Hacker News Reader

Hacker News

Comment by LiveTheDream | Hacker News Reader

Full thread

LiveTheDream

This

> DELETE http://api.fakecall.net/v1/account/(your number)

does this

> This really deletes your account and leaves no trace. We use "rm -rf /path/to/1234567890" (really).

Really hope they don't allow a number like "../*"

View on HN

(I'm the author). The number is put through a regex first and only digits are allowed.

Glad to hear it :)

Any chance of seeing some of the source, or maybe just a quick technical blurb on what kind of things you've used and how?

Does it really matter if they do?

it does if `rm -rf /var/www/fakecall.net/accounts/../../../../usr` actually hits /usr and mangles the server.

That would simply be poor system design. Why would you run the service and/or the rm's as root?

Ok. You run the service/rm's as a user specially created user. So think about what happens when they do the above.

Hint: not nothing.

Or to put it more bluntly: What about `rm -rf /var/www/fakecall.net/accounts/../*`?

I understand what would happen, what I mean is this is a free service the guy is offering for fun. Does it really matter if all the accounts are deleted? I mean, it could be annoying, but I don't generally expect account protection on free side-project hobby services.

Well if we're looking at it like that, would it really matter if somebody did do a `rm -rf /` as root? I can't imagine it'd take him more than a few minutes to redeploy.

In that case, either all data of all users is permanently destroyed, or they have backups in which case their "rm -rf" command is just a sham.

> Does it really matter if all the accounts are deleted?

Yes. Who said it's going to be free forever?

If you consider that the above example could be avoided with a single line of code, it does matter in the sense that he's avoiding a huge headache, not so much that he's offering any sort of guarantee to users.

The last addition "... (really)" is what bothers me most. To my experience, this usually means quite the opposite. That is, why does this need to be emphasized? Does it mean that the author usually doesn't take other's privacy seriously, but this time he'll try? No flame intended, but that's what is usually associated with such an exaggerated placation.

It's kind of the same phenomenon as with emails which start with "URGENT!!!" or similar. Almost always those aren't urgent at all.

But maybe it's just a cultural thing. I'm living in Germany, maybe things are different in Canada.

I take it as opposed to some others like Facebook, who keeps (kept?) all your data after you "delete" your account.

I think it's generally assumed that many are hesitant to give out personal info, especially when considering other companies that have been reluctant to erase your data (ahem Facebook), I can see the need for some to emphasize that your data really will disappear when you want it to. I don't see anything sinister here.

Reply on news.ycombinator.com