Hacker News Reader

Comment by octotoad | Hacker News Reader

I haven't gone further than reading TFA, but, was there anything beyond the tweeted screenshot to suggest that this was an actual "compromise"? Seems like a quick and easy way to cause quite a large fuss with minimal effort.

View on HN

So leaving potentially compromised packages online while investigating would have been more appropriate? I can see where you're coming from, but what would you have recommended instead?

If this was an actual compromise, and they had of remained online for hours while investigating, there'd be lynch mobs out to get them.

Don't get me wrong, they definitely handled this in an appropriate manner. "Better safe than sorry", but I just wonder about these sorts of situations. It reminds me of the ridiculous "SWATting" craze; wasting time and resources on something that turns out to be a false alarm. Good way to stir up a bunch of hysteria without any heavy lifting.

That doesn't answer the question: what should they have done instead? We struggle with this at our company all the time. It's very easy to point out the shortcomings in any course of action, because these kinds of decisions almost always have trade-off. As pointed out, the alternative was to leave potentially compromised packages online. If you do a risk/outcome matrix analysis on this decision, they clearly made the right one.

I would recommend reporting the prankster to the police. It prevents the loop hole of being able to take any project offline at no cost to yourselves and prevent the loophole of not investigating a server break in because it would cause downtime.

I agree that this should be the follow up. But it should not be the only course of action (not that you were suggesting it should be).

Reply on news.ycombinator.com