> "we were all aware that the system could be abused"
I think we were all aware that the system could be abused to buy yourself an extra coffee every once in a while, if you happened to be in Starbucks when the card had money on it. We were all aware that you could overspend, either on yourself or "for charity" (witness Sam's comment about buying food for homeless guys.) If that was the only vulnerability, most of us would think it acceptable -- most of the time money you put on the card goes to brighten an honest person's day, but occasionally someone games the system.
Until the exploit was posted, I was not aware that it could be abused by skimming $50 at a time onto your own card within moments of it being deposited on the main card. This is an unacceptable level of exploitability -- if you put money on the card, it's very likely that it will go to a scammer of some sort.
I'm glad Sam exposed this far-more-serious-than-most-of-us-realized vulnerability. I'm not pleased with how he went about it (particularly the game he and his brother seem to be playing; Daniel's startup deposited exactly $625, the same amount Sam took.) I'm not pleased with the "yuppies buying coffee" vs "starving kids in Africa" comparison. But I'm glad this particular exploit has been exposed, which means we now have the opportunity to set up a better-and-safer version of Jonathan's Card.
I think we were all aware that the system could be abused to buy yourself an extra coffee every once in a while, if you happened to be in Starbucks when the card had money on it. We were all aware that you could overspend, either on yourself or "for charity" (witness Sam's comment about buying food for homeless guys.) If that was the only vulnerability, most of us would think it acceptable -- most of the time money you put on the card goes to brighten an honest person's day, but occasionally someone games the system.
Until the exploit was posted, I was not aware that it could be abused by skimming $50 at a time onto your own card within moments of it being deposited on the main card. This is an unacceptable level of exploitability -- if you put money on the card, it's very likely that it will go to a scammer of some sort.
I'm glad Sam exposed this far-more-serious-than-most-of-us-realized vulnerability. I'm not pleased with how he went about it (particularly the game he and his brother seem to be playing; Daniel's startup deposited exactly $625, the same amount Sam took.) I'm not pleased with the "yuppies buying coffee" vs "starving kids in Africa" comparison. But I'm glad this particular exploit has been exposed, which means we now have the opportunity to set up a better-and-safer version of Jonathan's Card.