4 ms·
I take it you’ve never been involved in a breach investigation. Figuring out what an attacker had access to and whether they exploited that access isn’t trivial
by ralph84 4y ago
I take it you’ve never been involved in a breach investigation. Figuring out what an attacker had access to and whether they exploited that access isn’t trivial, especially for a heavily used service like npm. To say they were “sitting on” information while probably tens if not hundreds of engineers assisted in making sure the investigation was complete and accurate is uncharitable.
- glenngillen 4y agoHow presumptuous. I’ve worked with all of the teams involved in this specific incident over the past 12 years. I’ve helped lead incident response for much larger breaches. I know what’s involved. And the moment you’re aware customers have had their passwords exposed (even if hashed) you come clean on it and empower them to take mitigating action so that they’re not unduly exposed longer than they need to be. You probably even consider forcing password resets for everyone. As Heroku did, in its own hamfisted and still too slow way.
- ralph84 4y agoAnd you know the exact moment GitHub became aware that passwords were exposed and that they "sat on" that information? If you actually did work with those people, that's even more reason to assume good faith. Saying "I could have done it better" isn't helpful.