Hacker News Reader

Comment by FireBeyond | Hacker News Reader

I was impressed by the detail and level of disclosure in this post. Very little PR speak, very little vagueness and handwaving - Adobe acknowledged the severity and demonstrated how important they viewed their response.

I have to give a nod of admiration for the professionalism of their handling of such a situation.

View on HN

My favorite part is that they shut off their code signing infrastructure "within minutes". Good job Adobe! They are also saying that the root cause was essentially "somebody didn't follow procedures for setting up secure build servers, and we didn't catch it." Such a typical security threat: humans doing the wrong stuff.

Get rid of humans: problem solved.

At least that's what the singularity will think.

Brad Arkin is a pro. He comes from vulnerability research, not PR.

"Through this process we learned a great deal about current issues with code signing and the impact of the inappropriate use of a code signing certificate. We plan to share our lessons learned as well as foster a conversation within the industry about the best way to protect users and minimize the impact on users in cases where the revocation of a certificate becomes necessary (as in this example)."

I look forward to this as well.

"and then leveraged standard advanced persistent threat (APT) tactics" - would be interested to know more on this point.

Agreed! Thanks adobe for treating us like real people!

Reply on news.ycombinator.com