• 0 Posts
  • 8 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle






  • This was a series of decisions with good intentions that went poorly in the long run.

    Our customer wanted us to setup a system so their users could track their products from their site from a variety of carriers; but their backend was very old and difficult to work with, and their network very locked down.

    We were struggling to setup a single carrier, so we eventually decided to setup a new server with modern tooling on our own network so we could develop this and other “complicated” features with less pain, and they would only have to make a single exception to their firewall.

    Fast forward a year and:

    • They didn’t request any more “difficult” features, so the server was serving a single API
    • One of our carrier’s API keys had expired and nobody noticed because they weren’t using it, and they didn’t request support for additional carriers either
    • Somebody on their security team noticed the strange calls to our servers and demanded we moved the API to their infrastructure anyway