@colinjay:
I seriously looked for the up arrow for your comment.

The people who were making these funny links didn't even know the stuff would be cached. A thread on reddit was laughing about it and mid way through people realized the links were cached and were being served up to other users. What makes sears "hacker" response really bad is that sears knew about this post as they asked for it to be hidden. They knew full well it was people joking around with the links who mid way through found out sears was copying the input and showing it to other users.

Sears had no grounds to call it "hacking".

[consumerist.com]

I'm eagerly awaiting the first post in that category.

This isn't really a security hole... if that page isn't linked to, who really cares if the user is futzing with the url?

The re-design is bleh but the original looked and felt quite impressive. The first time I saw it I thought it was specifically made for serial killers because they say "it cuts through anything"...

I'm surprised by the sheer volume of anti-Sears stuff on the front page of Reddit, sure. However knowing what I do about the site, only mildly so. Sears is just lucky they didn't mess with /b. Yes, from now on, Sears is sure to be a meme, OK. But if they'd messed with /b.... Ya know... Those guys can take down freakin Twitter.

Okay, here they are!

Cats

Lazy

@megusi: Pizza Hut has proved you wrong, as has Domino's. (Stuffed crust and pasta bowl, respectively).

[tr.im]

or maybe to cook FORTY babies ...

or maybe to cook FOR forty babies ...

I would have come up with somthing far more offencive than that if given the opportunity.

And no one in the café was any the wiser..

If they're sending 2050 bytes of data that would cause something to change on the server you should use POST. If they're sending 2050 bytes of data that doesn't cause anything to change on the server, it's probably because of a poor design.

Definitely a flaw in the webpage. Of course sears is attempting to cry hacker and a few sites are reporting it as "hacking".

@MostlyHarmless: Blasphemy! There is no possible wrong way to use cheese.

If the website flaw exposed account information AND Sears tried to cover up their tracks, then it would be worth complaining about.

Seriously, Reddit people are whiners and they're trying to make a mountain out of a molehill. Almost as bad as Digg people.

What? You shouldn't use POST unless you're modifying something on the server side. Using POST here would be terrible software engineering. WTF.

Are they actually caching the user input and sending it back to other users? It doesn't say that in the consumerist article. If they're doing that, that's stupid.

@yadatothethirdpower: Haha us dads are the best, no way my wife would let me do that

what's really killing Sears' retail sales is the fact they no longer carry John Henry brand men's business attire. When you can buy a full suit for less than $80, does it matter what kind of material it's made from? I posit to you all that no, it does not. Just don't wear it too often, or it will literally fall apart on you.

I remember my old manager honoring a print-out some kid brought in of an online Sears Xbox add, and the price was $150. Clearly the kid copied the page and edited it (even the image was broken, he just stole the source code and changed the text), and even with me pointing this out, my manager still gave it to him for that price. As frustrated as I was, it just gave me all the more reason to get that Husqvarna 22" chainsaw for half the price with the same shenanigans.

@shepd:
Would love to. I'm in a juvenile mood today.

Though you are right in that there is nothing wrong in using GET the right way, but just like GOTO and cheese, it gets used in all the wrong ways.

It is about the same thing as letting users edit your billboard messages. As evidenced by this incident.

The correct way to do this would be to use POST and not GET. Using GET in places like this is just terrible software engineering.

Websites with much more traffic than Sears get by on it.

Even if there is is a performance gain from loading pages with url variables, when creating the cache, they should load their own database variables. Not the user supplied variables.

No matter what you try to claim, there is no excuse for them to cache the user supplied variables and start serving that to everyone else.

This is funny because Sears' entire web presence seems to be limited to randomly spamming people. I was added to one of their e-mail lists without my consent, and I contacted them and they said they had no way to know how I was added, and I could unsubscribe, which would be admitting I had subscribed in the first place.

How much longer until the Sears deathwatch starts?

[farm3.static.flickr.com]

I'll admit that Sears (or anyone for that matter) trying to get information off the Internet is pretty ludicrous, but how about, "fuck reddit for being a bunch of whiny babies". Their response is just silly, but then again this is the Internet (again).

I haven't seen what the URLs looked like at Sears.com, but many sites, including Amazon.com and Consumerist.com, put that sort of information in the URL just to make the URL somewhat readable. You see [consumerist.com] and you wonder WTF that is, but you see sears-caught-selling-grills-to-cook-babies-thanks-to-poorly-built-website at the end and you know what that URL will take you to. Amazon puts product names in the URL for the same reason. Presumably Consumerist and Amazon don't actually USE that information when the user visits that URL - it's just for the user's information. That's the difference between what Consumerist does and what Sears does. But I don't see what the big deal is about what Sears was doing - it has no negative impact on anyone.

Of the ones I've had the pleasure of interviewing, it's 1:10, if that. Error checking and handling, and parameter checking is a lost art.

Basically I just like it when casual cursing is injected into everyday objects.

Let's also not forget the "You Lazy Bastard" garage door opener.

(I have caps, I'll upload them somewhere later if anyone cares).

I'm just imagining it being read out loud in a Monster Truck Radio Commercial kind of voice.

FUCKING BIG ASS SAW SAW SAWS!

@secret_curse: Nope...This one was in the sub-category of "Body Part Roaster". A little more suited for a nice hot pair of legs.

@sqlrob:
I disagree with that, unless we're talking about overworked, underpaid, massively disgruntled developers. Then yeah. ^^

I've worked with several that were quite proud of doing a good job of things and didn't cut corners, they even pointed out missed scenarios.

Granted.. we're all overworked, massively disgruntled and underpaid right now >.>

@Hanshiro:
Oh Emm Eff Gee.
That is probably one of the greatest pictures I have seen EVER.
Even cooler that it's not photoshopped.

The seventh-grader in me is giggling like an idiot. Unfortunately, the grown-up me on the outside is joining in.

So, does that mean it won't grill babies? Because if so, I'm shopping elsewhere.