3 ms·

Note also there's a direct response from Persona's security team here[1], and a lot of back and forth from Rick on Twitter[2]. [1]: https://withpersona.com/blo

Note also there's a direct response from Persona's security team here[1], and a lot of back and forth from Rick on Twitter[2]. [1]: https://withpersona.com/blog/post-incident-review-source-map-exposure-non-production-subdomain https://withpersona.com/blog/post-incident-review-source-map... [2]: https://x.com/Persona_IDV/status/2025048195773198385?s=20 https://x.com/Persona_IDV/status/2025048195773198385?s=20

nailer 8mo ago
> About the name: The subdomain was called onyx, a reference to the Pokémon Onix (a Pokémon made of multiple boulders, fitting for a multi-node architecture). It was an informal codename chosen by the engineer. It had no connection whatsoever to Fivecast ONYX, an unrelated 3rd party commercial product previously used by ICE. We understand this coincidence caused confusion, and we address it further below.
- UqWBcuFx6NV4r 7mo ago
  The fact that this is even being discussed is truly a bad smell of bad-faith “dig up anything that sounds bad” “reporting”
  - tharkun__ 7mo ago
    Yeah I'd sorta second that actually. I can't "judge" on everything they say in the blog post. But some things I definitely recognize as "bad-faith". Datadog RUM (browser-intake-datadoghq.com) - real-time user monitoring. every click, every page load - on a FedRAMP platform processing PII and biometrics. Well duh, yes, DataDog does have those capabilities. Doesn't mean you use all of it, just coz you use RUM in general. We also use DataDog and RUM. But we also use filtering, including filtering out the known PII sources we have in our specific case (non-FedRAMP) and we don't have entire session recording enabled for example and we only sample. Yet no mention of that in the post. They just assume that they must be sending PII from a FedRAMP site to DataDog. No proof of what data actually does get sent.
  - sghitbyabazooka 7mo ago
    people turn a blind eye because it's what they want to hear. so do i, despite not being a fan of the author's past works and way of life
dvfjsdhgfv 8mo ago
Twitter requires login to view the replies, might use an alternative: https://nitter.net/Persona_IDV/status/2025048195773198385 https://nitter.net/Persona_IDV/status/2025048195773198385
- tetromino_ 7mo ago
  It doesn't appear that any of the replies contain anything of substance
deleted 7mo ago
[deleted]

nailer 8mo ago

> About the name: The subdomain was called onyx, a reference to the Pokémon Onix (a Pokémon made of multiple boulders, fitting for a multi-node architecture). It was an informal codename chosen by the engineer. It had no connection whatsoever to Fivecast ONYX, an unrelated 3rd party commercial product previously used by ICE. We understand this coincidence caused confusion, and we address it further below.

UqWBcuFx6NV4r 7mo ago
The fact that this is even being discussed is truly a bad smell of bad-faith “dig up anything that sounds bad” “reporting”
- tharkun__ 7mo ago
  Yeah I'd sorta second that actually. I can't "judge" on everything they say in the blog post. But some things I definitely recognize as "bad-faith". Datadog RUM (browser-intake-datadoghq.com) - real-time user monitoring. every click, every page load - on a FedRAMP platform processing PII and biometrics. Well duh, yes, DataDog does have those capabilities. Doesn't mean you use all of it, just coz you use RUM in general. We also use DataDog and RUM. But we also use filtering, including filtering out the known PII sources we have in our specific case (non-FedRAMP) and we don't have entire session recording enabled for example and we only sample. Yet no mention of that in the post. They just assume that they must be sending PII from a FedRAMP site to DataDog. No proof of what data actually does get sent.
- sghitbyabazooka 7mo ago
  people turn a blind eye because it's what they want to hear. so do i, despite not being a fan of the author's past works and way of life

dvfjsdhgfv 8mo ago

Twitter requires login to view the replies, might use an alternative: https://nitter.net/Persona_IDV/status/2025048195773198385 https://nitter.net/Persona_IDV/status/2025048195773198385

tetromino_ 7mo ago
It doesn't appear that any of the replies contain anything of substance

deleted 7mo ago

[deleted]