5 ms·

It's not clear enough, because people that don't frequent HN, Techcrunch, and the like, still haven't heard about this lapse. No email was sent out, and I doubt

It's not clear enough, because people that don't frequent HN, Techcrunch, and the like, still haven't heard about this lapse. No email was sent out, and I doubt there's one coming. Had someone not noticed something was up yesterday and not made a stink about it, we wouldn't even have this message to read. The message is fine. The venue is wrong.

jvandenbroeck 15y ago
I totally agree, an email would be much better than a blog post. Or a message you see when you login, which could also help you check your access logs in these 4 hours.
nomurrcy 15y ago
I received the following from Drop box late last night: We are writing to let you know that there was some activity in your Dropbox account that we'd like you to review. On June 19, 2011, there was a brief bug with our authentication system that could have allowed unauthorized access to accounts. You can read more about it at our blog post linked here. Based on a careful review of our records, we noticed that your account settings page was accessed during the time the bug was in effect. While it's unlikely, we'd like to be cautious and make sure this was you because if the activity was unauthorized, the information in your account could have been improperly accessed. Please review recent activity in your account, which you can view at http://www.dropbox.com/events http://www.dropbox.com/events, and let us know if you find anything suspicious. We noticed that during the time the bug was in effect you also: Logged into the Dropbox website Linked the desktop application to your Dropbox As a precautionary measure, we logged you out of the website and disabled any apps. We are very sorry and this should never have happened. We are scrutinizing our controls and will be implementing additional safeguards to prevent this from happening again. If you're not able to access your account or have any other questions or concerns, please contact us at support@dropbox.com. I don't know what else they are supposed to do. They should have never screwed this up to begin with, but grandted that they did I think they've responded just fine. IMHO All the moaning about how they've handled this is just a bunch of baloney. If a company spokesperson speaks out of both sides of their mouth, people cry for honesty. When a company is blunt and honest, they need to hire a PR person. I wonder how many people on these threads are 'PR' people.
- danilocampos 15y ago
  You've created a false dichotomy here. You don't need PR to have empathy or accountability – just a sense of humility. You can still be completely blunt. If the blog post had ended with: "We fucked up. Not cool. We're going to work hard to prevent these things in the future and earn your trust." Then the tone of the response would have been very different. That email was pretty good – they should have said something closer to that in their blog, too.
noodle 15y ago
> The message is fine. The venue is wrong. bingo. they needed a message that was easily understandable and relatable by all clients. there's nothing inherently wrong about the post and would've been a good status update or part of a post mortem, but not the entire PR statement of the company about the incident.

jvandenbroeck 15y ago

I totally agree, an email would be much better than a blog post. Or a message you see when you login, which could also help you check your access logs in these 4 hours.

nomurrcy 15y ago

I received the following from Drop box late last night: We are writing to let you know that there was some activity in your Dropbox account that we'd like you to review. On June 19, 2011, there was a brief bug with our authentication system that could have allowed unauthorized access to accounts. You can read more about it at our blog post linked here. Based on a careful review of our records, we noticed that your account settings page was accessed during the time the bug was in effect. While it's unlikely, we'd like to be cautious and make sure this was you because if the activity was unauthorized, the information in your account could have been improperly accessed. Please review recent activity in your account, which you can view at http://www.dropbox.com/events http://www.dropbox.com/events, and let us know if you find anything suspicious. We noticed that during the time the bug was in effect you also: Logged into the Dropbox website Linked the desktop application to your Dropbox As a precautionary measure, we logged you out of the website and disabled any apps. We are very sorry and this should never have happened. We are scrutinizing our controls and will be implementing additional safeguards to prevent this from happening again. If you're not able to access your account or have any other questions or concerns, please contact us at support@dropbox.com. I don't know what else they are supposed to do. They should have never screwed this up to begin with, but grandted that they did I think they've responded just fine. IMHO All the moaning about how they've handled this is just a bunch of baloney. If a company spokesperson speaks out of both sides of their mouth, people cry for honesty. When a company is blunt and honest, they need to hire a PR person. I wonder how many people on these threads are 'PR' people.

danilocampos 15y ago
You've created a false dichotomy here. You don't need PR to have empathy or accountability – just a sense of humility. You can still be completely blunt. If the blog post had ended with: "We fucked up. Not cool. We're going to work hard to prevent these things in the future and earn your trust." Then the tone of the response would have been very different. That email was pretty good – they should have said something closer to that in their blog, too.

noodle 15y ago

> The message is fine. The venue is wrong. bingo. they needed a message that was easily understandable and relatable by all clients. there's nothing inherently wrong about the post and would've been a good status update or part of a post mortem, but not the entire PR statement of the company about the incident.