![\"user-pic\"](\"/css/images/default.gif\")
f**k sears. don't mess with reddit.
1 replies
f**k sears. don't mess with reddit.
at the place i work at, we maintain a website that does something sorta like this i guess. whenever we get web based error messages, we can alter the URL and get any error messages we want. pretty hilarious because it looks legitimate. In fact, i had some people thinking that purple monkeys had taken over the web servers.
So, does that mean it won't grill babies? Because if so, I'm shopping elsewhere.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-943594-100x100.png\")
@secret_curse: I hear if you put some curry powder in their food for a few days before you roast, it helps season the meat nicely.
@secret_curse: Nope...This one was in the sub-category of \"Body Part Roaster\". A little more suited for a nice hot pair of legs.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-1713-100x100.png\")
@secret_curse: You'd be better off getting a smoker. Babies cooked over propane just don't have the flavor or tenderness of a good baby barbecue.
Developers that don't cut corners (web or otherwise) are few and far between.
@sqlrob:
I don't think they were \"cutting corners,\" they made a compromise for the sake of performance, something that you have to do on a website that gets as much traffic as Sears.com. Passing that information in the query string lets you avoid retrieving it from some external source, i.e. the DB or a cache or what have you - because you just retrieved that info on the previous page load. There is no negative impact to the user, so what's the problem?
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-436259-100x100.png\")
@Cant_stop_the_rock: Theres no negative impact... till the user gets creative.
It is about the same thing as letting users edit your billboard messages. As evidenced by this incident.
The correct way to do this would be to use POST and not GET. Using GET in places like this is just terrible software engineering.
Websites with much more traffic than Sears get by on it.
What? You shouldn't use POST unless you're modifying something on the server side. Using POST here would be terrible software engineering. WTF.
@Cant_stop_the_rock: Seriously? What if you want to send in 2050 bytes of data that you do not want the client to fiddle with?
@MostlyHarmless:
Seriously? You think using POST will prevent users from fiddling with the data they're sending you?
If they're sending 2050 bytes of data that would cause something to change on the server you should use POST. If they're sending 2050 bytes of data that doesn't cause anything to change on the server, it's probably because of a poor design.
@Corporate_guy: I dont want to start a GET v/s POST flame war here on Consumerist of all the places, so I'll stfu about it ;)
Though you are right in that there is nothing wrong in using GET the right way, but just like GOTO and cheese, it gets used in all the wrong ways.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-21970-100x100.png\")
@MostlyHarmless: Frankly, I didn't even know it was possible to start a GET vs POST flame war. You learn something knew every day. Unless you're drinking a lot.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-307161-100x100.png\")
@megusi: Pizza Hut has proved you wrong, as has Domino's. (Stuffed crust and pasta bowl, respectively).
@Cant_stop_the_rock: The problem is that when they create the cache of the page, they cache the version from the user supplied variables in the URL instead of the version from the database. So the user supplied variables now get displayed to other users.
Even if there is is a performance gain from loading pages with url variables, when creating the cache, they should load their own database variables. Not the user supplied variables.
No matter what you try to claim, there is no excuse for them to cache the user supplied variables and start serving that to everyone else.
Are they actually caching the user input and sending it back to other users? It doesn't say that in the consumerist article. If they're doing that, that's stupid.
@Cant_stop_the_rock: Yes. After a page is visited enough times and is considered \"popular\" it is cached. So future visitors see the cached paged. The problem is that when they decide to cache the page, they cache the version generated via the user provided info in the URL. Instead of caching a version generated by the information in their database.
Definitely a flaw in the webpage. Of course sears is attempting to cry hacker and a few sites are reporting it as \"hacking\".
@Corporate_guy: Well, it does constitute unauthorized modification of data on a Sears server, even if it's just the cache server and not the underlying DB. It's certainly not \"hacking\" in terms of the technical expertise required, but it's probably \"hacking\" in the sense that the FBI could choose to follow-up.
@bwcbwc: Not in any way. This is not hacking in any sense of the word. Nor could this even be called a crime in any way. This is not hacking. Say a site allowed you to type out a document that only you can see in your browser. But a glitch caches that document and it now comes up by default and is displayed by other users. This is exactly what is going on here. Something that should only be seen by the user doing it, is being displayed to other users.
