Exactly, it's not necessary. It's bad / lazy design. You don't expose the DB storage directly, you expose a frontend that handles all the authentication and validation stuff before accessing the DB on the backend. That's normal Client-Server-Database architecture.

I don't think creating an incel style circlejerk is the best solution.

please tell me you did not just use ted bundy to describe what you think women like in men?

I did, because he was. Two different ways.

1. Bundy's modus operandi was to approach women in public as a handsome, charming stranger. I'm pretty sure women like handsome, charming strangers; the entire female dating strategy seems to be geared toward attracting handsome, charming strangers. Ted Bundy was able to attract dozens of victims like that. There's an inherent danger in attracting strangers, because sometimes strangers are psychopaths.

2. Ted Bundy got a LOT of fan mail from women while he was in prison. Love letters, marriage proposals, nude photos. A shocking number of women saw his picture on the news alongside words like "murder trial" and "death sentence" and said "That's the man for me." He pulled some weird stunt to "get married" and he fathered a child from prison. This isn't unique to Ted Bundy, lots of mass murderers and serial killers have groupies, from Charles Manson to Dylan Klebold.

i said doxxing should be avoided, if you’d read any of my comments.

You came across as pretty lukewarm to me. "Yeah doxxing is a problem I guess." You can't have a Don't Date Him Girl website without doxxing. Doxxing is how they work.

A more ironic outcome couldn't have happened

What intrigue me is this:

I'm confident vibe coding was not to blame in this particular case,

So they used vibe coding, they are only saying that they think/hope that it is not the cause of the break (and maybe also of the second one)

And if vvibe coding is not caused then they are even more incompetent.

I agree. Some sort of solution is necessary but this probably isn't it.

skipped everything about ted bundy cause wtf you're obsessed, man. maybe join a bundy dating app?

also let me make it clear since you missed it last time (even though you quoted it). I think doxxing is bad and should be avoided. fuck's sake man. i am a commenter, not a politician. i read this stuff over breakfast. take it easy ffs.

not everything has to be a huge debate.

I think there must be a way to deliver on the value of the app without it being the privacy/public exposure nightmare it sounds like. Speaking naively, perhaps a setup where you can only speak about a person with those who have actually matched with them.

I get doing that in Dev for testing before launch, but in production? that’s insane.

Like it has to either be a junior developer playing the role of lead or some serious lack of web dev fundamentals haha

There’s no “matching” on this app, because men aren’t allowed. By its very design, you can’t avoid the unilateral one-sidedness.

Sorry, I do understand that, I was just thinking of an improvement that might help. I thought having the same phone number might work too but that gets dodgier.

How many red flags do you need to collect before you get a free cat?

that's a great(terrible) idea for a sex trafficking psyop. just get yourself a female spokesperson and make it a platform that gives a voice to women who have survived abuse. they'll willingly give you all their information on where to find them and their psych profiles on how to manipulate them.

fucked up, but really shows how fucked up apps are in general and how much power we give to them over ourselves.

the app is called TEA - it is a gossip vector masquerading as a safety mechanism, and people are making all sorts of claims about innocent people they had a bad date about, including their full name, location, workplace, pictures of their face - and accusing them baselessly in some (or most) instances of violent crimes.

If you can't see how not only that wouldnt make women safer, but instead is a black mirror episode - there's something wrong.

People against this app aren't against women's safety, and they dont necessarily believe our current systems and protection are adequate - but getting lynched by half a city because of a jaded ex is not a solution and is a crime of its own.

I mean half the posts on similar Facebook groups complain about the men being "narcissists" yeah its a shitty personality trait but thats clearly not a fucking safety issue, its about gossiping and doxxing people.

Sounds MAGA level IT and dev.

I'd argue that it should not even be done in Dev. Dev, staging/testing, and prod environments should all be as close to one another as possible, especially for infra like datastores.

As I mentioned in other comments, I am a noob when it comes to web-sec; please forgive what may be dumb questions.

There's nothing to forgive. Asking questions and being curious is how you learn this stuff.

Is it really just permission rights "over-exposure" issue?

From what I've read, it's more fundamental than that. It's a basic architecture issue. The datastore was publicly accessible, which it should never be. If they had it setup according to best practices, with an API to proxy access and auth, the datastore's permissions would be of minimal consequence, unless their network was compromised (still best practice to secure it and approach with a zero-trust mindset).

Or does one need to also encrypt and then decrypt the data itself that must be sent to a database?

Generally, cloud datastores handle encryption/decryption transparently, as long as the account accessing data has authorization to use the key. They probably also didn't have encryption setup.

Also, if you have time, recommend any links to web/cloud/SaaS security best practices "for dummies"?

Here are some more resources:

• https://cheatsheetseries.owasp.org/cheatsheets/Secure_Cloud_Architecture_Cheat_Sheet.html
• https://www.oreilly.com/library/view/security-architecture-for/9781098157760/
• https://www.oreilly.com/library/view/cloud-computing-security/9780429619649/
• Check Humble Bundle

So confirmation bias. Gotcha. That's generally not a great way to make sweeping generalizations about 50% of the population.

You ever hear that adage about smelling shit wherever you go, maybe check your shoes?