Now now, I like to shit on vibecoders too but let’s not pretend this is some new problem.
Idiots leave databases on cloud servers exposed all the time rather than deal with their companies often arcane rules for generating certificates
Comment on Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan
sunglocto@lemmy.dbzer0.com 3 days ago
This is what happens when you decide to vibecode a service with zero attention to safety or web development. This is why you don’t immediately jump onto a new service without it being vetted properly. Now one of the worst communities on the Internet is in possession of over a hundred thousand women’s driving licenses and faces. This is going to be an absolute disaster.
4am@lemmy.zip 3 days ago
JackbyDev@programming.dev 2 days ago
Remember when the government published SSNs in HTML? zdnet.com/…/missouri-will-not-prosecute-hacker-re…
Passerby6497@lemmy.world 2 days ago
Where do you think the AI learned it?
Like, I get that competent coders do it too, but now any skiddie with an idea can cosplay as a developer so this is going to be so much more prevelant
Maeve@kbin.earth 2 days ago
That's not new, either.
panda_abyss@lemmy.ca 3 days ago
To be fair, I’m not sure why firebase even has a public access option. That’s a recipe for issues.
Though if it’s anything like Google Cloud Store, they hopefully make it very clear that your bucket is public.
Zetta@mander.xyz 3 days ago
“Vibe coded” you just made that up didn’t you, because you don’t like llms. I don’t see anything in the article about “Ai” and this service has been operating for 2 years.
shalafi@lemmy.world 3 days ago
My thoughts as well. But hey, it’s lemmy! Just accuse someone of doing something we hate, good to go!
Redjard@lemmy.dbzer0.com 2 days ago
The og 4chan post brought up the vibe coding. Using it as an insult to quality is wider spread than just lemmy.
sunglocto@lemmy.dbzer0.com 2 days ago
Maybe I shouldn’t have used the term vibe coded. I apologize.
Eheran@lemmy.world 3 days ago
How is something “vetted properly” and how do I find out about that?
Hupf@feddit.org 3 days ago
You wait a while until something like this happens.
thymos@discuss.tchncs.de 2 days ago
This is something I worry about all the time as well, especially since I’ve started to learn how to code and experienced how easy it is to mess up and send a list with all registered users to everyone opening a page. (This was in a test environment.)
As a user, there is no proper way I know of to verify an app’s security. Most apps are closed source, but even if you could view the code, what would you look for?
Both Apple and Google have a verification process for apps that are published in their app stores, but if these worked, we wouldn’t see this happening.
There are academic researchers working on apps and privacy as well, but it’s not like you can ask them for a report on an app you’re thinking of installing.
I think it basically comes down to trust. Check if a developer has messed up in the past and how they dealt with that, that sort of stuff. And for dating apps there is this interesting article: privacyguides.org/…/queer-dating-apps-beware-who-…
It’s a long read (haven’t fully read it myself yet) and it paints a bleak picture, but that’s the world we live in today.
troglodyke@lemmy.federate.cc 1 day ago
You can pay for a 3rd party to penetration test your app, it’s good practice to do this before you launch an app, after any significant changes, and annually at a minimum.
There are also a growing number of companies offering continuous penetration testing - basically, automated pen tests - but these are expensive and it’s difficult to convince companies that the cost is worth it
thymos@discuss.tchncs.de 1 day ago
Thanks, that’s good to know! If I do ever decide to release an app, I’ll definitely look into this.
bytesonbike@discuss.online 3 days ago
I honestly don’t understand what op is talking about.
Leaks happen all the time, even in billion dollar companies.
prof@infosec.pub 3 days ago
This situation would have been easily preventable with basic understanding of what they’re doing is what OP is saying. This leak is not something highly complex, it is painfully stupid on the side of the developers.
There’s a difference between a hack, where data is exposed, compared to data exposure due to negligence or ignorance on the development side.
Eheran@lemmy.world 2 days ago
Again, how should the end use know anything about what is going on at their end? How does anyone “vett” that? It is a nonsense “argument” to put blame on the users.
Tlaloc_Temporal@lemmy.ca 3 days ago
This was more like leaving all your valuables in a cardboard box on your front lawn. Anyone can just take it, if they care to look inside the complete unsecured box.
Someone just drove up and tossed the box in their truck. No lock involved.
Eheran@lemmy.world 2 days ago
I love how people just jump on whatever they like, instead of actually thinking about the stuff they read/comment on/upvote. Exactly like on Reddit, no difference.
zarkanian@sh.itjust.works 2 days ago
How strange that a site designed exactly like reddit behaves like reddit.
zarkanian@sh.itjust.works 2 days ago
Anybody oblivious enough to create something like this isn’t someone you should trust your most private data with. This service had red flags from the concept phase, never mind the execution.
This is not to say, of course, that the victims deserved it. It just really sucks that they had to learn this lesson this way.
Darrell_Winfield@lemmy.world 3 days ago
This is ALSO why no service should ever require or get my driver’s license information. Fuck that. Also, yet another Constance to those who can’t afford a car or want to improve the environment by living car free.
shiroininja@lemmy.world 3 days ago
My only exception to that are uber drivers. But then again we live in an age where somehow better help has become popular, even though they sell your data.
XTL@sopuli.xyz 2 days ago
I disagree on even that. It should be enough to have some trusted “notary” tick a box that they have verified your driver’s license as valid. It should not be stored out sent anywhere at any time. Just showed to a human. Regularly, if needed.
JackbyDev@programming.dev 2 days ago
Instead, just prove you have a credit card by submitting the details. Also totally safe. Be sure to include the CVV, please!
Alaik@lemmy.zip 2 days ago
The only site I ever felt comfortable scanning shit like that into was a site that sold things only to military/medics/fire fighters so I had to upload my medic license and my FF cert.
Anything beyond that is a no go from me.