4 ms·

Nice write-up and good on them for fixing that quickly, but it's a serious bummer they unnecessarily bring in the RubyGems incident as some sort of awkward "Wel

Nice write-up and good on them for fixing that quickly, but it's a serious bummer they unnecessarily bring in the RubyGems incident as some sort of awkward "Well at least we didn't screw up that badly!" swipe. It's not relevant to anything else they said.

wycats 13y ago
I think what they're trying to say is that the bug is exactly as bad as the Rubygems incident, but they got lucky and it wasn't exploited.
- Jgrubb 13y ago
  How I took it as well.
  - seldo 13y ago
    That was certainly the intention.
avree 13y ago
It's not a swipe at all. It's almost self-disparagement. They're being totally up front with "as history has shown, this could have been incredibly disastrous, but we got really lucky."
seldo 13y ago
Update: I was in fact incorrect about the severity of the rubygems.org incident; their issue was a disclosure without a breach, exactly like ours. I've updated the original post and also issued a correction: http://blog.npmjs.org/post/78165272245/more-help-with-self-signed-cert-in-chain-and-npm http://blog.npmjs.org/post/78165272245/more-help-with-self-s...