Hacker News Reader

Comment by pstuart | Hacker News Reader

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs in the browser.

That redirects to https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site.

Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email and sent them info with no response, and no change to their site behavior.

This makes me think that they might be ripe for more monkey business but that's not my thing. Oh well.

View on HN

Seems to be fixed: This request was blocked by our security service

Not fixed where I am.

what the hell, i see the same thing. it's crazy to me when large companies don't even have an option for: in case of dumpster fire, send an email here.

Technically it's not my problem (or on any other basis), but it bothers me because I'm weird.

I was tempted to find their CTO on linked in and post a message there, along with the fact that there was no reply to my outreach nor a proper channel to do so.

I think the only think in their defense is that they must get a lot of angry customer messages and they just don't want to deal with that.

I very much doubt it's got anything to do with their CTO - the management of a corporate website is usually jealously guarded by marketing/corporate communications

Yes, the CTO hopefully has nothing to do with lower level operations like that. But if they get a public burn they're going to issue a decree that will be addressed.

No what I mean is that it won’t even be in their org. The public website will belong to the head of corporate communications or some similar chief bullshit officer

Ah, yes. It looks like my post here did get the security folk involved -- but it appears that they've yet to fix it. The power of Hacker News!

Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us

Please also add a security.txt file so that it is not necessary to navigate through a labyrinthine site to get this information.

https://datatracker.ietf.org/doc/html/rfc9116

It's definitely not fixed: the (likely malicious?) redirect still happens for me now. How embarassing (for you).

Hi! I was wondering if it would get noticed here ;-)

But as noted elsewhere, it's still not fixed.

And the link you shared is a good thing but is that going to be easy to find to someone who sees an issue with your websites? I'd recommend putting a link here: https://www.safeway.com/help/contactus

As it's still not fixed, I tried the form there. It let me fill it out and send it in and then told me I needed to create an account, which made it appear that my submission wasn't sent.

I've done enough here but ffs, if that form requires an account to be created beforehand then don't let the submitter go to the trouble of filling it out and then discard it.

Edit: my bad. Looks like browser cache was "helping out". Problem is resolved from my vantage point.

Reply on news.ycombinator.com