Trades 'n' Swaps

Forums › Startups › Trades 'n' Swaps

freitasm

BDFL
44246 posts

Uber Geek

Administrator

Trusted

Geekzone

Subscriber

Topic # 114180 11-Feb-2013 12:36	One person supports this post
Another Trade Me competitor, and this one seriously security flawed. If they fix this before the post goes live (I doubt it), just check the SQL Injection (click for larger image): People won't learn, will they? Another case of bad Wheedle in progress. And probably people who thought Cloudflare would automatically make their site safe... Thanks to this tip on Twitter. Mauricio Freitas (Geekzone Admin, Devil's Advocate, my blog, technology disclosure, my tweets, Web Performance Optimization) Geekzone Price comparison \| Amazon Kindle order page \| How to get the best out of Geekzone \| New Zealand IT Jobs \| Geekzone News \| Jinglebugs

1 | 2

510 posts

Ultimate Geek

Trusted

Kiwi Dev Studios

Reply # 759444 11-Feb-2013 13:01
Thanks for referencing my tweet. Yep, another site that hasn't taken warning from previous ones.. Security 101 Fail. Come on developers, focus on security! -- Stephen twitter/ NZCoderGuy / KiwiDevStudios

reven

1205 posts

Uber Geek

Trusted

Reply # 759469 11-Feb-2013 13:18	One person supports this post
you should read their "About us" page "At the end of the day if I swap my vehicle for a pair of running shoes you can't come to my house and tell me I can't do that", (this is what really pissed me off and Trademe to the day have refuted ever happened) she then responded by yelling down the end of the phone at me with "YES I CAN" I said no you f%$#@g can't and I hung up. not really something you should put on your business website.... and thats some serious SQL oversight. www.reven.co.nz

ajobbins

Awesome
3090 posts

Uber Geek

Trusted

Subscriber

Reply # 759501 11-Feb-2013 14:03
"Unlike everyone else coming into the market we are not rich trying to get richer." Just because you have an axe to grind with Trade Me, doesn't mean you have any chance of competing with them. In fact their about us page just makes them look stupid. I don't know why people even waste their time trying to compete with Trade Me. Twitter: ajobbins

jonherries

707 posts

Ultimate Geek

Reply # 759503 11-Feb-2013 14:06
ajobbins: "Unlike everyone else coming into the market we are not rich trying to get richer." Just because you have an axe to grind with Trade Me, doesn't mean you have any chance of competing with them. In fact their about us page just makes them look stupid. I don't know why people even waste their time trying to compete with Trade Me. Economically it makes sense, there will be niches that a monopoly will choose not to invest in which makes a site worthwhile. Although that being said, the cost of development is low (relative to return) so Trademe can see off most competitors relatively easily. Jon

MattEast

31 posts

Geek

Trusted

Mighty Ape

Reply # 759545 11-Feb-2013 14:53
Had a quick look at the site, lots of test listings that I would have thought would have been removed prior to going live (I can understand needing these for pre-production testing. When I hit the Sell an Item button from anywhere on the site I get a page similar to the one above (Unhandled Exception). Why do these guys come out swinging saying they are going to take on Trademe? I guess it gets you an interview on Firstline and a bit of publicity, but wouldn't it be easier to build a robust site, gain a following over time and then go toe-to-toe with the big guys (remember, Trademe was operating for a few years before it became successful) I wish these guys and Wheddle all the best, competition is good, but perhaps they'd be better off taking each other on before lining up Trademe. Matt East

