Atlassian: An update on our security breach

blogs.atlassian.com

18 points·bootload··11 comments

"... Firstly, we made a big error. For this we are, of course, extremely sorry. The legacy customer database, with passwords stored in plain text, was a liability. Even though it wasn't active, it should have been deleted. There's no logical explanation for why it wasn't, other than as we moved off one project, and on to the next one, we dropped the ball and screwed up. ..."

Plain text for passwords fast, but not good.

It is kind of amazing they did this, and the fact they didn't fix it when they could, speaks of negligence. I appreciate the honesty and the "No Bullshit" stance.

Still you have to wonder, Atlassian is building organizational communication tools, they are also using them their own development and business process, It gives pause when you consider the software they develop to actually do the job the are claiming it helps to achieve.

Isn't the whole point of this type of software, is to help stuff like that not happen by enhancing organizational communication?

They switched to dogfooding their own product in 2008, and you'll note that accounts created after that are not affected.

What the hell is "dogfooding"?

Using your own product internally. From "eating your own dogfood."

http://en.wikipedia.org/wiki/Eating_one%27s_own_dog_food

I didn't know that had a name. Thanks.

It's an adage that's been verbed into a gerund because the verb it would have been based on didn't exist.

YOU ARE NOT ALLOWED TO MAKE MISTAKES EVER!!!!

This isn't forgetting the milk, this is forgetting your anniversary.

Or "Honey I'm home" "Hi. Where's the Baby?"

No, not of this magnitude.

I still haven't found all the places that needed to get a new password after the reddit guys screwed up.

Reply on news.ycombinator.com