←back to thread

I hacked a dating app (and how not to treat a security researcher)

(alexschapiro.com)
560 points bearsyankees | 5 comments | 12 May 25 16:39 UTC | HN request time: 1.861s | source
Show context
michaelteter ◴[12 May 25 17:34 UTC] No.43965514[source]▶
Not excusing this is any way, but this app is apparently a fairly junior effort by university students. While it should make every effort to follow good security (and communication) practices, I'd not be too hard on them considering how some big VC funded "adult" companies behave when presented with similar challenges.

https://georgetownvoice.com/2025/04/06/georgetown-students-c...

replies(10): >>43965600 #>>43965723 #>>43965782 #>>43966035 #>>43966222 #>>43966281 #>>43966578 #>>43967558 #>>43968803 #>>43969670 #
tmtvl ◴[12 May 25 19:18 UTC] No.43966578[source]▶
I vehemently disagree. 'Well, they didn't know what they were doing, so we shouldn't judge them too harshly' is a silly thing to say. They didn't know what they were doing _and still went through with it_. That's an aggravating, not extenuating, factor in my book. Kind of like if a driver kills someone in an accident and then turns out not to have a license.
replies(6): >>43966766 #>>43967142 #>>43967680 #>>43967819 #>>43968420 #>>43969894 #
1. michaelteter ◴[12 May 25 21:51 UTC] No.43967819[source]▶
Still not excusing them, but these HN responses are very hypocritical.

US tech is built on the "go fast, break things" mentality. Companies with huge backers routinely fail at security, and some of them actually spend money to suppress those who expose the companies' poor privacy/security practices.

If anything, college kids could at least reasonably claim ignorance, whereas a lot of HN folks here work for companies who do far worse and get away with it.

Some companies, some unicorns, knowingly and wilfully break laws to get ahead. But they're big, and people are getting rich working for them, so we don't crucify them.

replies(3): >>43968512 #>>43976058 #>>44019153 #
2. mianos ◴[12 May 25 23:49 UTC] No.43968512[source]▶
It’s also why other regulatory zones outside the US, with much stronger privacy laws like the EU, don’t seem to produce as much innovation, while the US and China keep churning out new stuff.

It’s a trade-off between shipping fast and courting risk. I’m not judging one over the other; it comes down to what you’re willing to accept, not what you wish for.

replies(1): >>43973636 #
3. tmcdos ◴[13 May 25 14:53 UTC] No.43973636[source]▶
I would definitely accept more privacy rather than more innovation.
4. ruszki ◴[13 May 25 18:24 UTC] No.43976058[source]▶
“Go fast, break things” was invented at places where the best developers worked on the world. Applying the mentality without great developers is not how great startups were made.
5. make3 ◴[18 May 25 05:15 UTC] No.44019153[source]▶
I'm not sure hypocritical is the right word as you have no idea who parent is, maybe it's Pope Bob for all you know