Hacker Newsnew | past | comments | ask | show | jobs | submit | BobDaHacker's commentslogin

Also, I am not much of a football gal myself, so I didn't know they were a shitty org.


As much as I like being butt fucked, I dont wanna go to prison :3


Yeah I used Claude as a writing assistant for the initial draft. I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me. But I do edit it pretty heavily after, the voice and the jokes and the structure are mine, the AI just helps me get a baseline down so I'm not staring at a blank page. The research, the screenshots, the disclosure, that's all me. I've been doing this stuff for years.


My opinion is that this is a great story.

But the haters are going to hate.

If you had not used AI to fix your post, I bet the top post will be complaining about your grammar.

Some people will always find something negative. Simple as that.


While I appreciate the positivity, but I've honestly grown to appreciate grammar mistakes. Just like it's not X, it's Y indicated AI, those indicated that the effort behind was human.

Honestly, no need to write 4000 words if the story can be told in 400. The story is what matters, not word count or "flow".


I think the criticism is constructive. It's really not about hating. I'd wager many of the people who convey this criticism do use AI to aid their writing as well.

It's just that this one in particular lacks one more edit pass removing some of the AI noise on branding-speak and needless repetition (AI tends to list things and beat the point).


> If you had not used AI to fix your post, I bet the top post will be complaining about your grammar.

I'm positive that a post complaining about the grammar would've been (rightfully) downvoted to oblivion on this site.


I understand that it feels helpful but the post ends up repeating the same insight over and over. Reads very sloppy, while you wanted the opposite.


Don't take my criticism of AI writing as criticism of your work. This is stellar stuff! What I'm trying to say is I'd really like to hear it in your words.

I'm glad to hear the voice is yours, and I apologize for assume it was the AI's.


Great post. It was an amusing read, and quite the discovery! Good work, and great job documenting it.


Understandable, but open disclosure would help. You of all people must know how hard it is to hide things from being discovered, and this is something that will be discovered without any doubt. Just explain it and most reasonable people will understand. Some won't but at least they will be honestly warned.


> I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me.

I find the way I interact with the world is exceptionally different from the descriptions of everybody else. Some of the symptoms of such manifest as difficulty communicating... with most people.

There are a subset of people who I have not only no problem, but seemingly a drastically increased information exchange rate.

Do with that observation what you will, but I don't write for the lowest common denominator, the preferred style of AI, because I don't write for the people who cant be bothered to understand me. I'm writing for people like me.

n.b. Maybe you are writing for the lowest common denominator. In which case, say that: "Yeah I know it sounds like AI but it's supposed to be advertising, not a technical white paper or PoC"

> the AI just helps me get a baseline down so I'm not staring at a blank page.

If this was true, the top comment wouldn't be a complaint about how the voice of the article sounds "inauthenticlly human" or like an LLM. It's having a stronger influence on your writing than you're giving it credit for. It's on you to decide if or how much you care, but ideally you wouldn't be lying to either yourself or your readers.


Good question! So RTMP doesn't really have a clean way to handle two publishers on the same stream key. What would actually happen is the two streams fighting for the ingest endpoint, so the output would glitch between the two sources. Like if I pushed Subway Surfers gameplay it'd be flickering between the actual match and Subway Surfers with the audio cutting back and forth. You're right that a live director would catch it pretty fast but even a few seconds of that on air during a World Cup match is not great.


How do you know that you can even write to any of those fields? You didn't try it, so maybe there is a JWT role check in the backend on POST and PUT.


That's a different thing. RTMP ingest endpoints aren't behind the same API layer, they're just open media endpoints that accept a connection if you have the stream key. The stream key was right there in the URL. There's no JWT involved in pushing video to an RTMP ingest, it's just connect and publish.


Yeah I see this type of crap often honestly, especially at big companies.


I blocked my network traffic before clicking it cuz I've seen a lot of things without confirmation pop-ups. At least there was a confirmation pop-up.


Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV worldwide. Write access to match stats, commentator notes, and the live score system was also exposed.


As someone that also wears security hat from time to time, regarding devs best practices, that is a very common failure in SPAs, client side only validation.

There is always some fun showing teams how easy it is to bypass with a plain browser and developer tools window open.


Could have made a killing off of poly market and rick rolled ftw.


Given that they had to hand over their identity to get access, seems like a 1-way ticket to prison (assuming FIFA logs events like that, which honestly I’m not so sure about anymore).


> Hire me (just kidding... unless?)

Would you really want to work for one of the world’s most notoriously corrupt organizations?


I am not much of a football gal myself, so I didn't know they were a shitty org.


I don't follow football in the slightest, but these have been major media stories. See: https://en.wikipedia.org/wiki/2015_FIFA_corruption_case

Not saying "you should have heard of it", just giving info.

The US DOJ investigation found over $150 million in bribes and kickbacks over two decades. This led to dozens of criminal indictments, and ongoing legal battles over the recovery of stolen funds.

But maybe they've resolved that now and are a changed organization? Oh wait, this is the organization that made up a "peace prize" to give to a certain Donald Trump, to make up for the Nobel committee's completely inexplicable refusal to award their Peace Prize to the guy who started a pointless war with Iran that plunged the world into economic chaos. It'd be hilarious, if it weren't so sleazy, sad, and depressing.

Long story short, if FIFA offered you a cybersecurity job tomorrow, you should do a lot of due diligence before accepting.


Burger King


Why is your blog post down?


mmph..furger


Yes. I really hope this teaches them a lesson and they fix it before 4chan acts but that problem won't happen. Also If I would have stayed quiet and not informed the public that the app doesnt care about your privacy, a databreach was bound to happen at some point, because they are just leaving holes for bad guys to discover.


I do want people's privacy to be protected, this app has been insecure since day one, and they obviously don't care, it's been 9 months. I posted about it since they obviously didnt give a shit, because this will now hopefully force them to actually fix it.

Instead of fixing these issues they have been implement "ai matchmaking" like that is more important.

And these fixes aren't that hard either. Its not rocket science.

My goal is not to get hired, my goal is to hold them responsible and hopefully make them fucking fix it.

I hate companies that don't give a rats ass about their users security and waste time making ai shit instead of fixing their problems cuz they dont care.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: