3 ms·
Why did it take months for Amazon to fix it?
by fletchowns 12y ago
Why did it take months for Amazon to fix it?
- joshfraser 12y agoI have no idea. Adding a single HTTP header seems simple to me, but I have no idea what their architecture looks like. It took them an entire month to send me a "thanks, we're working on it" email and that was only after I followed up with them.
- mike-cardwell 12y agoThey probably spent most of the time investigating to make sure that adding the header wasn't going to break anything.
- joshfraser 12y agoYep, they may have had widgets or legitimate framing that they needed to handle.
- phil21 12y agoSounds about the right amount of time for a dev cycle in a large corporation. Yes, I may be a bit bitter...
- fletchowns 12y agoYeah for a normal dev cycle. Security fixes do not need to follow a normal dev cycle.
- greenyoda 12y agoProbably because you can't do much by exploiting this security hole besides annoying people, so there's little incentive to do so. If you can get me to click on an item and buy it, the item will be shipped to my physical address, not yours. Even if was a product you were selling, I could return it for a refund and your account would be charged back. It doesn't seem like a very profitable scheme.