7 ms·

That's like saying AWS's permissions system is a mess and depending on how you set it up you may get access to all of someone's S3 buckets ;)

Zetice 4y ago
It'd be more like if Amazon hosted customer support tickets in a heavily customized S3 bucket, but didn't lock that S3 bucket down.
- tharkun__ 4y ago
  It's called an analogy. Systen A with permissions: Jira System B with permissions: AWS This is the only property the two systems used in the analogy are required to have. In fact they don't even need to have the exact same property. Of course more similarities between the two make the analogy closer to each other but that is not required. Obligatory - if somewhat far fetched - car analogy: Tesla's app is a complete mess! Depending on how you set up access, anyone with permissions to your car could just drive off with it!
  - Zetice 4y ago
    …what? Atlassian uses Jira (a product they own) to manage their support tickets, and they have not configured it to only allow the customer who created the ticket to access their ticket. The analogy is that Amazon is to AWS as Atlassian is to Jira.
    - tharkun__ 4y ago
      Oh that's the angle you are referring to. Fair enough.I concentrated on the support system part. I don't think that should be part of your analogy. If you leave that out it'd be easier to see what you are referring to. Say: Amazon hosts their static website content on S3 and left it open to public write access for example.
      - Zetice 4y ago
        So you don't think it's relevant to note a company that makes a product can't secure that product for its own use and is actively leaking customer data to other customers? I do think that's a relevant part of the story.
        tharkun__ 4y ago
        If by Story you refer to the article, that is not what happened. If you are referring to your own vaguely described issue, please do report it to them or any other "authority" you see fit so it can be fixed if indeed that is the case. FWIW I do know my own tickets I created with them in the past were not publicly visible as in they did know how to set up issue security correctly ;) That said misconfigurations happen all the time in large organizations. Not defending Atlassian there. No affiliation beyond using their products at work.
        Zetice 4y ago
        So you didn't understand I was posting about another example of Atlassian security issues. Got it. No worries, mistakes happen!

Zetice 4y ago

It'd be more like if Amazon hosted customer support tickets in a heavily customized S3 bucket, but didn't lock that S3 bucket down.

tharkun__ 4y ago
It's called an analogy. Systen A with permissions: Jira System B with permissions: AWS This is the only property the two systems used in the analogy are required to have. In fact they don't even need to have the exact same property. Of course more similarities between the two make the analogy closer to each other but that is not required. Obligatory - if somewhat far fetched - car analogy: Tesla's app is a complete mess! Depending on how you set up access, anyone with permissions to your car could just drive off with it!
- Zetice 4y ago
  …what? Atlassian uses Jira (a product they own) to manage their support tickets, and they have not configured it to only allow the customer who created the ticket to access their ticket. The analogy is that Amazon is to AWS as Atlassian is to Jira.
  - tharkun__ 4y ago
    Oh that's the angle you are referring to. Fair enough.I concentrated on the support system part. I don't think that should be part of your analogy. If you leave that out it'd be easier to see what you are referring to. Say: Amazon hosts their static website content on S3 and left it open to public write access for example.
    - Zetice 4y ago
      So you don't think it's relevant to note a company that makes a product can't secure that product for its own use and is actively leaking customer data to other customers? I do think that's a relevant part of the story.
      - tharkun__ 4y ago
        If by Story you refer to the article, that is not what happened. If you are referring to your own vaguely described issue, please do report it to them or any other "authority" you see fit so it can be fixed if indeed that is the case. FWIW I do know my own tickets I created with them in the past were not publicly visible as in they did know how to set up issue security correctly ;) That said misconfigurations happen all the time in large organizations. Not defending Atlassian there. No affiliation beyond using their products at work.
        Zetice 4y ago
        So you didn't understand I was posting about another example of Atlassian security issues. Got it. No worries, mistakes happen!