3 ms·

Has anyone written a checklist for CEOs/CTOs of stuff to do/avoid when such incidents are discovered?

• FLGMwt 11y ago
  I would love this from someone with the know
• sarciszewski 11y ago
  In my opinion: the Pager Duty team did okay. Disclosing sooner would have been cool, but then again law enforcement might have had the gun to their heads on disclosing anything. They explained their bcrypt implementation awkwardly, though. This is what their code did: https://github.com/plataformatec/devise/blob/1a0192201b317d3f1bac88f5c5b4926d527b1b39/lib/devise/encryptor.rb https://github.com/plataformatec/devise/blob/1a0192201b317d3... I would not have advised them to go the pepper route, but it's probably a moot point now. In their favor: When asked, they gave specific answers up to the point that they were allowed to by law enforcement. More companies should follow their example here.