5 ms·

I only got the 'update' from last Saturday, by then it was too late already. Their original advisory was from the 25th, they should have mailed me back then.

Mandatum 5y ago
How big is your organisation? I know it shouldn’t matter but your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc. I’ve always found government, sensitive customers (banks, payment processors, healthcare) and big spenders get prioritised with phone call notifications. However with a deprecated product, the financial impact is so minuscule - leadership won’t prioritise this one unless you’re big fish.
- miken123 5y ago
  It's tiny, I just want them to send me an email if there is a critical vulnerability. Not too much to ask, I think.
  - pc86 5y ago
    Based on the other anecdotes here it seems most likely that they did and you just didn't receive it.
- reaperducer 5y ago
  your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc. The only companies that are like those companies are those companies. In most companies, the CS people don't know what anything in that sort of alert means and will discard it thinking that it's a spam or phishing attempt. The problem is not that he doesn't work for a megacorp. The problem is that Atlassian screwed up.
  - qwertox 5y ago
    Where did they screw up? How do you know that the mail wasn't lost/filtered after being sent?
    - miken123 5y ago
      If O365 can't find the email and the O365 message tracing does not show anything, it seems likely that the mail was not actually delivered by Atlassian. If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Also, regardless of whether or not I received the mail, the initial mail stated that only authorized users could exploit this. So Atlassian did not inform any of their users fully until Sep 4, whereas they were well aware on Aug 26 that the vulnerability was exploitable by anyone.
      - dragonwriter 5y ago
        > If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Internet email has never been considered a highly-reliable messaging system; its quite possible an infrequent data loss in a mail server would get misattributed to a failure outside. Heck, even ignoring the unreliability of email generally, in fact, your assumption that it must not occur because you haven't previously heard about it demonstrates how that might happen.
        miken123 5y ago
        I would beg to differ about email reliability, also see https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 but do agree that everything could get lost for some reason. But that is not the main point. Even if the email was lost somewhere in Office 365, people were already pointing out to Atlassian that they should really send a follow up on Aug 27: https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCommentId=2862709&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-2862709 https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCo...
  - geofft 5y ago
    I think the claim here is that Atlassian's post-sales account representatives ("customer success"?) would have proactively reached out to the technical contacts of large companies with a personal email - and known exactly what person to talk to, because they stay in touch - because Atlassian is an organization like Amazon, Microsoft, or Salesforce. I think you're reading it as saying that the helpdesk people ("customer support"?) at a large organization like Amazon, Microsoft, or Salesforce would be trained to recognize a mis-directed email from a vendor and send it to the right place, but I don't think that's the claim being made.
qwertox 5y ago
If you got the one from Sep 4, you definitely should have gotten the one from Aug 25. This is unrelated to any mailing-list change, since both were sent from/to the 10991049.xt.local mailing list. Search for the header entry `List-ID: <10991049.xt.local>` in your Sep 4 email. If it came from that list, the one from Aug 25 will very likely have been lost during transit. I use their products in the 10-user license program since 2016 and got automatically subscribed to their mailing list back then, and never made some change to the subscription. I'm receiving emails from that list since 2020-10-17. On the 2020-07-10 I got a mail from them telling me: ``` Subject: Please double-check your contact details for Atlassian Making sure you don't miss important emails Hi, When you purchased your Atlassian products, we asked for the contact information for two types of people in your organization: Billing contact - A person we contact with invoice and billing information Technical contact - A person we contact about product changes, security advisories, etc. We don't want your company to miss out on important information from Atlassian, so please take a minute to make sure your contact information is current. Here's what we have in our system: ```
- miken123 5y ago
  I'm listed as the technical contact and have been for 5+ years and also get the regular mails to 'verify contact details'. I did not get the Aug 25 email. I did get the Sep 4 mail from that list ID. Once I noticed I did not get an email, on Sep 3, I checked some checkboxes at https://my.atlassian.com/email https://my.atlassian.com/email But that page also says tech contacts should always receive an email regardless of settings. I have received other security announcements in the past. Office 365 can't find any emails from Atlassian on Aug 25 when searching using the Message trace tool (which also includes any spam mails, deleted mails, et cetera), so I would suggest Atlassian fix their mailing list.

