DoorDash's company blog, with engineering posts on scaling and migrations plus announcements on policy, funding and security incidents.
HN commenters link it as the primary source for DoorDash's tipping change and its data breach notice, and criticize its Project Dash as hypocritical.
Original blog post: https://blog.doordash.com/important-security-notice-about-your-doordash-account-ddd90ddf5996#46h35gr24e
From the techcrunch article: "It’s not clear why it took almost five months for DoorDash to publicly reveal the breach. DoorDash spokesperson Mattie Magdovitz say why [sic]."
Pretty bad. If personal identity info is exposed, it is irresponsible not to notify users immediately so they can freeze credit and watch for suspicious activity. The blog post did mention a third-party vendor, so it's possible there was a delay, but it's a whole other problem if it took this long to find a breach.
This sounds like it could be "flipboard-itis". Flipboard stored passwords insecurely in the beginning (SHA-1), but switched to bcrypt as it scaled. The passwords breached were before 2015, so possibly a similar thing here where they started out with bad security and improved with scale (but left the old stuff behind). I'm guessing Doordash did something similar and improved security as it scaled.
I think the thing that's making it look a lot worse for Doordash is their hypocrisy in things like this: https://blog.doordash.com/introducing-project-dash-bbc61ac0cb8c
the critique goes :
1. rip off workers
2. workers are poor, cant afford food
3. launch BS "anti-hunger" initiatives which address about 1% as much hunger as they cause, but make customers feel like they are doing a good thing using the service.
it's not unlike how big oil companies like BP run tons of advertisements how they are so "invested" in renewable energies like solar, spending a tiny fraction of the money they gain by profiting off of generation of greenhouse gasses and also dumping millions of gallons into the gulf of mexico every now and then.
Doordash stopped doing the tipping thing over a year ago https://blog.doordash.com/working-to-strike-a-better-balance-e1f66c76fca1?gi=f98dc4077568
The official blog post: https://blog.doordash.com/important-security-notice-about-your-doordash-account-ddd90ddf5996#46h35gr24e
They did change it: https://blog.doordash.com/working-to-strike-a-better-balance-e1f66c76fca1