eBay eBabe enigma explained: Microsoft bug blamed after topless model slings e-souk's emails at stunned Brits We've all seen some wild bugs, but this one is just baffling. On Friday evening, we reported that some Register readers, among other netizens, got an eyeful in their Microsoft's Outlook mobile app inboxes: invoices, delivery alerts, and other emails from eBay UK appeared to be sent from a topless busty babe. Specifically, the …
In the event of a hash collision, all parties would be protected by Bulgarian airbags.
A few years back my logs showed a popular seller on eBay was hotlinking to one of the JPEG images on my website for their avatar. I noticed it because the user was very active on eBay forums so I was seeing thousands of hits a day - the user would have five forum posts on one page, so five avatars, times a few hundred page views a day, for each forum page. You get the idea.
I remember wondering why eBay allowed an external image instead of uploading an avatar. Hotlinking was a big deal to me as my website was getting popular and hotlinking was stealing plenty of bandwidth and screwing up my stats before I put in protections. I repeatedly messaged the user, sent maybe a dozen complaints to eBay - all were ignored.
Finally after a week of this guy stealing my bandwidth I decided to replace the image they were linking to with an image of the male anatomy. This was the user's avatar for about a day before I saw their account was suspended. I'm wondering if this might be a similar situation & the avatar was Webmaster's Revenge?
Hash collision is one option, but I'd guess that would be a backend thing, and MS is telling people to update their apps...
Hash collision or not, it is somewhat worrying. It means there is room for error in the way Outlook serves data belonging to a certain account. This time it's just an avatar, but it makes you wonder if the same might happen to an actual mail for example. That would potentially be, erm, even more interesting.
Presumably there is an image store with all the profile images stored which is also used by MS to store the default image and populate the emails?
Plus some weird naming of the default image?
Or finger trouble with an update which pointed to the user area instead of the system area?
I think efforts should be made to get enough information for a "who me?" story. This does have the feel of a naming policy which was vulnerable to a minor configuration slip.
Alternatively the developer used their own chosen image file from their personal profile by mistake?
Edit: if someone could disassemble the App (since this seems to be cured by updating the App) it might be instructive to see the path name used.
For some reason it reminded me of the Test Card.
I can recall said test card, and I must say the young lady has certainly gotten all grown up nicely now :o)
I also have to add, I REALLY do need to come visit and see just what you consider to be a test card LOL
Wife sees message with that avatar, immediately assumes that her techie hubbie is spoofing his mistress's email address to disguise hot talk as innocent eBay updates, won't listen to any excuses ... ah, the opportunities for strife.
Seriously, it would be interesting to know how this occurred, especially if it is a hash collision as someone suggested. The odds ought be astronomical, but as the late Terry Pratchett said: "Million-to-one chances crop up nine times out of ten". Perhaps the hashing algo they use was designed for a couple orders of magnitude fewer email addresses ...?
A colleague added some code to the OS which he knew had a statistical chance of hitting a boundary condition - so he made it type an operator console message if it ever happened.
He calculated the long odds and went ahead in the live system. He had the odds right - but hadn't realised how many times his code would get obeyed. In computers a million iterations can take only a few minutes.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
