3 ms·

This is very disappointing from JetBrains :-/

by estefan 10y ago

netcraft 10y ago
It is, but everyone can/will have vulnerabilities.
hhariri 10y ago
We're sorry. We've done our best to address the issue, provide the fixes for current versions as well as back-port it up to 3 years for all products running on the platform. In any case we apologise and have learned from this and will improve.
- Azkar 10y ago
  I'm happy with how the issue was addressed. No one can expect perfection from a complicated piece of software such as this. I was glad to have received the email and find the blog post with a thorough list of FAQs. I'm glad to see proper credit given to Jordan for finding the flaw. Maybe I'm a cynic, but I'm glad that this was an open process and not a one line blog post about a critical security update. Keep up the great work.
- sievebrain 10y ago
  It would be interesting to see the lessons learned. I do plain old IntelliJ development without any web stuff at the moment, so it was a surprise to learn that things were being exposed to the web.
anglebracket 10y ago
To JetBrains' credit they were very responsive throughout the disclosure process. I received a reply to my initial report in under two hours. Generally response times are measured in days unless you know someone in the company. They also gave me diffs against intellij-community master so I could verify their fixes were sound, and they were generally receptive to my feedback.
- hhariri 10y ago
  Once again we appreciate your professionalism in this and very grateful for all your help.
organsnyder 10y ago
Updating has been painless, their communication was open and direct, and there aren't (to my knowledge) any exploits in the wild. How is this a failing on their part? Do you expect 100% perfection?
alangpierce 10y ago
While the bug is a downer, I was impressed with how they responded to it, especially the fact that they simultaneously released patch updates for all products (including Android Studio) and for all relevant prior versions. The email I got made the severity clear and I was able to easily update WebStorm, PyCharm, and Android Studio without any problems.

This is very disappointing from JetBrains :-/

by estefan 10y ago

This is very disappointing from JetBrains :-/

netcraft 10y ago

It is, but everyone can/will have vulnerabilities.

hhariri 10y ago

We're sorry. We've done our best to address the issue, provide the fixes for current versions as well as back-port it up to 3 years for all products running on the platform. In any case we apologise and have learned from this and will improve.

Azkar 10y ago
I'm happy with how the issue was addressed. No one can expect perfection from a complicated piece of software such as this. I was glad to have received the email and find the blog post with a thorough list of FAQs. I'm glad to see proper credit given to Jordan for finding the flaw. Maybe I'm a cynic, but I'm glad that this was an open process and not a one line blog post about a critical security update. Keep up the great work.
sievebrain 10y ago
It would be interesting to see the lessons learned. I do plain old IntelliJ development without any web stuff at the moment, so it was a surprise to learn that things were being exposed to the web.

anglebracket 10y ago

To JetBrains' credit they were very responsive throughout the disclosure process. I received a reply to my initial report in under two hours. Generally response times are measured in days unless you know someone in the company. They also gave me diffs against intellij-community master so I could verify their fixes were sound, and they were generally receptive to my feedback.

hhariri 10y ago
Once again we appreciate your professionalism in this and very grateful for all your help.

organsnyder 10y ago

Updating has been painless, their communication was open and direct, and there aren't (to my knowledge) any exploits in the wild. How is this a failing on their part? Do you expect 100% perfection?

alangpierce 10y ago

While the bug is a downer, I was impressed with how they responded to it, especially the fact that they simultaneously released patch updates for all products (including Android Studio) and for all relevant prior versions. The email I got made the severity clear and I was able to easily update WebStorm, PyCharm, and Android Studio without any problems.