> We have a live demo on our home where people can upload a test file. The demo is a way for users to actually see how the uploader will look in their own apps. It's a way for users to test drive the site without actually signing up.
> ....
> I believe that somebody signed up for our service (it’s free to sign up) and then uploaded a malicious file on our test storage and abused this feature.
Step 1 - Allow random users to dump random files onto your website.
Step 2 - Random users dump random files on your website.
Step 3 - Create an outrage, OMG, OMG!!! Google killed my site!!!
Step 4 - Post on HN, generate more outrage and sympathy
Step 5 - When the real thing comes to light, oh yeah, I did allow random users to upload random files to my website. Let me write a blog and tell what lessons I learned and still claim "How Google killed my site".
Step 6 - Kachinnng, look at all the attention and internet points me and my website earned!!!
We had a similar episode where this guy https://news.ycombinator.com/user?id=dcurtis created an uproar and outrage about Apple only to be proven[1] that he was the one at fault and not Apple. Now that the reality came to light, he's no where to be seen, not even an apology. We'll see him back during his next episode of outrage and attention seeking.
> ....
> I believe that somebody signed up for our service (it’s free to sign up) and then uploaded a malicious file on our test storage and abused this feature.
Step 1 - Allow random users to dump random files onto your website.
Step 2 - Random users dump random files on your website.
Step 3 - Create an outrage, OMG, OMG!!! Google killed my site!!!
Step 4 - Post on HN, generate more outrage and sympathy
Step 5 - When the real thing comes to light, oh yeah, I did allow random users to upload random files to my website. Let me write a blog and tell what lessons I learned and still claim "How Google killed my site".
Step 6 - Kachinnng, look at all the attention and internet points me and my website earned!!!
We had a similar episode where this guy https://news.ycombinator.com/user?id=dcurtis created an uproar and outrage about Apple only to be proven[1] that he was the one at fault and not Apple. Now that the reality came to light, he's no where to be seen, not even an apology. We'll see him back during his next episode of outrage and attention seeking.
[1] https://9to5mac.com/2021/03/03/apple-card-apple-id-unrelated...