Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.



BDFL
49739 posts

Uber Geek
+1 received by user: 4521

Administrator
Trusted
Geekzone
Subscriber

Topic # 114180 11-Feb-2013 12:36 One person supports this post Send private message

Another Trade Me competitor, and this one seriously security flawed. If they fix this before the post goes live (I doubt it), just check the SQL Injection (click for larger image):



People won't learn, will they? Another case of bad Wheedle in progress. And probably people who thought Cloudflare would automatically make their site safe... 

Thanks to this tip on Twitter.




View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
511 posts

Ultimate Geek
+1 received by user: 1

Trusted
Kiwi Dev Studios

  Reply # 759444 11-Feb-2013 13:01 Send private message

Thanks for referencing my tweet.

Yep, another site that hasn't taken warning from previous ones.. Security 101 Fail.

Come on developers, focus on security!




--
Stephen
twitter/ NZCoderGuy / KiwiDevStudios

Kiwi Dev Studios


1718 posts

Uber Geek
+1 received by user: 112

Trusted

  Reply # 759469 11-Feb-2013 13:18 One person supports this post Send private message

you should read their "About us" page

"At the end of the day if I swap my vehicle for a pair of running shoes you can't come to my house and tell me I can't do that", (this is what really pissed me off and Trademe to the day have refuted ever happened) she then responded by yelling down the end of the phone at me with "YES I CAN" I said no you f%$#@g can't and I hung up.


not really something you should put on your business website....

and thats some serious SQL oversight.

Awesome
3968 posts

Uber Geek
+1 received by user: 562

Trusted
Subscriber

  Reply # 759501 11-Feb-2013 14:03 Send private message

"Unlike everyone else coming into the market we are not rich trying to get richer."

Just because you have an axe to grind with Trade Me, doesn't mean you have any chance of competing with them. In fact their about us page just makes them look stupid.

I don't know why people even waste their time trying to compete with Trade Me.




Twitter: ajobbins

849 posts

Ultimate Geek
+1 received by user: 49


  Reply # 759503 11-Feb-2013 14:06 Send private message

ajobbins: "Unlike everyone else coming into the market we are not rich trying to get richer."

Just because you have an axe to grind with Trade Me, doesn't mean you have any chance of competing with them. In fact their about us page just makes them look stupid.

I don't know why people even waste their time trying to compete with Trade Me.


Economically it makes sense, there will be niches that a monopoly will choose not to invest in which makes a site worthwhile. Although that being said, the cost of development is low (relative to return) so Trademe can see off most competitors relatively easily.

Jon

58 posts

Master Geek
+1 received by user: 9

Trusted

  Reply # 759545 11-Feb-2013 14:53 Send private message

Had a quick look at the site, lots of test listings that I would have thought would have been removed prior to going live (I can understand needing these for pre-production testing. When I hit the Sell an Item button from anywhere on the site I get a page similar to the one above (Unhandled Exception).
Why do these guys come out swinging saying they are going to take on Trademe? I guess it gets you an interview on Firstline and a bit of publicity, but wouldn't it be easier to build a robust site, gain a following over time and then go toe-to-toe with the big guys (remember, Trademe was operating for a few years before it became successful)
I wish these guys and Wheddle all the best, competition is good, but perhaps they'd be better off taking each other on before lining up Trademe.




Matt East

SnapComms Ltd

Awesome
3968 posts

Uber Geek
+1 received by user: 562

Trusted
Subscriber

  Reply # 759556 11-Feb-2013 15:12 Send private message

I personally think the whole 'competition is good' is a very double edged sword in this industry.

Sure, Trade Me can effectively set monopoly prices - however, having competition in the market is also bad for buyers and sellers.

These kind of marketplaces work best when you have the maximum number of buyers and sellers in the same place. As a buyer, you get maximum choice, and as a seller you have a bigger audience.

As soon as you get competition, you have fewer buyers and sellers in a single place, and you then end up with lower prices for items, and less choice. This was VERY evident when Zillion was around. Sellers who listed on both often reported lower sale prices on Zillion compared to Trade Me for the same items. There was less people to sell to on Zillion, and so people were reluctant to spend time listing there. As there were less items, people didn't bother looking there.

As a seller, yeah you might save a few bucks on another site with lower fees......but if you are selling for a lower price anyway, it's probably not worth it.

Online auctions is a bit of a winner takes all market. There aren't many (any?) examples that come to mind where two online auction marketplaces directly compete successfully. Zillion gave it a bloody good crack, but after a few years they finally realised there wasn't room for two.

IMO - Their is probably opportunity to have a marketplaces that does better at some other niches Trade Me do not cover well - but competing directly with them is purely a waste of time and money. For example, you have Mighty Ape which doesn't compete with TM directly, but covered a slightly different market - and is a specialist at Games, Movies, Books etc. Amazon vs. eBay vs. Craigslist is another good example.




