4 ms·
Damn, it takes 2 minutes to "investigate the issue" if you simply follow the steps.
by vitalysh 14y ago
Damn, it takes 2 minutes to "investigate the issue" if you simply follow the steps.
- gingerlime 14y agoBut probably a little longer to find a fix, test it and release it...
- jtraub 14y agoI think they can just temporarily turn off password reset to prevent account stealing. After that they can take their time to fix the problem, test it and roll out to the public.
- x-sam 14y agoyes, better to keep 0day working, and roll out fixes with the next release.
- vitalysh 14y agoBlock password reset. It is as simple as that.
- sondh 14y agoThey have just done that.
- entropy_ 14y agoNot really, no. Just stop the reset token from appearing in the client. Just send it by email like you're supposed to and that's it, vulnerability gone.
- mvzink 14y agoYeah, but pushing a client fix takes time. They'll need an excuse in the meantime.
- aidos 14y agoYou don't push the fix to the client. They have some notification system ou there that is sending the messages to the client. They just need to stop it from sending these kind of messages. Obviously I can't say how much work is involved in that - but they don't need to push an updated client.
- entropy_ 14y agoIt's not a client-side fix. Just stop the server from sending the token/link to the clients. Sure, that might degrade the client experience a bit(assuming that the client isn't just displaying a webview in which case no degradation would occur) but it would fix the problem for now. Later on you can take your time rolling out a client fix if it's required, but a hotfix server-side is entirely possible, there's no excuse keeping this vulnerability possible when it's been made this public(step by step instructions to hack someone's account, with screenshots!) especially since you were contacted privately about it ~3 months ago.
- JabavuAdams 14y agoRight. There's one developer at Skype who can just do that and push it to production, without talking to anyone else, or getting approval from anyone else. Be realistic. If two people need to talk about it, it's going to take longer than 2 minutes.
- entropy_ 14y agoLonger than two minutes, definitely! More than 2 hours to investigate and fix? very doubtful. 3 months? That's a bit much...
- se85 14y agoI see your not familiar with the nature of code deployments and everything that has to happen beforehand. ;) The two hours were most likely spent on office politics as opposed to fixing the problem. I'm surprised it wasn't > 5 hours to be honest.