6 ms·

How big is your organisation? I know it shouldn’t matter but your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce

How big is your organisation? I know it shouldn’t matter but your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc. I’ve always found government, sensitive customers (banks, payment processors, healthcare) and big spenders get prioritised with phone call notifications. However with a deprecated product, the financial impact is so minuscule - leadership won’t prioritise this one unless you’re big fish.

miken123 5y ago
It's tiny, I just want them to send me an email if there is a critical vulnerability. Not too much to ask, I think.
- pc86 5y ago
  Based on the other anecdotes here it seems most likely that they did and you just didn't receive it.
reaperducer 5y ago
your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc. The only companies that are like those companies are those companies. In most companies, the CS people don't know what anything in that sort of alert means and will discard it thinking that it's a spam or phishing attempt. The problem is not that he doesn't work for a megacorp. The problem is that Atlassian screwed up.
- qwertox 5y ago
  Where did they screw up? How do you know that the mail wasn't lost/filtered after being sent?
  - miken123 5y ago
    If O365 can't find the email and the O365 message tracing does not show anything, it seems likely that the mail was not actually delivered by Atlassian. If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Also, regardless of whether or not I received the mail, the initial mail stated that only authorized users could exploit this. So Atlassian did not inform any of their users fully until Sep 4, whereas they were well aware on Aug 26 that the vulnerability was exploitable by anyone.
    - dragonwriter 5y ago
      > If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Internet email has never been considered a highly-reliable messaging system; its quite possible an infrequent data loss in a mail server would get misattributed to a failure outside. Heck, even ignoring the unreliability of email generally, in fact, your assumption that it must not occur because you haven't previously heard about it demonstrates how that might happen.
      - miken123 5y ago
        I would beg to differ about email reliability, also see https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 but do agree that everything could get lost for some reason. But that is not the main point. Even if the email was lost somewhere in Office 365, people were already pointing out to Atlassian that they should really send a follow up on Aug 27: https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCommentId=2862709&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-2862709 https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCo...
        qwertox 5y ago
        The follow-up-request was to notify users that the advisory has been updated, not to ensure that customers received the Aug 25 email which linked to that advisory. Either is was Atlassian's mailing list software which did not attempt to re-send the email to you after it noticed that the connection got dropped (should that have happened), or is was Microsoft which dropped the email after receiving it, but before storing it into the database and assigning it to your account. You cannot know who is responsible for this delivery error unless you ask them directly.
      - carlmr 5y ago
        In terms of human communication, I consider anything which is only unidirectional to be unreliable. It's ok for ad emails. But anything that might cost millions if lost should require some kind of human TCP handshake. Whether by email or phone.
- geofft 5y ago
  I think the claim here is that Atlassian's post-sales account representatives ("customer success"?) would have proactively reached out to the technical contacts of large companies with a personal email - and known exactly what person to talk to, because they stay in touch - because Atlassian is an organization like Amazon, Microsoft, or Salesforce. I think you're reading it as saying that the helpdesk people ("customer support"?) at a large organization like Amazon, Microsoft, or Salesforce would be trained to recognize a mis-directed email from a vendor and send it to the right place, but I don't think that's the claim being made.

miken123 5y ago

It's tiny, I just want them to send me an email if there is a critical vulnerability. Not too much to ask, I think.

pc86 5y ago
Based on the other anecdotes here it seems most likely that they did and you just didn't receive it.

reaperducer 5y ago

your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc. The only companies that are like those companies are those companies. In most companies, the CS people don't know what anything in that sort of alert means and will discard it thinking that it's a spam or phishing attempt. The problem is not that he doesn't work for a megacorp. The problem is that Atlassian screwed up.

qwertox 5y ago
Where did they screw up? How do you know that the mail wasn't lost/filtered after being sent?
- miken123 5y ago
  If O365 can't find the email and the O365 message tracing does not show anything, it seems likely that the mail was not actually delivered by Atlassian. If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Also, regardless of whether or not I received the mail, the initial mail stated that only authorized users could exploit this. So Atlassian did not inform any of their users fully until Sep 4, whereas they were well aware on Aug 26 that the vulnerability was exploitable by anyone.
  - dragonwriter 5y ago
    > If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now. Internet email has never been considered a highly-reliable messaging system; its quite possible an infrequent data loss in a mail server would get misattributed to a failure outside. Heck, even ignoring the unreliability of email generally, in fact, your assumption that it must not occur because you haven't previously heard about it demonstrates how that might happen.
    - miken123 5y ago
      I would beg to differ about email reliability, also see https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 but do agree that everything could get lost for some reason. But that is not the main point. Even if the email was lost somewhere in Office 365, people were already pointing out to Atlassian that they should really send a follow up on Aug 27: https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCommentId=2862709&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-2862709 https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCo...
      - qwertox 5y ago
        The follow-up-request was to notify users that the advisory has been updated, not to ensure that customers received the Aug 25 email which linked to that advisory. Either is was Atlassian's mailing list software which did not attempt to re-send the email to you after it noticed that the connection got dropped (should that have happened), or is was Microsoft which dropped the email after receiving it, but before storing it into the database and assigning it to your account. You cannot know who is responsible for this delivery error unless you ask them directly.
    - carlmr 5y ago
      In terms of human communication, I consider anything which is only unidirectional to be unreliable. It's ok for ad emails. But anything that might cost millions if lost should require some kind of human TCP handshake. Whether by email or phone.
geofft 5y ago
I think the claim here is that Atlassian's post-sales account representatives ("customer success"?) would have proactively reached out to the technical contacts of large companies with a personal email - and known exactly what person to talk to, because they stay in touch - because Atlassian is an organization like Amazon, Microsoft, or Salesforce. I think you're reading it as saying that the helpdesk people ("customer support"?) at a large organization like Amazon, Microsoft, or Salesforce would be trained to recognize a mis-directed email from a vendor and send it to the right place, but I don't think that's the claim being made.