alt Hacker NewsSo the active incident is now fixed and they've already reached out to impacted customers but they can't mark it as resolved yet because they are still yet to publish a more detailed blog post?
Replies
whilenot-dev • today at 6:53 AM
What makes you think it's fixed? They just state that they "blocked the exploit", and that could mean anything:
- did they just take the affected API offline?
- or did they just disable the account of the attacker?
- or is the exploit actually being fixed?
Environment variables are sensible data, and marking a security incident as resolved with that little detail is quite a take. Even changelog entries for harmless bug fixes are more detailed.
➕ show 1 reply
It's not that they can't mark it as resolved. It's just that it is bad business to do so.
How they handle the communication on the incident is crucially as important as remediating the original cause.
Just the fact that they are doing this means I will probably never use this service or recommend this service to anyone else.