Mandatum 5y ago

How big is your organisation? I know it shouldn’t matter but your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc. I’ve always found government, sensitive customers (banks, payment processors, healthcare) and big spenders get prioritised with phone call notifications. However with a deprecated product, the financial impact is so minuscule - leadership won’t prioritise this one unless you’re big fish.

miken123 5y ago
It's tiny, I just want them to send me an email if there is a critical vulnerability. Not too much to ask, I think.
- pc86 5y ago
  Based on the other anecdotes here it seems most likely that they did and you just didn't receive it.
reaperducer 5y ago
your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc. The only companies that are like those companies are those companies. In most companies, the CS people don't know what anything in that sort of alert means and will discard it thinking that it's a spam or phishing attempt. The problem is not that he doesn't work for a megacorp. The problem is that Atlassian screwed up.
- qwertox 5y ago
  Where did they screw up? How do you know that the mail wasn't lost/filtered after being sent?
  - miken123 5y ago
    If O365 can't find the email and the O365 message tracing does not show anything, it seems likely that the mail was not actually delivered by Atlassian. If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Also, regardless of whether or not I received the mail, the initial mail stated that only authorized users could exploit this. So Atlassian did not inform any of their users fully until Sep 4, whereas they were well aware on Aug 26 that the vulnerability was exploitable by anyone.
    - dragonwriter 5y ago
      > If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Internet email has never been considered a highly-reliable messaging system; its quite possible an infrequent data loss in a mail server would get misattributed to a failure outside. Heck, even ignoring the unreliability of email generally, in fact, your assumption that it must not occur because you haven't previously heard about it demonstrates how that might happen.
      - miken123 5y ago
        I would beg to differ about email reliability, also see https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 but do agree that everything could get lost for some reason. But that is not the main point. Even if the email was lost somewhere in Office 365, people were already pointing out to Atlassian that they should really send a follow up on Aug 27: https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCommentId=2862709&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-2862709 https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCo...
- geofft 5y ago
  I think the claim here is that Atlassian's post-sales account representatives ("customer success"?) would have proactively reached out to the technical contacts of large companies with a personal email - and known exactly what person to talk to, because they stay in touch - because Atlassian is an organization like Amazon, Microsoft, or Salesforce. I think you're reading it as saying that the helpdesk people ("customer support"?) at a large organization like Amazon, Microsoft, or Salesforce would be trained to recognize a mis-directed email from a vendor and send it to the right place, but I don't think that's the claim being made.

qwertox 5y ago

If you got the one from Sep 4, you definitely should have gotten the one from Aug 25. This is unrelated to any mailing-list change, since both were sent from/to the 10991049.xt.local mailing list. Search for the header entry `List-ID: <10991049.xt.local>` in your Sep 4 email. If it came from that list, the one from Aug 25 will very likely have been lost during transit. I use their products in the 10-user license program since 2016 and got automatically subscribed to their mailing list back then, and never made some change to the subscription. I'm receiving emails from that list since 2020-10-17. On the 2020-07-10 I got a mail from them telling me: ``` Subject: Please double-check your contact details for Atlassian Making sure you don't miss important emails Hi, When you purchased your Atlassian products, we asked for the contact information for two types of people in your organization: Billing contact - A person we contact with invoice and billing information Technical contact - A person we contact about product changes, security advisories, etc. We don't want your company to miss out on important information from Atlassian, so please take a minute to make sure your contact information is current. Here's what we have in our system: ```

miken123 5y ago
I'm listed as the technical contact and have been for 5+ years and also get the regular mails to 'verify contact details'. I did not get the Aug 25 email. I did get the Sep 4 mail from that list ID. Once I noticed I did not get an email, on Sep 3, I checked some checkboxes at https://my.atlassian.com/email https://my.atlassian.com/email But that page also says tech contacts should always receive an email regardless of settings. I have received other security announcements in the past. Office 365 can't find any emails from Atlassian on Aug 25 when searching using the Message trace tool (which also includes any spam mails, deleted mails, et cetera), so I would suggest Atlassian fix their mailing list.