4 ms·
I was hoping you would share your simplified version of the GitHub quote. So let me attempt it instead - "On the evening of March 8, we logged out all users fr
by dreamer7 6y ago
I was hoping you would share your simplified version of the GitHub quote. So let me attempt it instead -
"On the evening of March 8, we logged out all users from GitHub.com who had logged in prior to 12:03 UTC on March 8. This was done to protect users from an extremely rare, but potentially serious, security vulnerability affecting a very small number of GitHub.com sessions. No user accounts were affected"
I really couldn't simplify much without losing information. Logging out users isn't the same as invalidation of authenticated sessions because this probably revoked access to bots / API calls etc.
- PascLeRasc 6y agoEmail from security@github.com, sent on March 9th Last night, we logged out your Github account to fix a security flaw. Your account was not breached. You can read more details here [1]. [1] https://github.blog/2021-03-08-github-security-update-a-bug-related-to-handling-of-authenticated-sessions/ https://github.blog/2021-03-08-github-security-update-a-bug-...
- dreamer7 6y agoThis is good but without the extra words "extremely rare, potential harm.." this feels like it was a dangerous miss. I would worry about future such occurrences rather than just archiving it. Also I would definitely read more details. So perhaps this message works better in educating users