4 ms·
I haven't gone further than reading TFA, but, was there anything beyond the tweeted screenshot to suggest that this was an actual "compromise"? Seems like a qui
by octotoad 12y ago
I haven't gone further than reading TFA, but, was there anything beyond the tweeted screenshot to suggest that this was an actual "compromise"? Seems like a quick and easy way to cause quite a large fuss with minimal effort.
- jsmeaton 12y agoSo leaving potentially compromised packages online while investigating would have been more appropriate? I can see where you're coming from, but what would you have recommended instead? If this was an actual compromise, and they had of remained online for hours while investigating, there'd be lynch mobs out to get them.
- octotoad 12y agoDon't get me wrong, they definitely handled this in an appropriate manner. "Better safe than sorry", but I just wonder about these sorts of situations. It reminds me of the ridiculous "SWATting" craze; wasting time and resources on something that turns out to be a false alarm. Good way to stir up a bunch of hysteria without any heavy lifting.
- bradleyland 12y agoThat doesn't answer the question: what should they have done instead? We struggle with this at our company all the time. It's very easy to point out the shortcomings in any course of action, because these kinds of decisions almost always have trade-off. As pointed out, the alternative was to leave potentially compromised packages online. If you do a risk/outcome matrix analysis on this decision, they clearly made the right one.
- tomjen3 12y agoI would recommend reporting the prankster to the police. It prevents the loop hole of being able to take any project offline at no cost to yourselves and prevent the loophole of not investigating a server break in because it would cause downtime.
- jsmeaton 12y agoI agree that this should be the follow up. But it should not be the only course of action (not that you were suggesting it should be).