News for hackers. Stuff that matters.
Re:Even the FBI says you need to patch this Atlassian Conflu... by skipper-roo on Wednesday October 18, 2023 @01:02PM (#37931513)
What is atlassian doing? Last year it was the RCE CVE-2022-26134. And now this. Getting published by CISA every year isn't a good look.
Re:Even the FBI says you need to patch this Atlassian Conflu... by RomanPushkin on Wednesday October 18, 2023 @01:14PM (#37931664)
We once had a meeting with our ex-CTO. The question was how do you envision the technical future of Atlassian. The most popular tag was "fire", referring to the "Five-alarm fire" program they introduced to fight a series or emerging outages. This program was over at the time when we had this poll. Seems like everyone in the org saw that in 2021. Later it was confirmed multiple times, with one of the services down for almost a week for some clients, and TBH with other outages. And in 2021 the CTO just ignored the most popular "fire" answer saying something "while we're getting votes coming in, let's talk about..."

They replaced CTO, but it didn't help. At this point I'm pretty confident it's about founders who cannot keep it under control. So you know, this org is 70-80% KTLO.

Re:Even the FBI says you need to patch this Atlassian Conflu... by talent_deprived on Wednesday October 18, 2023 @01:28PM (#37931889)
IDK, I've used Jira and Confluence at almost every place I've worked the past 20 years, love those tools.
Re:Even the FBI says you need to patch this Atlassian Conflu... by RomanPushkin on Wednesday October 18, 2023 @02:10PM (#37932470)
There is pretty substantial number of folks who hate Jira, TBH. But you're the reason is their stock is still flat, and the entire company worth something.
Re:Even the FBI says you need to patch this Atlassian Conflu... by ninju on Wednesday October 18, 2023 @04:36PM (#37934443)
> reason is their stock is still flat

It's up 20% in the last 6 months https://www.google.com/finance/quote/TEAM:NASDAQ?sa=X&ved=2a...

Re:Even the FBI says you need to patch this Atlassian Conflu... by RomanPushkin on Friday October 20, 2023 @12:27PM (#37958225)
Even if it's flat you can find a time frame when it's up. The reality is it's not the best stock by any means, and it will never will be. Why? Because it's Atlassian. No-innovation, KTLO-kind-of-company.
Re:Even the FBI says you need to patch this Atlassian Conflu... by sofixa on Thursday October 19, 2023 @03:57AM (#37939842)
They probably don't hate Jira, but specific implementations of it, which can easily turn to shit with bad management because the tool is flexible enough to allow it.
Re:Even the FBI says you need to patch this Atlassian Conflu... by mschuster91 on Wednesday October 18, 2023 @02:37PM (#37932811)
> At this point I'm pretty confident it's about founders who cannot keep it under control.

They seem to be purely on the growth-by-acquisition trend, hell almost all of their products are acquisitions that have been more-or-less shoddily "integrated"... just a week ago they bought Loom for a billion $ - money that would have been better invested in bringing their code and service quality up to speed.

Atlassian is enshittification-as-a-service, just that this time it isn't the general population being squeezed but large corporations.

Re:Even the FBI says you need to patch this Atlassian Conflu... by justinpombrio on Wednesday October 18, 2023 @01:10PM (#37931615)
Don't forget that time last year they accidentally deleted data for 400 customers, and it took them 2+ weeks to restore it. Which is concerning when taken in conjunction with their plan to require all new accounts to be cloud hosted (IIRC).

Having used Jira, it was very clear from the sorts of bugs it had that the codebase is a jumbled mess, so I'm not at all surprised it's full of security holes.

https://www.theregister.com/2022/04/14/atlassian_ongoing_out...

Re:Even the FBI says you need to patch this Atlassian Conflu... by nonameiguess on Wednesday October 18, 2023 @04:17PM (#37934208)
I don't remember if it was this one, but Confluence had a pre-login vulnerability a while back that was actively exploited on DI2E, which had been the DoD's largest unclassified system, used as a collaboration and platform layer for all defense and intelligence projects that didn't have their own isolated environment, ironically only a couple months before it was scheduled to sunset anyway. They had to lock and bring down their entire data center for months before they could be sure everything was clean, and all defense projects that didn't have their planning data backed up somewhere else just lost it that entire time. And we'll never know how many programs that were considered sensitive but not enough to be classified had planning data compromised or by whom.

The only reason Atlassian hasn't totally lost the entire US government at this point is inertia and the remaining influence of however many thousands of agile consultants and project managers out there just love Jira and don't want anyone to move their cheese.