Hacker News Reader

I don't know but it always seems to be worded like in this instance: "...A small subset of customers’ Sourcegraph license keys may have been accessed..."

I don't buy that, it always seems to me like an attempt to downplay something.

View on HN

I lead security at Sourcegraph and have been overseeing the incident investigation and resolution. To give you more specific details, I can say that we saw that the attacker viewed a page where they would have only seen the first 20 items, and we were able to determine what those were at the time of viewing because of stable sorting.

Kudos. Thanks for the good communications and security response.

That… didn’t age well

In what way? Has something else happened since?

Reply on news.ycombinator.com