Hacker News Reader

Comment by nknighthb | Hacker News Reader

On top of what the others said, it requires pointing out that you go to www.archive.org and get the new page. It's shipped. It is the public face now. You don't get to hide behind any sort of pre-release label when you've already made it the default in place of a prior working model.

View on HN

If you go to the site cold, you do not get the new site. You get the old site. If, however, you've chosen to look at the new site, a cookie is set so you are looking at the new site. If you click on "exit beta" in the corner, it will go back to the old site and the old site after that.

So it's still an option.

Please, please, pretty please keep the old site around in some form. It would be the irony of ironies if the archive would no longer be available in its old form.

OK, well, that's... Actually worse.

Websites should not make changes to a user's settings based simply on a GET against an URL, because the user can click the URL from a random stranger not knowing it would have that effect -- as I did.

Aside from being a poor user experience, what has happened here is someone has deliberately coded a security vulnerability. Granted the impact here is basically trivial, but it's still a pretty classic no-no, and should have immediately set off flashing lights and klaxons in any security-conscious developer's mind.

I think the dev team would be surprised to hear that getting to see the new site is a security vulnerability!

While I, sadly, am not at all surprised to hear that yet another group of developers treats security and user experience flippantly. I'm rather starting to regret defending you and lending resources to the twitpic grab.

Reply on news.ycombinator.com