Hacker News Reader

rkh_popcornon Post-Mortem and Security Advisory: Data Exposure After travis-ci.com Outage

I was looking for one as well, but it seems we did not write a blog post. I will do some digging when I find the time, as I know we at least messaged some people that voiced their frustration directly.

rkh_popcornon Post-Mortem and Security Advisory: Data Exposure After travis-ci.com Outage

Correct, this was from an overenthusiastic user, someone we did not know and had no direct contact with.

At the time we weren't actually making money yet, and most of the contributions to Travis CI came from outside collaborators.

To add to the confusion, we did indeed have a bot in the early days that would comment on pull requests, but only if the repository was using Travis CI already (this has now been replaced by GitHub's status API). However, this was not the same bot account that kept opening unsolicited pull requests on random projects.

rkh_popcornon Post-Mortem and Security Advisory: Data Exposure After travis-ci.com Outage

Apologies that you were affected by this. The script creating these pull requests was created and run by a third party not affiliated with the company. We were similarly upset by this.