploy multiple times daily? Deal with vague sometimes contradictory client requirements? Do their tools and platforms change daily?
      - curiousllama 4y ago
        Funny you mention carmakers. Wouldn’t a crash test be the carmaker equivalent to a penetration test?
        blueflow 4y ago
        crash tests verify what the designers already predicted. You don't blindly construct a car and then crash-test it to safety in a trial & error manner.