4 ms·

It's a bit embarrassing to have this happen, but I can't throw stones about configuration causing issues like this. Addressing it publicly like this (identifyi

by anitil 5y ago

It's a bit embarrassing to have this happen, but I can't throw stones about configuration causing issues like this. Addressing it publicly like this (identifying exactly what was shared, who was impacted etc) builds a lot of trust. No denial or fobbing off, just clear communication.

magicalhippo 5y ago
> I can't throw stones about configuration causing issues like this. True, such misconfigurations are bound to happen. That's why it's so worrying that they thought it was OK to have a third-party script injector on the signed-in pages to begin with. I see now that they've removed Google Tag Manager from those pages, however they're still fairly opaque about preventing such a glaring security and privacy issue from happening again. Not a customer, however I was seriously considering switching to B2 for my backups before this happened. This post does very little to make me want to pursue that further.