I am sorry, this is "Resolved"? How can they even consider marking this resolved in any situation. Yeah we exposed your env vars but we told you about it over email so it's all good... We dont know how or to what extend though.
theturtletalks 59 minutes ago [-]
The biggest case for building bespoke software is that you drop your attack surface area and it’s not as lucrative to hack one person. Don’t even expose it to the internet if you don’t need to and just run Tailscale.
asdfsa32 1 hours ago [-]
So at this rate, how long before people start hiding use of AI in development of in their SaaS and services? or people really don't care, do they?
iampims 2 hours ago [-]
It’s bold to set status page incident to resolved.
weird-eye-issue 2 hours ago [-]
If they fixed the exploit then what do you want them to do? Do they need to wait an arbitrary amount of time before setting it to resolved?
eddythompson80 1 hours ago [-]
I don't disagree with you, but I think generally when the mistake involves compromised user data, the answer is a bit more emotionally driven. People get rightfully mad when things like that happens, and services usually keep the incident in a "Mitigated" status while they "work with their customers to ensure blah blah blah" or whatever. Everywhere I've personally worked the Mitigated->Resolved involves publishing a postmortem, repair items, and general assurances or safe guards based on learnings from the incident that the issue won't happen again. However, the industry as a whole doesn't have a standard for what the line between Mitigation and Resolution is.
weird-eye-issue 1 hours ago [-]
So the active incident is now fixed and they've already reached out to impacted customers but they can't mark it as resolved yet because they are still yet to publish a more detailed blog post?
jtchang 32 minutes ago [-]
It's not that they can't mark it as resolved.
It's just that it is bad business to do so.
How they handle the communication on the incident is crucially as important as remediating the original cause.
Just the fact that they are doing this means I will probably never use this service or recommend this service to anyone else.
weird-eye-issue 21 minutes ago [-]
Okay so let's just say you are one of those affected users
The founder of the company has already emailed you with details and their support team is around for you to ask any follow-up questions
At this point are you saying you would actually be upset and leave because the incident on their status page has been marked as resolved?
tuwtuwtuwtuw 11 minutes ago [-]
Yes.
cheeze 1 hours ago [-]
I like the fancy gradient INCIDENT REPORT image as well. At least it looks fancy and AI-ey
reassess_blind 3 hours ago [-]
Have any of these companies disclosed the actual vulnerabilities used to gain access to their systems?
dboreham 1 hours ago [-]
No. Which may mean they don't know.
fathermarz 1 hours ago [-]
Holy smokes, is security just not a priority at all anymore? Like in what world do we live in, that this is acceptable. And at the volume this has been happening, bad guys are having a FIELD DAY.
OccamsMirror 48 minutes ago [-]
What makes you think security was ever a priority?
2 hours ago [-]
rvz 58 minutes ago [-]
Given the recent Claude Code remote access tool, it would be wise to not install any new software, or use any package manager for a few weeks as they could have already been silently backdoored during the aftermath of that incident.
cpursley 26 minutes ago [-]
The very fact that Nextjs vibe projects need an external (and paid!) background jobs / async service show how much of an anti pattern that this framework and similar are. Just use a sensible stack from day one that can handle concurrency out of the box like Elixir or something with established open source background jobs library. Then you can worry less about this kind of 3rd party nonsense. Ditto on auth.
multiplegeorges 18 minutes ago [-]
Yes, outsourcing these kinds of core functionality (your queue, your users table!) is insane to me.
Rendered at 06:07:26 GMT+0000 (Coordinated Universal Time) with Vercel.
How they handle the communication on the incident is crucially as important as remediating the original cause.
Just the fact that they are doing this means I will probably never use this service or recommend this service to anyone else.
The founder of the company has already emailed you with details and their support team is around for you to ask any follow-up questions
At this point are you saying you would actually be upset and leave because the incident on their status page has been marked as resolved?