The people who were making these funny links didn't even know the stuff would be cached. A thread on reddit was laughing about it and mid way through people realized the links were cached and were being served up to other users. What makes sears \"hacker\" response really bad is that sears knew about this post as they asked for it to be hidden. They knew full well it was people joking around with the links who mid way through found out sears was copying the input and showing it to other users.
Sears had no grounds to call it \"hacking\".
@Oranges w/ Cheese - now with 50% more kitty!:
I haven't seen what the URLs looked like at Sears.com, but many sites, including Amazon.com and Consumerist.com, put that sort of information in the URL just to make the URL somewhat readable. You see [consumerist.com] and you wonder WTF that is, but you see sears-caught-selling-grills-to-cook-babies-thanks-to-poorly-built-website at the end and you know what that URL will take you to. Amazon puts product names in the URL for the same reason. Presumably Consumerist and Amazon don't actually USE that information when the user visits that URL - it's just for the user's information. That's the difference between what Consumerist does and what Sears does. But I don't see what the big deal is about what Sears was doing - it has no negative impact on anyone.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-1184475-100x100.png\")
@sqlrob:
I disagree with that, unless we're talking about overworked, underpaid, massively disgruntled developers. Then yeah. ^^
I've worked with several that were quite proud of doing a good job of things and didn't cut corners, they even pointed out missed scenarios.
Granted.. we're all overworked, massively disgruntled and underpaid right now >.>
Of the ones I've had the pleasure of interviewing, it's 1:10, if that. Error checking and handling, and parameter checking is a lost art.
Wow reddit is on fire today. That was a huge mistake by SEARS as it may have just gone by unnoticed. Now its sure to make cnn and other news networks.
Kmart was also selling \"Dead cats in a sack\" beds (specifically, a serta pet bed).
Let's also not forget the \"You Lazy Bastard\" garage door opener.
(I have caps, I'll upload them somewhere later if anyone cares).
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-261962-100x100.png\")
\"Fuck Sears for trying to fix their mistake!\"
I'll admit that Sears (or anyone for that matter) trying to get information off the Internet is pretty ludicrous, but how about, \"fuck reddit for being a bunch of whiny babies\". Their response is just silly, but then again this is the Internet (again).
@madog: I admit the reaction from Reddit is strong, but screw em? Really? I think that's a little much. Sears over reacted, and Reddit just made a zillion Sears post so they can't all be deleted.
@madog: Their response is not silly. Sears was actually lying by saying they were victimized and someone was defacing their pages. The guy who brought up the topic on reddit didn't even know the funny pages were cached. Mid topic someone noticed the funny variables were coming up even when removed from the URL. There was no malicious intent here. Sears just screwed up when making their site. No one intended for these variables to be served up to other customers. Sears should have admitted their was a flaw in their website, said they fixed it and moved on.
@Corporate_guy: Just because there's a flaw in Sears website, doesn't mean it's legal for people to go poisoning their cache. This is probably one of the most easily exploitable website bugs at a major retailer since the dot-com boom, but it's still illegal to exploit it.
Mammas, don't let your babies grow up to be Sears webmasters...
This is funny because Sears' entire web presence seems to be limited to randomly spamming people. I was added to one of their e-mail lists without my consent, and I contacted them and they said they had no way to know how I was added, and I could unsubscribe, which would be admitting I had subscribed in the first place.
How much longer until the Sears deathwatch starts?
what's really killing Sears' retail sales is the fact they no longer carry John Henry brand men's business attire. When you can buy a full suit for less than $80, does it matter what kind of material it's made from? I posit to you all that no, it does not. Just don't wear it too often, or it will literally fall apart on you.
I remember my old manager honoring a print-out some kid brought in of an online Sears Xbox add, and the price was $150. Clearly the kid copied the page and edited it (even the image was broken, he just stole the source code and changed the text), and even with me pointing this out, my manager still gave it to him for that price. As frustrated as I was, it just gave me all the more reason to get that Husqvarna 22\" chainsaw for half the price with the same shenanigans.
well, they probably wouldn't have been tempted to cut those corners if management would stop making unreasonable requests and would invest some more money in development...
