Posted by 882542F3884314B 16 hours ago
Google and Apple are throttling hotfix updates (for app developers) as tons of code pushes to their infra (by vibe coders) is straining their system.
The are fixing this by throttling updates to minimum 3 days review period.
so good luck fixing the vulnerability or data leaks in your apps.
This seems to rhyme with "Don't worry, the spammers will tire out"
Narrator: "The spammers in fact, did not tire out"
Meanwhile.. have you ever paid for a vibe-coded anything? Why would you, when you (along with everyone else) can slop the same thing together in a weekend with a $20 CC subscription?
I wonder whats next, I feel it might be a huge swing of the pendulum next.
It's not needed. There are already alternatives that could take its place. Some of them are able to actually show you what data leaked instead of leaving you blind of what was actually included in the breach.
https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...
We get a "your private data is now public" email, but knowing exactly what data turns that from a depressing statement on how much corporations value their customers' privacy into something actionable.
There seems to be some amount of entitlement by people in this thread to get information from a third party about what a first party to them lost.
The first party that lost your data should be the one that shows you exactly what was compromised.
It could show the hash instead.
>No, it's not ok that these passwords are already out there
So it's better that people have to pay for it instead of getting this information for free?
>Because it's important to say "I don't store passwords in HIBP"
This is a personal choice.
>I'm not your personal lookup service
The idea is that this would be done by the site itself and would not require manual work by the owner.
Passwords shouldn't matter anyways. Use a password manager and be done with it. The real issue is metadata which can't easily be changed - phone numbers, addresses, and the like. If any of that data is leaked, it becomes much harder to contain impact. You can't move addresses every time your address gets leaked online.
(This is not an advertisement.)
Maybe it isn't needed
Originally HIBP and other websites used data breach dumps to solicit further data collection^1, e.g., with a fear-based, clickbaity title like "Have I been pwned?"
Maybe HIBP serves the author, maybe that's why it's "needed"
For example, it brings him notoriety
For example, he can promote his other cybersecurity website via HIBP and paid speaking engagements
The author has expressed dissatisfaction that companies are being penalised for data breaches through class action litigation, including any compensation users might receive as part of these settlements
He believes there is no user injury
https://www.troyhunt.com/data-breaches-class-actions-and-amb...
If that's his position, if he believes users are unharmed by data breaches, then what's the point of HIBP
Is it to support the companies who are collecting data and then being breached (not the users to whom the data belongs)
1. Data collection being the root cause of the data breach problem
2. He validates the breaches through a network of volunteers who check if the credentials are real.
3. He provides an easy-to-use service for free.
What is your alternative? Having each person run their own agent scanning the corners of the internet, downloading breaches, and looking for their own accounts? What the point of that?