Last night I received a curious e-mail in my inbox from HBO Max with the subject line “Integration Test Email #1” and the body simply stating “This template is used by integration tests only.”. It was followed up later on by another copy of the e-mail stating exactly the same thing.
Being in software development I knew this could mean only one thing: someone messed up – big time!
With a site like HBO Max you would expect (hope?) that they would do testing – a lot of testing hopefully. An outage for HBO Max can mean lost customers, loss of revenue, or even potentially a hit to the stock price.
However what you would hope is that HBO Max’s test infrastructure is such that there would be a big separation between what the testing framework is allowed to do and what actually can happen when the site is ‘live’. This was apparently not the case in this instance.
The Twitter site for HBO Max has gone on to clarify that this was done in error by an intern:
If you’re worked in IT for any sufficient amount of time, you might be familiar with the sinking feeling this poor intern experienced when they either saw the e-mail popup in their own inbox, or their instant messenger starting chirping as others discovered it.
That sinking feeling…
However I think questions remain such as:
- How come HBO’s testing environment has access to the global customer distribution e-mail list/server?
- Why does an intern have access rights to push something like this out?
- How bad could this have been if someone had used this access for malicious purposes instead of an accidental test email?
HBO Max seems to be taking the lighthearted approach to this but I hope they are taking a good hard look at auditing who has access to their internal resources like their global customer e-mail distribution list. It’s all fun and games to play ‘blame the intern’ but next time it might not be so funny…