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-1034061-100x100.png\")
@snapdoodle: Sears used to have a better (though still not good) website. They spent money to make it worse--like Consumerist.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-34412-100x100.png\")
Yeah, I don't see what the big deal is. Sears had a minor flaw in their website, some people got a chuckle out of it, Sears fixed the problem, and now it's time to move on.
If the website flaw exposed account information AND Sears tried to cover up their tracks, then it would be worth complaining about.
Seriously, Reddit people are whiners and they're trying to make a mountain out of a molehill. Almost as bad as Digg people.
This is funny, but I don't see how it's an issue. It did remind me of this mod for The Sims 2, though. [www.modthesims.info]
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-342256-100x100.png\")
I love small children, but I can't eat a whole one at one sitting.
I would have come up with somthing far more offencive than that if given the opportunity.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-428567-100x100.png\")
And here I thought it would turn out that the grill was actually used to cook FOR babies ...
or maybe to cook FORTY babies ...
or maybe to cook FOR forty babies ...
I guarantee Chris Walters here has no place to make any comments about any Sears web developer's \"incompetence\". If he did he would have realized that this was a total non-issue, a customer would have to direct link to the page WITH the exact variables that the user cached at the beginning of the day to view the issue. FAIL
@yourfriendbrett: I think it's a shame that any discussion of the issue fails to highlight the \"real wtf\" that the server would output cache the content of the page onto the products base page. If you visited a url in which you replaced the grill's category name with grill for cooking babies, or whatever the one that caught on was called, it would get cached for anyone viewing that product (and not just through the supplied link), so no you did not need a direct link with the passed variables, just visiting the product through the site itself, or a standard product link would show it. FAIL back atcha.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-376262-100x100.png\")
Really? 'cuz the \"Body Part Roaster\" isn't just as good?
Reddit really doesn't like to be censored. The website takes it's user-generatedness very seriously, and reacts quite strongly whenever an organized outside attempt to influence the site is detected. We don't want to be Digg.
I'm surprised by the sheer volume of anti-Sears stuff on the front page of Reddit, sure. However knowing what I do about the site, only mildly so. Sears is just lucky they didn't mess with /b. Yes, from now on, Sears is sure to be a meme, OK. But if they'd messed with /b.... Ya know... Those guys can take down freakin Twitter.
Despite Sears' flaws, craftsman hand tools are top notch and they have the mother of all cool ass power tools called the \"twin cutter\" it has dual opposing rotating blades (as I remember it) and looks like it was specifically designed for the zombie-pocalypse.
The re-design is bleh but the original looked and felt quite impressive. The first time I saw it I thought it was specifically made for serial killers because they say \"it cuts through anything\"...
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-488475-100x100.png\")
Ha ha ha! That is really funny. I liked the Fucking Big Ass Saws.
\"Until it was fixed, you could simply change category values in the URL and they'd show up on the page, which meant you could send your friends and family to all sorts of creatively named product listings\"
I'm eagerly awaiting the first post in that category.
This isn't really a security hole... if that page isn't linked to, who really cares if the user is futzing with the url?
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-145065-100x100.png\")
As a web developer for a company that does basically nothing but this, I can tell you this stuff falls through the cracks all the time.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-1175017-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-1017764-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-929652-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-529488-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-9110-100x100.png\")
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-1020806-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-652073-100x100.png\")
![[farm3.static.flickr.com]](\"http://farm3.static.flickr.com/2435/3842825451_a7175d8fe1_o.jpg\"){kind=link}
![Cats](\"http://img249.imageshack.us/img249/8003/catsu.png\"){kind=link}
![Lazy](\"http://img40.imageshack.us/img40/3295/lazyn.png\"){kind=link}
![[kimag.es]](\"http://kimag.es/share/6916697.png\"){kind=link}
FBA Saw was probably an offshoot of BFG. (pun intended...)
@Hanshiro: It was really hilarious to start with but what tipped it over was the \"Tools Yo\"
@Hanshiro:
Oh Emm Eff Gee.
That is probably one of the greatest pictures I have seen EVER.
Even cooler that it's not photoshopped.
The seventh-grader in me is giggling like an idiot. Unfortunately, the grown-up me on the outside is joining in.