miken123

Funny, you see the same mistake at exactly the same spot, albeit less spectacular, in the video linked from the tweet: https://www.youtube.com/watch?v=xWc-r0InwVk&t=148s

I would beg to differ about email reliability, also see https://datatracker.ietf.org/doc/html/rfc5321#section-6.1 but do agree that everything could get lost for some reason.

But that is not the main point. Even if the email was lost somewhere in Office 365, people were already pointing out to Atlassian that they should really send a follow up on Aug 27:

https://jira.atlassian.com/browse/CONFSERVER-67940?focusedCo...

If O365 can't find the email and the O365 message tracing does not show anything, it seems likely that the mail was not actually delivered by Atlassian. If O365 looses mails and these mails do not show up in message tracing either (i.e., not classified as spam), we would probably have heard about that by now.

Also, regardless of whether or not I received the mail, the initial mail stated that only authorized users could exploit this. So Atlassian did not inform any of their users fully until Sep 4, whereas they were well aware on Aug 26 that the vulnerability was exploitable by anyone.

I'm listed as the technical contact and have been for 5+ years and also get the regular mails to 'verify contact details'. I did not get the Aug 25 email. I did get the Sep 4 mail from that list ID.

Once I noticed I did not get an email, on Sep 3, I checked some checkboxes at https://my.atlassian.com/email But that page also says tech contacts should always receive an email regardless of settings. I have received other security announcements in the past.

Office 365 can't find any emails from Atlassian on Aug 25 when searching using the Message trace tool (which also includes any spam mails, deleted mails, et cetera), so I would suggest Atlassian fix their mailing list.

It's tiny, I just want them to send me an email if there is a critical vulnerability. Not too much to ask, I think.

Yes, I did. I also ran an Exchange Message Trace (this is just standard Office 365, nothing fancy) and there was only 1 message from Atlassian in the last 15 days which was the update email that was too late to prevent exploitation. So they did not email me in time.

I only got the 'update' from last Saturday, by then it was too late already. Their original advisory was from the 25th, they should have mailed me back then.

Atlassian was so kind to update their mailing lists somewhere over the last year or so. Previously, they would email the 'technical contact' of the license about any vulnerabilities. They quietly switched to some other notification system and never informed us about it. Hence we missed the update and got a free Bitcoin miner. Thanks Atlassian, I'll make sure to get your products out of the door as soon as possible.

[edit] Oh it's even better. Their site says 'Note: if you are a tech administrator, you will always receive these notifications.' but they never mailed us. Great job, Atlassian, great job.

> Luttwak's team found the problem, dubbed ChaosDB, on Aug. 9 and notified Microsoft Aug. 12, Luttwak said.

Then mailing customers on the 26th.

Depending on whether or not this can be classified as a 'personal data breach' (IMO you should treat it as such, since it has such widespread implications) that may be a GDPR violation. The GDPR requires 72h notice to the data protection authorities and notice without 'undue delay' to the controller.

It could very well be that your specific Javascript does not run automatically or does not run correctly. I see the same with one of our auto-submitting forms. I do not know whether or not that is intentional on Microsoft's part. But other users have had different experiencies, so be aware that Microsoft may 'fix' their issue on some day and all of a sudden all your users will start clicking/unsubscribing/whatevering automatically.

See https://blog.healthchecks.io/2019/12/preventing-office-365-a... for someone who did have this experience.

You should not submit the form automatically. Tools like Microsoft O365 ATP run any links in an emulated browser with Javascript support. These will, in some cases, happily autosubmit the form for you.

I find this quite concerning and am really wondering if there are any privacy advantages to Signal if these things happen.

Could you say something on:

1. Have any defend in depth measures been applied in the Android and other clients to make sure this issue does not happen again? E.g., an additional check when sending/encrypting a message to make sure it is absolutely meant for the person it is being send to? 2. Why did it take 8 months to fix this if some users could reproduce it consistently?

That may be your opinion, but an invoice in at least the Netherlands needs an monotonically increasing number. And it needs to be on the invoice and your customer needs to be able to see it.

[edit] It's even EU-wide, see article 226(2) of directive 2006/112/EC:

> a sequential number, based on one or more series, which uniquely identifies the invoice;

> Would you be willing to share more specifics

That's something you could easily figure out yourself. E.g., just grabbing some random JIRA:

https://hibernate.atlassian.net/jira/software/c/projects/HV/...

Opening an issue in that tracker takes 24 seconds for me. Twenty-four.

I guess this didn't help:

"I lost all my stuff in an apartment fire and am barely staying unhomeless. Lost access to most of my accounts. All precious metal is missing. If anyone could bless paypal@marak.com with a little cash it would help me from freezing on the street. lol."

https://twitter.com/marak/status/1320465599319990272

Even if the data is stored in the EU, Google (or Microsoft for that matter) does not guarantee that data cannot be accessed from the US. That makes sense, since most of their operating staff is probably based in the US, but does mean that it is not GDPR-compliant, no matter what Google says about that. Google states that they are using the SCCs now Privacy Shield has been invalidated, but as Google US is an entity under reach of FISA I highly doubt that they can provide the necessary safeguards required under the GDPR and the SCCs.

