3 ms·

Thanks Kevin. We really do appreciate the discussion and, as you would imagine, are rethinking some of our approaches in line with the issues you've raised.

by z00b 9y ago

Posibyte 9y ago
The real thanks should go to you Rob. As it's stated, it's an industry wide problem and the real guts come from the companies that take the issue seriously; the ones who come out, hold it close to their own, admit they were wrong, and work to improve. This says a lot about you and your company, and as a customer it makes me proud that you're part of our mobile pipeline. As a customer, Rob, what would be a good avenue to notify you of issues like this in the future? Not every company wants to be front and center of what is essentially the news hub of tech people like HN for issues, so is there some way we can get with you guys directly to straighten security issues out, as well as some assurances as how you'll handle it along the way? Thanks for your attention to the issue :)
- z00b 9y ago
  Hi. You can always email our security team at security@circleci.com Our gpp key is available on our site https://circleci.com/security/ https://circleci.com/security/ if needed. You can also email me directly at rob@ if you have an immediate question.
remcob 9y ago
In the interest of said discussion, I would appreciate a write-up of the rationale behind the approach chosen, when you are ready. It could help others that are in a similar situation. Perhaps inspire a better practice in the industry.
- ssemmaprise 9y ago
  Hi there, we wrote up our thoughts + reply here: https://discuss.circleci.com/t/circleci-response-to-kevin-burke-s-blog-post-about-third-party-services/17276 https://discuss.circleci.com/t/circleci-response-to-kevin-bu... Thanks all for your thoughts + comments.
  - politician 9y ago
    Thanks for putting this together. You mention vetting third party scripts, but did not explain how your app is not vulnerable to those scripts being hacked or modified in the future. This vulnerability seemed to be the main point of Kevin's piece. Could you update your post to address that issue?

Thanks Kevin. We really do appreciate the discussion and, as you would imagine, are rethinking some of our approaches in line with the issues you've raised.

by z00b 9y ago

Thanks Kevin. We really do appreciate the discussion and, as you would imagine, are rethinking some of our approaches in line with the issues you've raised.

Posibyte 9y ago

The real thanks should go to you Rob. As it's stated, it's an industry wide problem and the real guts come from the companies that take the issue seriously; the ones who come out, hold it close to their own, admit they were wrong, and work to improve. This says a lot about you and your company, and as a customer it makes me proud that you're part of our mobile pipeline. As a customer, Rob, what would be a good avenue to notify you of issues like this in the future? Not every company wants to be front and center of what is essentially the news hub of tech people like HN for issues, so is there some way we can get with you guys directly to straighten security issues out, as well as some assurances as how you'll handle it along the way? Thanks for your attention to the issue :)

z00b 9y ago
Hi. You can always email our security team at security@circleci.com Our gpp key is available on our site https://circleci.com/security/ https://circleci.com/security/ if needed. You can also email me directly at rob@ if you have an immediate question.

remcob 9y ago

In the interest of said discussion, I would appreciate a write-up of the rationale behind the approach chosen, when you are ready. It could help others that are in a similar situation. Perhaps inspire a better practice in the industry.

ssemmaprise 9y ago
Hi there, we wrote up our thoughts + reply here: https://discuss.circleci.com/t/circleci-response-to-kevin-burke-s-blog-post-about-third-party-services/17276 https://discuss.circleci.com/t/circleci-response-to-kevin-bu... Thanks all for your thoughts + comments.
- politician 9y ago
  Thanks for putting this together. You mention vetting third party scripts, but did not explain how your app is not vulnerable to those scripts being hacked or modified in the future. This vulnerability seemed to be the main point of Kevin's piece. Could you update your post to address that issue?