4 ms·
> Gitlab has, as I understand it, a pretty excellent security team, which gives some sense of how hard this bug class is to avoid. I disagree. It's a bonehead
by Rapzid 3y ago
> Gitlab has, as I understand it, a pretty excellent security team, which gives some sense of how hard this bug class is to avoid.
I disagree. It's a bonehead mistake to send password resets out to tainted email addresses. As this was an authentication change it should have received extra scrutiny and so have been even harder to introduce.
Something is wrong with their engineering culture that needs correcting.
- tptacek 3y agoEvery time we get a story about a vulnerability, we get comments about how they're indications that engineering cultures need correcting. All I'll say is, the impression one gets is that every engineering culture needs correcting. I buy it!
- Rapzid 3y agoSure, but some corrections are more urgent than others. Such as that time they deleted the prod database.
- TylerE 3y agoFrom my experience people say “engineering culture” when what they actually mean management culture. It’s not typically the engineers that are the problem.
- Rapzid 3y agoWhat's the difference. That's a statement.