• 1 post
  • 61 comments
Joined 3 years ago
Cake day: August 5th, 2023
  • Peter Thiel and Sam Altman were some of the earliest investors in reddit (2014 funding round). Alexis Ohanian shared board seats at Y Combiner with those guys. Of course they’re together.

    Honestly like 80% the enshittification we’re seeing can be traced back directly back to late stage Y Combinator and Sequoia Capital decisions.

  • The secrets themselves were basically guids, they had quite a lot of characters. If sent MORE than 1 character, pretty low chance they would clash. But those long guids also covered a lot of letters and number - it wasn’t terribly difficult to find one single character that cleared authorization reliably.

    And maybe you’re joking lol, but multitenant meaning multiple businesses/customers using the same application stored in the same database. If Bob’s construction wanted to spy on Jim’s contracting, they’d just need to know the right header to send and could get whatever they wanted from the other customer partitions. User access should of course be limited to their own assigned partitions.

  • I’ve had legacy systems that would encrypt user passwords, but also save the password confirmation field in plain text. There was a multitenent application that would allow front end clients to query across any table for any tenant, if you knew how to change a header. Oh and an API I discovered that would validate using “contains” for a pre-shared secret key. Basically if the secret key was “azh+37ukg”, you could send any single individual character like “z” and it would accept the request.

    Shits focked out here, mate.