3 ms·
Who cares? It was compromised, and customers weren't notified for 21 days. If this were some highly regulated banking/securities/government system, 21 days MI
by rdl 11y ago
Who cares? It was compromised, and customers weren't notified for 21 days.
If this were some highly regulated banking/securities/government system, 21 days MIGHT be ok for public notice, but not for an infrastructure tool with highly technical users.
People get hacked (not good), but responding badly is the true badness.
And now additionally we're in WTF hell because no one knows if linode was compromised meaningfully (again), or if it was just a PagerDuty credential which got compromised.
- noir_lord 11y agoPagerDuty use AWS and Linode, be interesting to see which one was responsible. https://support.pagerduty.com/hc/en-us/articles/202830570-Where-is-PagerDuty-hosted- https://support.pagerduty.com/hc/en-us/articles/202830570-Wh...
- rdl 11y agoIf it was AWS (and not just AWS credential mismanagement by a client), I will donate $100 to PETA.
- jacquesm 11y agoThat's an easy bet, if it was AWS there will be much higher visibility targets than pagerduty, the fact that that is not the case makes it seem as if betting against you at this point is a losing proposition.
- sarciszewski 11y agoAccording to Julius Kivimaki (whom has hacked Linode countless times, including under the Hack the Planet hacker collective), Linode is pretty much an open door for blackhats.
- ryanlol 11y agoBeat me to it.
- akerl_ 11y agoIt seems like if the compromise were due to a failure on the provider's side, rather than the more common stolen/phished credentials, PagerDuty would be more clear about laying fault where it's due. It would help clarify that they didn't directly make an error, and allow them to put the ball in the provider's court to respond. Instead, the post's comment makes a reference to "an administrative panel provided by one of our infrastructure providers". It's not clear if this refers to the provider's internal tool, or the administrative panel they expose to customers for administering their accounts. If the former: I'd prefer they name the provider. If the latter, it might be worth clarifying the wording so it's more clear.