4 ms·

What i find particularly embarrassing for Citrix (although only marginally touched in the article) is the amount of time taken for them to close the hole that w

What i find particularly embarrassing for Citrix (although only marginally touched in the article) is the amount of time taken for them to close the hole that was in their Netscaler/ADC components. I mean, this is not a one-man show and an open-source project....

thedance 7y ago
How do you know? There are lots of commercial products that have no staffing at all. "1 man" might even be above the median staffing.
- montalbano 7y ago
  Citrix had 8200 employees as of 2018 according to Wikipedia. https://en.wikipedia.org/wiki/Citrix_Systems https://en.wikipedia.org/wiki/Citrix_Systems
  - thedance 7y ago
    I meant the NetScaler project in particular.
    - frollo 7y ago
      They still have nearly 10k employees and are a big, affluent company. None of their project should be a one-man project, but, even if it were, they should still be able to find enough engineers to work on it in case of emergencies. If it can be done by a small startup with a total of 3 devs in the entire company (and I have seen it done), it can be done by a company the size of Citrix.
      - thedance 7y ago
        I guess you'd be surprised at how easy it is for an organization to just de-staff a launched product.
        throwiay987 7y ago
        why are we defending gross incompetence and laid back attitudes again?
        mynameisvlad 7y ago
        Who is defending, exactly? thedance is pointing out that we have no idea of the inner workings of Citrix, and how they staff their projects. It's not completely unreasonable to believe a non-core project has minimal staffing levels.
    - Spooky23 7y ago
      The vulnerability in Netscaler was an old bug in a web server that let you trivially break out of the virtual directory. So you could navigate to <URL>/vpn/../path and read/write files. The device is a freaking load balancer. It took the company a month from public disclosure to push out a rule to workaround to stop most exploits on some devices, and 6 weeks to patch it. Something went horribly wrong. Netscaler was a potential spinoff product awhile back — my guess is that they stripped the division in the anticipation of a sale to make the numbers look good.

thedance 7y ago

How do you know? There are lots of commercial products that have no staffing at all. "1 man" might even be above the median staffing.

montalbano 7y ago
Citrix had 8200 employees as of 2018 according to Wikipedia. https://en.wikipedia.org/wiki/Citrix_Systems https://en.wikipedia.org/wiki/Citrix_Systems
- thedance 7y ago
  I meant the NetScaler project in particular.
  - frollo 7y ago
    They still have nearly 10k employees and are a big, affluent company. None of their project should be a one-man project, but, even if it were, they should still be able to find enough engineers to work on it in case of emergencies. If it can be done by a small startup with a total of 3 devs in the entire company (and I have seen it done), it can be done by a company the size of Citrix.
    - thedance 7y ago
      I guess you'd be surprised at how easy it is for an organization to just de-staff a launched product.
      - throwiay987 7y ago
        why are we defending gross incompetence and laid back attitudes again?
        mynameisvlad 7y ago
        Who is defending, exactly? thedance is pointing out that we have no idea of the inner workings of Citrix, and how they staff their projects. It's not completely unreasonable to believe a non-core project has minimal staffing levels.
  - Spooky23 7y ago
    The vulnerability in Netscaler was an old bug in a web server that let you trivially break out of the virtual directory. So you could navigate to <URL>/vpn/../path and read/write files. The device is a freaking load balancer. It took the company a month from public disclosure to push out a rule to workaround to stop most exploits on some devices, and 6 weeks to patch it. Something went horribly wrong. Netscaler was a potential spinoff product awhile back — my guess is that they stripped the division in the anticipation of a sale to make the numbers look good.