Hacker News Reader

Comment by Lammy | Hacker News Reader

Just make your own website, as long as you've done it before and are intimately familiar with all the dangerous defaults built in to our collective tech.

Perhaps they aimed too high too fast (dunno, never even went there), but I just can't bring myself to make beginner-shaming a core pillar of my criticism.

View on HN

A company founded by billionaires and FAANG engineers, operating for multiple years, and having had millions of users shouldn't be... "Beginner shamed"... for creating services wildly irresponsible with user data?

Small or "beginner" web payment companies are required to think more responsibly about user data; the state of Parler in January 2021 was ridiculous and users who were effectively doxxed should be outraged.

This. We should have higher standards to what we will tolerate from beginners.

Teach and guide them to not make things open to the public. Mentor the next gen engineers on security. For god sakes check a jwt claim...

You might not realize how many companies make this mistake and worse. Dropbox? LinkedIn?

What is it you think was wildly irresponsible exactly? Not stripping exif data? Facebook did that too. And has had many account takeover bugs.

How many beginner websites require you to verify with your social and back and front scans of your license?

There's beginner shaming and then there's going above and beyond with intrusive PII collection.

There's also the aspect this was a company founded by billionaires and FAANG engineers which means an even slightly reasonable person wouldn't classify the project as one made by "beginners".

I wouldn’t be comfortable with “beginner shaming” a private blog. But they didn’t set out to create a blog, they set out to create a Twitter competitor. Their negligence is going to get their customers hurt and possibly jailed. I’m very comfortable condemning them for their incompetence.

If I was the CTO or CIO then to CYA I would pay some security consultant $700/hr for a 2hr briefing on the best practices for handling user data. A beginner should know that experts are knowledgeable, and a bunch of FAANG and VCs should have known that. Then when the consultant mentions having rate limits for media to protect against scraping, you would look into seeing if you're already doing that. It's not rocket science it's just a webapp

I made some photo sharing PoCs about 10 years ago. Step 1 was strip exif data at the earliest possible point. It isn't just the CEO, there were any number of people that could have applied the basic level of diligence to this problem.

Clowns.

When said "beginners"[0] are responsible for the loss of tons of private user data, I don't think that's acceptable, understandable, or easily dismissed. Perhaps shaming is not the most appropriate response, but there should be repercussions. Legal and financial ones, preferably.

[0] As others pointed out in sibling comments, these people are not "beginners" by any stretch of the imagination.

No entity with as much funding as Parler had is a beginner. If the actual principals are beginners, they have the wherewithal to hire seasoned experts and listen to them. Either they didn't hire them, or they didn't listen to them. The beginner's mistake isn't the technical failures of working the stack; it's the organizational failure to usefully apply millions of dollars to basic operational best practices.

They're clowns, and deserve to be laughed at as such.

Reply on news.ycombinator.com