Code as Craft

Note: This post was co-written by Avleen Vig (@avleen) and Zane Lackey (@zanelackey). In mid-January of this year we started an initiative to remove Java browser plugins from all employee systems at Etsy, as we feel this is a best practice to be striving towards. To that end, we wanted to discuss the challenges we […]

Summer is ending New security features Sweeping in like Fall The Etsy Security Team is extremely happy to announce the simultaneous release of three important security features: Two factor authentication, full site SSL support, and viewable login history data. We believe that these protections are industry best practice, and we’re excited to offer them proactively […]

At Etsy we have three tiers of static analysis on our PHP code that run on every commit or runs periodically every hour. They form an important part of our continuous deployment pipeline along with one-button deploys, fast unit and functional tests, copious amounts of graphing, and a fantastic development environment to make sure code […]

The design of PHP’s basic random number generators rand and it’s newer variant mt_rand is based off the C Standard Library. For better or worse, both use a single global state and this can be reset using stand (or mt_srand). This means anyone (a developer, a third party module, a library) could set the state to a fixed […]

We love our human customers. That said we get a lot of traffic from robots too. This is great, especially when they use the Etsy API. However, they sometimes misbehave. And they misbehave frequently in the late hours, not unlike a legendary East Village night club. This time Craig Ferguson isn’t at the door to […]

At Etsy, we are constantly evaluating the security and safety of our members as they use the site.  One way we do this is by analyzing user generated content (UGC) for possible problems.  As part of the process we integrate results from the Google Safe Browsing (GSB) service. Typically this is client-side technology used by […]