Hacker News Reader

mcintyre1994

Given they didn't think it was exploited they must have pretty poor logging and analytics around that part of their infrastructure. Someone managed to abuse it millions of times and they didn't know about it even after they'd fixed it and knew exactly where to look for abuse.

View on HN

Curious what kind of logs/analytics would you add and watch to catch something like this?

You should notice a spike in any request logging metric if someone exploits this.

Depends on the normal usage, if someone was doing this across unique ips and slow enough that the usage change may be say 1% it wouldn't be noticed.

A more sophisticated system that could look at the ips in use and compare to previously used ips for the accounts would notice something.

Reply on news.ycombinator.com