Twitter: ajobbins

2113 posts

Uber Geek
+1 received by user: 41


  Reply # 759569 11-Feb-2013 15:36 Send private message

I just tried to sign up to the site and firstly couldn't get past the details screen without putting in a mobile number even though it doesn't say the field is required. (until you click submit)
And then it kept saying the captcha I was entering was wrong and I tried half a dozen times then gave up.




58 posts

Master Geek
+1 received by user: 9

Trusted

  Reply # 759571 11-Feb-2013 15:41 Send private message

You also cannot see what the membership rates are, until you've signed up...not sure I want to hand over all my personal details (including mobile phone number) to a company I've only just heard about today. Pop the membership rates on the site where I can see them...before I make the decision to sign-up. Anyone who has signed up care to post them here?




Matt East

SnapComms Ltd



BDFL
49739 posts

Uber Geek
+1 received by user: 4521

Administrator
Trusted
Geekzone
Subscriber

  Reply # 759871 12-Feb-2013 08:05 Send private message

Contacted the owner directly using the registrar details and received this:

"Just a little note, unhandled exemptions show as we used framework to build the site. Our development team run a very successful international classified website. The site is as secure as can be."





1562 posts

Uber Geek
+1 received by user: 215


  Reply # 759874 12-Feb-2013 08:21 Send private message

freitasm: Contacted the owner directly using the registrar details and received this:

"Just a little note, unhandled exemptions show as we used framework to build the site. Our development team run a very successful international classified website. The site is as secure as can be."



Rather a defensive response. 

Not even a thanks or acknowledgement.  

Maybe they would prefer being in the news? 

335 posts

Ultimate Geek
+1 received by user: 29


  Reply # 759897 12-Feb-2013 09:18 Send private message

freitasm: Contacted the owner directly using the registrar details and received this:

"Just a little note, unhandled exemptions show as we used framework to build the site. Our development team run a very successful international classified website. The site is as secure as can be."



If they do indeed run a successful website then surely they know that displaying errors is a fairly big no no. A lot of frameworks these days have the option of running in test/dev/production modes which set the error settings to different levels. 




Web development blog: http://www.devhour.net
Follow me on twitter: @JAGracie

1718 posts

Uber Geek
+1 received by user: 112

Trusted

  Reply # 759909 12-Feb-2013 09:41 Send private message

the SQL injection problem proves its not even close to being secure, and the owner clearly doesn't know much about web security.

511 posts

Ultimate Geek
+1 received by user: 1

Trusted
Kiwi Dev Studios

  Reply # 759914 12-Feb-2013 09:53 Send private message

indeed. the owner is going to be embarrassed, when the site either gets owned, or breaks completely!




--
Stephen
twitter/ NZCoderGuy / KiwiDevStudios

Kiwi Dev Studios


112 posts

Master Geek


  Reply # 760038 12-Feb-2013 13:06 Send private message

Whoops, 500 errors on the homepage now...

http://cl.ly/image/0T391E1y0p3t

Awesome
3968 posts

Uber Geek
+1 received by user: 562

Trusted
Subscriber

  Reply # 760056 12-Feb-2013 13:30 One person supports this post Send private message

Man the people running this site come across as very arrogant and entitled.

It actually makes me look forward to seeing them fail hard.




Twitter: ajobbins

 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic




Twitter »
Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:




News »

Trending now »
Hot discussions in our forums right now:

Windows 10 announced, as well as developer preview
Created by macuser, last reply by Behodar on 2-Oct-2014 11:24 (74 replies)
Pages... 3 4 5


Moment of Truth?
Created by BarTender, last reply by JimmyC on 29-Sep-2014 09:16 (441 replies)
Pages... 28 29 30


Can i have 2 ISP's at home?
Created by ReckITT, last reply by Lazarui on 30-Sep-2014 18:15 (49 replies)
Pages... 2 3 4


Why is your nickname what it is, what are the origins of it?
Created by Presso, last reply by xontech on 2-Oct-2014 11:02 (91 replies)
Pages... 5 6 7


What time will the Apple Store online be selling the iPhone 6?
Created by scotiwis, last reply by Bextinaa on 2-Oct-2014 09:53 (121 replies)
Pages... 7 8 9


iPhone 6 From Spark - Order Dates and Pricing?
Created by Otagolad, last reply by mahdibassam on 1-Oct-2014 17:03 (348 replies)
Pages... 22 23 24


Easiest way to have iPhone warranty service
Created by JoshWright, last reply by nitrotech on 30-Sep-2014 21:37 (15 replies)

Registering with metaname
Created by freitasm, last reply by freitasm on 30-Sep-2014 18:16 (13 replies)


Geekzone Live »
Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.