News for hackers. Stuff that matters.

A comment on Heroku Security Notification. Parent comment

Re:Heroku Security Notification by chii on Thursday May 05, 2022 @12:21AM (#31269439)
it might be that it took this amount of time to establish the facts of the events. If they recounted an incorrect version early, it might do more damage than not telling it.

I dont know if the github disclosure "includes" heroku's disclosure : https://github.blog/2022-04-15-security-alert-stolen-oauth-u... - but it was at least april 15th - close-ish to when the event occurred.

[ Parent | on HN ]
Re:Heroku Security Notification by bigDinosaur on Thursday May 05, 2022 @05:53AM (#31271419)
Is it ever true that earlier indications that credentials should be rotated leads to worse outcomes, though, as just one example?

I'm sure I've received emails of the form: we suspect there may have been a breach, so we're forcing password resets, and have always taken that fine.

[ Parent | on HN ]