I don't mind seeing a duplicate here because this looks like a serious incident that may have been downvoted by Apify employees. I personally didn't see it til now despite checking HN very often.
If you check the thread you linked, Apify isn't being transparent about what data was in the leak. Someone posted it from an email they received and allegedly got downvoted, and then a response from an Apify employee.
mvolfik 15 hours ago [-]
Hi, sorry that you see it as low transparency. Incident handling takes some time (I know this is an annoying response), and our priority was to send specific information to the affected users. For legal and other reasons, there's naturally a slight embargo on public comms. But a public post-mortem with full details is definitely coming next week, the engineering culture here wouldn't let the management sweep this under the rug. And I expect that the post-mortem will make bigger numbers here on HN, once someone inevitably posts it here, as it's going to be more technical type of content.
Disclaimer: I'm an Apify employee. Not an official position of the company, opinion my own, yada yada
tptacek 1 days ago [-]
(The title is fixed now, and I don't so much care about how much exposure the story gets on the front page as I do that we not lose track of the previous thread. I live in a blissful state of not even knowing what an Apify is.).
RamblingCTO 21 hours ago [-]
I can tell you bc I was affected: my whole personal data, my payment information (I provide a bunch of scrapers), my biling information and stuff like this.
I don't know if they accessed the actor results themselves, but that's not an issue from me.
TZubiri 1 days ago [-]
The link is different, yesterday's post seems to be the status page. This is a post-mortem
mvolfik 14 hours ago [-]
nope, this is just status page detail of this specific incident
post-mortem coming next week (hopefully) :)
TZubiri 1 days ago [-]
I feel like an asshole posting a criticism of the whole dependency category every time they get a critical vuln.
But if you are building an API service, you don't need an API Management dependency. And it's an additional attack vector. You (as in an engineer or as a company that provides an API service) need to do the actual undelegable job of building an API, just do the work, do the HTTP server, do the rate limiting, do the OAuth integration.
Verdict: Time to uninstall software in the category of API Management. That is, if you want to be the very best. If you want to be mediocre, sure use some middleware that provides API, slap some API into your software so that customers that ask for API have API. Otherwise, engineer an external Application Programming Interface into your systems.
mvolfik 15 hours ago [-]
I mean, yes, but (unless I'm critically misunderstanding your comment) that's not what Apify is.
We're more like "a provider of APIs for the public websites that don't want to offer it" (hence the name), and in general an "automate the web & your work & give more tools to your AI agents" marketplace/runtime/platform.
Disclaimer: I'm an Apify employee. Not an official position of the company, opinion my own, yada yada
TZubiri 14 hours ago [-]
oh my bad, I mistook it for apigee
SudoSH 1 days ago [-]
[flagged]
radial_symmetry 1 days ago [-]
"- API tokens are now stored only as hashes, which limits the impact of any similar incident."
WTF were they not already?
shipsafestack 1 days ago [-]
[flagged]
bombcar 1 days ago [-]
The number of systems that will show me the API token more than once makes me realize that many haven't figured out it is just a long password and should be treated exactly as such.
0127 1 days ago [-]
Except maybe using faster hashing, depending on usage
https://news.ycombinator.com/item?id=50469719
If you check the thread you linked, Apify isn't being transparent about what data was in the leak. Someone posted it from an email they received and allegedly got downvoted, and then a response from an Apify employee.
Disclaimer: I'm an Apify employee. Not an official position of the company, opinion my own, yada yada
post-mortem coming next week (hopefully) :)
But if you are building an API service, you don't need an API Management dependency. And it's an additional attack vector. You (as in an engineer or as a company that provides an API service) need to do the actual undelegable job of building an API, just do the work, do the HTTP server, do the rate limiting, do the OAuth integration.
Verdict: Time to uninstall software in the category of API Management. That is, if you want to be the very best. If you want to be mediocre, sure use some middleware that provides API, slap some API into your software so that customers that ask for API have API. Otherwise, engineer an external Application Programming Interface into your systems.
Disclaimer: I'm an Apify employee. Not an official position of the company, opinion my own, yada yada
WTF were they not already?