Top all-time · #15596
Aditya Saligrama
Personal blog · saligrama.io/blog · on HN as saligramasecurityprogramming
Aditya Saligrama's personal blog at saligrama.io covers security and programming. Since 2022, 5 different Hacker News readers have linked it 9 times, most often “Firebase: Insecure by Default (that one time our classmates tried to sue us)”. It is still writing: the last post was on 2026-10-23, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for a technical writeup of the Firebase insecure-by-default issue, where the team found they could set isAdmin to true on existing accounts. Comments point to it for the details.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Software engineer; security & infrastructure enthusiast; Stanford alum
Most-linked posts?
- Firebase: Insecure by Default (that one time our classmates tried to sue us)5 people · 6 mentions · first linked 2023-08-28
What Hacker News says?
Ok, do you agree that they claimed the OWASP document supported their actions? Concerned about user privacy and security — and consistent with industry best practices [link to owasp] — we wrote a detailed email to the Fizz team [0] Do you disagree that the OWASP page states the below? Researchers should: Ensure that any testing is legal and authorised. [1] Ok, I can see how the OWASP document doesn’t use the words e…
Comment linking /blog/post/firebase-insecure-by-default/
on “When your classmates threaten you with felony charges”Submitted How to Create a Stanford Course as a story · 2 points
HN discussionhttps://news.ycombinator.com/item?id=37297823#37298972 Really what happened is we checked whether we could set `isAdmin` to `true` on our existing accounts, and... we were able to. Adi's more technical writeup has details: https://saligrama.io/blog/post/firebase-insecure-by-default/
Comment linking /blog/post/firebase-insecure-by-default/
on “When your classmates threaten you with felony charges”Submitted Flipping the script: when a hacking class gets hacked as a story · 2 points
HN discussionBaserunner [1] does exactly this. I described using it for Firebase security research in my blog post [2]. [1] https://github.com/iosiro/baserunner [2] https://saligrama.io/blog/post/firebase-insecure-by-default/
Comment linking /blog/post/firebase-insecure-by-default/
on “When your classmates threaten you with felony charges”Submitted How practical should computer science degrees be, anyway? as a story · 1 points
HN discussionReally what happened is we checked whether we could set `isAdmin` to `true` on our existing accounts, and... we were able to. Adi's more technical writeup has details: https://saligrama.io/blog/post/firebase-insecure-by-default/
Comment linking /blog/post/firebase-insecure-by-default/
on “When your classmates threaten you with felony charges”Submitted Firebase: Insecure by Default (that one time our classmates tried to sue us) as a story · 1 points
HN discussionI found this story about the same situation (linked from the OP) easier to follow: https://saligrama.io/blog/post/firebase-insecure-by-default/
Comment linking /blog/post/firebase-insecure-by-default/
on “When your classmates threaten you with felony charges”