4 ms·

No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech o

by ygjb 5y ago

No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode. This type of a call would likely be focused on assessing current state at that point.

asjfj9 5y ago
Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this? I work for a large non-US based tech company and have not heard anything about this beyond HN.
- bsagdiyev 5y ago
  It’s definitely happening. People are just too busy to post about it. I’m on a few hours sleep over the last couple days myself.
- MomoXenosaga 5y ago
  It was on the news in my country. There have been several notable ransomware attacks in the last few years, it's become an issue for a country and government that's gone all in on digital.
- octodog 5y ago
  I work for a bank in APAC region and we had at least one big change out on Friday evening to address this.
- xiphias2 5y ago
  I had an ex colleague at Google talking about it on Facebook...if he had to bring an internal stuff of Facebook, it must be really bad.
- xwolfi 5y ago
  Work in one of the largest financial org in the world as a Java dev for critical system (albeit not internet facing), learned of this just now on this thread... Edit: upon checking, we're safe, it doesn't impact log4j1, only the second version. We're not cowboys using versions as young as 2012 lol.
- austinkhale 5y ago
  There are many: https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/ https://www.techsolvency.com/story-so-far/cve-2021-44228-log...
- tomrod 5y ago
  I'm sure many folks here spent their Friday, Saturday, and possibly even Sunday patching, and won't speak up in case their profile connects to their company. Friday mid-afternoon a Google search for the exploit showed there were many websites in several languages giving instruction on how to exploit the vulnerability. This is hitting hard and fast.
notthathardbro 5y ago
The people that would be in that meeting are not the individuals actually patching servers.
- ygjb 5y ago
  No, they are managing the teams patching things and helping with prioritization. If the stakeholders participating in the call on Monday are not the people working on patching, managing, or prioritizing, then having the call earlier than that is pointless, because those stakeholders are too removed from the situation, and getting that information will detract from getting work done. It's pretty simple really, having a status or coordination call while the work is being done is roughly analogous to a photo-op by a politician during an emergency. It looks good for the voters, but it takes away resources from the folks who are actually doing the work.

by ygjb 5y ago

asjfj9 5y ago

Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this? I work for a large non-US based tech company and have not heard anything about this beyond HN.

bsagdiyev 5y ago
It’s definitely happening. People are just too busy to post about it. I’m on a few hours sleep over the last couple days myself.
MomoXenosaga 5y ago
It was on the news in my country. There have been several notable ransomware attacks in the last few years, it's become an issue for a country and government that's gone all in on digital.
octodog 5y ago
I work for a bank in APAC region and we had at least one big change out on Friday evening to address this.
xiphias2 5y ago
I had an ex colleague at Google talking about it on Facebook...if he had to bring an internal stuff of Facebook, it must be really bad.
xwolfi 5y ago
Work in one of the largest financial org in the world as a Java dev for critical system (albeit not internet facing), learned of this just now on this thread... Edit: upon checking, we're safe, it doesn't impact log4j1, only the second version. We're not cowboys using versions as young as 2012 lol.
austinkhale 5y ago
There are many: https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/ https://www.techsolvency.com/story-so-far/cve-2021-44228-log...
tomrod 5y ago
I'm sure many folks here spent their Friday, Saturday, and possibly even Sunday patching, and won't speak up in case their profile connects to their company. Friday mid-afternoon a Google search for the exploit showed there were many websites in several languages giving instruction on how to exploit the vulnerability. This is hitting hard and fast.

notthathardbro 5y ago

The people that would be in that meeting are not the individuals actually patching servers.

ygjb 5y ago
No, they are managing the teams patching things and helping with prioritization. If the stakeholders participating in the call on Monday are not the people working on patching, managing, or prioritizing, then having the call earlier than that is pointless, because those stakeholders are too removed from the situation, and getting that information will detract from getting work done. It's pretty simple really, having a status or coordination call while the work is being done is roughly analogous to a photo-op by a politician during an emergency. It looks good for the voters, but it takes away resources from the folks who are actually doing the work.