<story><title>CurrentC Has Been Hacked, Testers’ Email Addresses Stolen</title><url>http://techcrunch.com/2014/10/29/retailer-backed-apple-pay-rival-currentc-has-been-hacked-testers-email-addresses-stolen/</url></story><parent_chain><item><author>steakejjs</author><text>This is a big problem I&amp;#x27;ve noticed with startups. Stupid web vulns are EVERYWHERE.&lt;p&gt;I&amp;#x27;ve reported so many serious web vulnerabilities to startups it isn&amp;#x27;t even funny (4-5 S14 YC batch alone). Account hijacks, XSS, SQLi. Everywhere.&lt;p&gt;If you are starting a startup (or writing any web software software),  PLEASE read OWASP to at least get an idea of what types of issues can exist in Web Applications. Their top 10 is a good place to start (&lt;a href=&quot;https://www.owasp.org/index.php/Top_10_2013-Top_10&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.owasp.org&amp;#x2F;index.php&amp;#x2F;Top_10_2013-Top_10&lt;/a&gt;)</text></item></parent_chain><comment><author>krapp</author><text>Startups optimize for fast growth and monetization with limited resources. Time spent securing a site is considered time wasted not improving SEO or user experience. It&amp;#x27;s already well known that people will sign up for an insecure site because they really don&amp;#x27;t care until something happens, and apologies after you&amp;#x27;ve gotten traction (and their money and&amp;#x2F;or data) are less risky than potentially going live later than sooner.&lt;p&gt;In other words, not only do many startups not care, they would consider application security to be actively harmful.&lt;p&gt;This is of course assuming they know. Vulnerabilities may exist in libraries, packages and frameworks which are not known about, or in the case of PHP, old and unsafe practices are easier to copy and paste and tend to proliferate on tutorial and Q&amp;#x2F;A sites.</text></comment>
<story><title>CurrentC Has Been Hacked, Testers’ Email Addresses Stolen</title><url>http://techcrunch.com/2014/10/29/retailer-backed-apple-pay-rival-currentc-has-been-hacked-testers-email-addresses-stolen/</url></story><parent_chain><item><author>steakejjs</author><text>This is a big problem I&amp;#x27;ve noticed with startups. Stupid web vulns are EVERYWHERE.&lt;p&gt;I&amp;#x27;ve reported so many serious web vulnerabilities to startups it isn&amp;#x27;t even funny (4-5 S14 YC batch alone). Account hijacks, XSS, SQLi. Everywhere.&lt;p&gt;If you are starting a startup (or writing any web software software),  PLEASE read OWASP to at least get an idea of what types of issues can exist in Web Applications. Their top 10 is a good place to start (&lt;a href=&quot;https://www.owasp.org/index.php/Top_10_2013-Top_10&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.owasp.org&amp;#x2F;index.php&amp;#x2F;Top_10_2013-Top_10&lt;/a&gt;)</text></item></parent_chain><comment><author>LesZedCB</author><text>While I totally agree this is important to know, CurrentC isn&amp;#x27;t a startup, it&amp;#x27;s a new program from an established company. These guys have made themselves a target, and it is very likely that no amount of good security would leave them totally invulnerable. The community&amp;#x27;s desire to make CurrentC look foolish is very high.</text></comment>