Re:GitLab Pages Security Issue Notification
by satish-setty on Monday February 12, 2018 @10:18AM
(#16359098)
As a customer of Gitlab who uses custom domains, I haven't got any email notification about this. Especially when the post says it requires user action. As much as I love gitlab, this negligence is unacceptable.
[ Parent
| on HN ]
Re:GitLab Pages Security Issue Notification
by gitlab-security on Monday February 12, 2018 @01:33PM
(#16360742)
We apologize that you haven't received an email notification. We've sent email notifications to as many customers as possible, but obviously did not get everyone.
Rest assured that when domain verification rolls out, there will be an email notification you'll receive regarding a grace period to address your required user actions prior to re-verification.
If you have any further questions about this plan, feel free to contact us directly at [email protected]
Re:GitLab Pages Security Issue Notification
by enzanki_ars on Monday February 12, 2018 @11:40AM
(#16359778)
It seems that a notice would only need to be sent to users that used to have an active GitLab pages setup with a custom domain that does not any more. No point in alerting customers that are not affected yet in my mind. If you do have a currently active setup, not action is needed until a fix is issue, and then it would be necessary to alert people.