Hacker News Reader

Comment by air7 | Hacker News Reader

Technical details can be found here (in Hebrew) [0]

The gist is that, amazingly, the url "/get-admin-users" would return a list of all admin users with their plaintext passwords... And that this url appeared in the html source of the site's landing page.

[0] https://internet-israel.com/%d7%97%d7%93%d7%a9%d7%95%d7%aa-%...

View on HN

That is just amazing,

- passwords in plaintext, check - deliver that list without protection, check - put a hint to this route into the landing page, check

Wow!

Wow! It’s difficult here to invoke Hanlon: do not attribute to malice that which can be explained by stupidity.

Stupidity might be the symptom, but the root cause is almost always malice - in this case systemic corruption and malicious negligence.

This. I have started to think of this rejoinder to Hanlon after the Iowa app fiasco.

Stupidity may be a great cover for uncoordinated malice leading to widespread negligence. A bit like “chaos monkey” but by those who’d like to rearrange the pieces.

I'd describe it as a vicious cycle of incompetence and misunderstanding risk. They exacerbate each other. It all begins with someone trying to get something done as cheaply as possible in an area about which they are ignorant.

Whether they are a "corrupt cowboy" or "cost-efficient genius" mostly depends on whether the project is a success, and that depends on luck.

We don't have the exact details here yet but I'm willing to bet that a rather fat contract was given to someone affiliated with a Likud center member (equivalent to a US party boss) who then sought the cheapest provider while pocketing the difference or maybe handed it to their relative.

Private ownership of contractor businesses means decisions are made by a few at the top :)

Relevant comment I wrote on how to solve that:

https://news.ycombinator.com/item?id=22289943

Except in this case the decisions were probably made by an underqualified codeling at the bottom who possibly could not even been expected to know better and not take the assignment, that's the immediate stupidity part - the malice is what led to this situation in the first place and saw the result rolled to production.

I don't see how that comment is specifically relevant to anything at hand here.

Absolutely. Malice is almost always the cause. That's why Hanlon's razor is absurd. It supposes a version of human nature that doesn't exist. Surely humans are generally stupid, but they are also scheming, lying, manipulating, violent, and definitely malicious way more than they are stupid. History shows us this over and over again.

Hanlon fails due to second order effects. For instance, I have a "really secure" voting app to make, I hire 3 interns and give them 4 months to do it. Of course they're trying their hardest to make the app, and they'll likely fail. But hey, I'm non the wiser.

Hanlon = plausible deniability

Reply on news.ycombinator.com