ajobbins

Awesome
3090 posts

Uber Geek

Trusted

Subscriber

Reply # 759556 11-Feb-2013 15:12
I personally think the whole 'competition is good' is a very double edged sword in this industry. Sure, Trade Me can effectively set monopoly prices - however, having competition in the market is also bad for buyers and sellers. These kind of marketplaces work best when you have the maximum number of buyers and sellers in the same place. As a buyer, you get maximum choice, and as a seller you have a bigger audience. As soon as you get competition, you have fewer buyers and sellers in a single place, and you then end up with lower prices for items, and less choice. This was VERY evident when Zillion was around. Sellers who listed on both often reported lower sale prices on Zillion compared to Trade Me for the same items. There was less people to sell to on Zillion, and so people were reluctant to spend time listing there. As there were less items, people didn't bother looking there. As a seller, yeah you might save a few bucks on another site with lower fees......but if you are selling for a lower price anyway, it's probably not worth it. Online auctions is a bit of a winner takes all market. There aren't many (any?) examples that come to mind where two online auction marketplaces directly compete successfully. Zillion gave it a bloody good crack, but after a few years they finally realised there wasn't room for two. IMO - Their is probably opportunity to have a marketplaces that does better at some other niches Trade Me do not cover well - but competing directly with them is purely a waste of time and money. For example, you have Mighty Ape which doesn't compete with TM directly, but covered a slightly different market - and is a specialist at Games, Movies, Books etc. Amazon vs. eBay vs. Craigslist is another good example. Twitter: ajobbins

CYaBro

1816 posts

Uber Geek

Reply # 759569 11-Feb-2013 15:36
I just tried to sign up to the site and firstly couldn't get past the details screen without putting in a mobile number even though it doesn't say the field is required. (until you click submit) And then it kept saying the captcha I was entering was wrong and I tried half a dozen times then gave up. Computer Repairs Whangarei Remote Support

MattEast

31 posts

Geek

Trusted

Mighty Ape

Reply # 759571 11-Feb-2013 15:41
You also cannot see what the membership rates are, until you've signed up...not sure I want to hand over all my personal details (including mobile phone number) to a company I've only just heard about today. Pop the membership rates on the site where I can see them...before I make the decision to sign-up. Anyone who has signed up care to post them here? Matt East

freitasm

BDFL
44246 posts

Uber Geek

Administrator

Trusted

Geekzone

Subscriber

Reply # 759871 12-Feb-2013 08:05
Contacted the owner directly using the registrar details and received this: "Just a little note, unhandled exemptions show as we used framework to build the site. Our development team run a very successful international classified website. The site is as secure as can be." Mauricio Freitas (Geekzone Admin, Devil's Advocate, my blog, technology disclosure, my tweets, Web Performance Optimization) Geekzone Price comparison \| Amazon Kindle order page \| How to get the best out of Geekzone \| New Zealand IT Jobs \| Geekzone News \| Jinglebugs

surfisup1000

640 posts

Ultimate Geek

Reply # 759874 12-Feb-2013 08:21
freitasm: Contacted the owner directly using the registrar details and received this: "Just a little note, unhandled exemptions show as we used framework to build the site. Our development team run a very successful international classified website. The site is as secure as can be." Rather a defensive response. Not even a thanks or acknowledgement. Maybe they would prefer being in the news?

Kingy

152 posts

Master Geek

Reply # 759897 12-Feb-2013 09:18
freitasm: Contacted the owner directly using the registrar details and received this: "Just a little note, unhandled exemptions show as we used framework to build the site. Our development team run a very successful international classified website. The site is as secure as can be." If they do indeed run a successful website then surely they know that displaying errors is a fairly big no no. A lot of frameworks these days have the option of running in test/dev/production modes which set the error settings to different levels.

reven

1205 posts

Uber Geek

Trusted

Reply # 759909 12-Feb-2013 09:41
the SQL injection problem proves its not even close to being secure, and the owner clearly doesn't know much about web security. www.reven.co.nz

NZCoderGuy

510 posts

Ultimate Geek

Trusted

Kiwi Dev Studios

Reply # 759914 12-Feb-2013 09:53
indeed. the owner is going to be embarrassed, when the site either gets owned, or breaks completely! -- Stephen twitter/ NZCoderGuy / KiwiDevStudios

phindmarsh

112 posts

Master Geek

Reply # 760038 12-Feb-2013 13:06
Whoops, 500 errors on the homepage now... http://cl.ly/image/0T391E1y0p3t

ajobbins

Awesome
3090 posts

Uber Geek

Trusted

Subscriber

Reply # 760056 12-Feb-2013 13:30	One person supports this post
Man the people running this site come across as very arrogant and entitled. It actually makes me look forward to seeing them fail hard. Twitter: ajobbins

1 | 2