3 ms·
The big thing I see is that it was only three hours from security report receipt to primary mitigation in place. That’s a very quick turnaround for a volunteer
by burlesona 6y ago
The big thing I see is that it was only three hours from security report receipt to primary mitigation in place. That’s a very quick turnaround for a volunteer open source project.
Kudos to the Homebrew team for running a disclosure program to find risks like this, and for their speedy mitigation!
- dcow 6y agoThey were conducting the program (with help from HackerOne) so they were on standby.
- mikemcquaid 6y agoThanks for the kind words, they are surprisingly motivating (and rare). I was the person who responded to this at the weekend while my youngest kid was having a nap. I'm glad to see people recognise that this sort of turnaround on a volunteer-run project has a human cost and doesn't come automatically.