4 ms·
The initial response was very quick, but honestly: Fixing such a simple XSS hole on a web application shouldn't take 7 days. In the age of automated testing and
by pilif 13y ago
The initial response was very quick, but honestly: Fixing such a simple XSS hole on a web application shouldn't take 7 days. In the age of automated testing and continuos deployment, escaping that parameter is trivial.
Granted. If you have a systemic issue and you need to fix your framework to always escape unless told otherwise, that will take longer, but it won't prevent you from quick-fixing just the reported issue.
- algorithm_dk 13y agoIt took them 7 days to fully test the patch. LinkedIn's team for instance responds in 2 hours.
- antsar 13y agoI had to do a double-take when I read the "7 days" part, because I wasn't sure why that should be a pleasant surprise. If it were their desktop client, that kind of turnaround would be understandable. For their website? I don't see why they couldn't have deployed a hotfix immediately. On the other hand, perhaps they had a quota of more serious security issues and were preoccupied with addressing those.
- abjorn 13y agoIt's likely that it was fixed sooner than that. I would bet they gave it 7 days before he could talk about it, so they could audit the rest of their site.
- JoachimSchipper 13y ago"We have fixed it" is easy to understand as "you're now free to blog about this flaw"; one could imagine why Spotify would want to take the time to properly audit the rest of the site. Also, Spotify is a serious business that doesn't want to go down, and likely has a testing/deployment process a bit more complicated than "just push to master".
- a1a 13y agoIndeed. I would like to add that the initial response was most likely automated (looks kinda generic). Kinda makes me want to send a dummy email and see if I get a similar response as fast. But in all fairness, 7 days is still acceptable. It's far from "best ever", but compared to others it's still great.
- rohansingh 13y agoI just checked our logs and we had a fix commit and built to stable within a day. We wouldn't wait around a week on something like this.