It should be patched since Dec 2019: https://twitter.com/jensvoid/status/1295633279727673344

I did not know that. Thanks for the information, as I can now cancel my donation and save a couple of bucks each month.

That’s not really how it works in the Netherlands, I’m afraid. Yes, the losing party usually has to pay the legal fees, but these fees are determined using a point-based system and do not really reflect the actual costs.

But, I do have to say, IP-related cases are an exception, and more is covered there (still not necessarily the actual costs). But that is not specific to the Netherlands but mandated by an EU directive (2004/48/EG).

I don't see the problem with it. Think of this scenario from the perspective of an employer:

- You hire someone and they create something and use it as part of your software. - They leave. - Then they sue you because they say you are using their software that they created in their spare time.

Or any of the other 999 IP disputes that can arise from not being very clear about who owns the IP of things your employees create.

> The wording specifically says that they own anything I conceive of while working for them.

That's quite normal, at least under Dutch labour law. It prevents IP discussions if an employee does anything outside of the 9-5 working hours, or anything they were not directly instructed to by their manager.

Of course there can be exceptions, e.g., we exempt open source software by default, and are open for any discussions on other side projects the employee may have. But the concept that all your programming work belongs to the company is not that strange.

Also note that this is not a non-compete, but simply an IP clause.

Wondering when they will start with implementing proper access controls on their API's. At the moment, a personal access token does have scopes, but it is quite limited:

- Repo access is all or nothing. A read-only token is not possible, an 'issues-only' token is not possible.

- Personal access tokens are not scoped to repositories or organizations. So your personal toy project token also allows access to your super-sensitive employer's repository. On top of that, your employer is unable to prevent this, unless you start using Github Enterprise _and_ an SSH CA, which is far from trivial.

It's nice that they drop username/password access, but as long as personal access tokens have such broad permissions, it does not really add any value (you should have been using 2FA anyway).

That's explained in the post linked from the blog: https://github.blog/2020-01-22-how-we-built-good-first-issue...

I'm not suggesting you lack perspective.

I am suggesting you are in no position to judge other people's problems as you are not a qualified healthcare psychologist. In denying other people's issues, you are creating a toxic environment in which some people will not ask for the help they need.

Also, your comment is utter nonsense when looking at the statistics. Sick leave in the Netherlands is below EU average [1] and the Netherlands have one of the lowest rates of burnout in Europe [2]. France has one of the highest rates.

[1]: https://gateway.euro.who.int/en/indicators/hfa_411-2700-abse... [2]: https://www.wilmarschaufeli.nl/publications/Schaufeli/500.pd...

> Expats who come to The Netherlands generally earn a lot.

Not in the last place because they are highly subsidized by not having to pay any taxes over 30% of their salary. In return for that, they post not very insightful comments like this on HN.

Mocking people's mental issues in public literally costs lives. Hope the thread starter realizes that somewhere.

> I find it hard to believe that with a list of major enterprise clients, they can't afford several thousand dollars a month?

They can probably afford it, but if every piece of your stack needs that kind of money you run out of money fairly quickly.

> Developer costs in USA run about ~$5-10k/month

They are based in the UK.

> Would be curious to hear about the number of dev-weeks they have spent learning all the stuff they mentioned, building it, troubleshooting any issues, and keeping the system running and up-to-date.

It's just an SMTP server, not rocket science.

> to run it to ASD2 and order the parts at GSX, we take the hardware back and as soon as the parts arrive

The AASP I contacted could not return the hardware until the repair was done, so bringing it in when the parts arrived was impossible. The Apple stores need 1 week for repairs nowadays.

> a reason to get next-day AppleCare support (...) Yes, that exists, just like with Dell and HP

Only for enterprise users, and it sets you back 400 EUR/yr. Dell charges 190 EUR for 3 years (in total). Quite a difference.

> hardware quality & support (if my Apple laptop has an issue, I can take it into an Apple store and get it fixed same-day in many cases

That kind of depends on the country you are in, I guess. Here in the Netherlands you first need to make an appointment (~1 week), then they order the parts (~2-3 days), then they fix the issue (~1 week). All in all you are without your laptop for 1,5 weeks. That is really lousy support compared to something like Dell's next business day on-site support.

Upgrading to a new JDK every 6 months is pushing a bit too hard if you ask me. In case of JDK 8 -> JDK 11 (LTS to LTS) you even have only 4 months.

A new JDK may have breaking changes, which may require code changes, acceptance testing, deployment to many customer sites. It is not unusual for that process to take 6 to 12 months, and you certainly do not want to repeat that process every 6 months.