Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

zdnet.com

Post reply on HN
Print view View original

181–190 of 344 posts

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#181

Post by ljm »

hobs wrote: post #178
r0m4n0 wrote: post #155

Earlier quoted context omitted.

A far stretch to conclude that this event can equate to awful engineering. The rest of this your comment reads like you continue to be naive to Atlassian’s success. I have to think many people do find unique value in their products (myself included), some people don’t laugh rudely when they hear what folks are working on, and I think that shows in the overall achievements of the Atlassian team and product. I’ve witne…

And I've witnessed first hand the truly garbage nothing changes after adopting Jira and Confluence - a wasteland of process management through bad automation and forgotten wiki articles with Write Once Read Never behavior. Nothing Atlassian does is that much better than past tooling, it all comes down to how you want to run your org, what discipline you apply, and where you apply it.

I'm no fan of Jira or Confluence but you'll get forgotten wiki articles, for example, no matter what tech you choose.

Confluence? Forgotten

Git repos? Forgotten

Notion? New hotness, still forgotten

Google Docs / Office 365 ? Forgotten

This is just a difficult problem to solve, especially for organisations growing at speed.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#182

Post by arghwhat »

hn_throwaway_99 wrote: post #146
numair wrote: post #72

The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. We have to assume that there are problems of a similar nature in their cloud service, which is way more of a problem considering the number of orgs that depend on the JIRA SaaS offering. Maybe the founders could have used some…

> The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. Regardless of what one thinks about Atlassian, this is a completely ridiculous bullshit statement, and anyone who works in the world of business software knows it. I don't think there is a company out there that hasn't had c…

You are missing the point entirely.

Any sufficiently complicated product will eventually have major CVEs, as you say. Anyone having hosted Atlassians product know that these products are nothing but garbage fires on the inside, as the commenter above said.

Both of these statements are true and not mutually exclusive in any way.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#183

Post by gurkendoktor »

kayodelycaon wrote: post #129
nicoburns wrote: post #112

Earlier quoted context omitted.

Well if your organisation wants crappy project management tools and processes then there's nothing to be done. But there are plenty of alternatives out there for those who seek them.

There aren’t good integrated replacements. Any system that lacks a wysisyg interface for text is not a viable option. If copy and paste from Word doesn’t keep some of the formatting, forget it. Our support board has customized forms. These forms create tickets that can seamlessly be moved to our scrum board once they are vetted. We use JQL to manage a lot of the boards we use. We have custom workflows for different t…

> There aren’t good integrated replacements

I think even that would be a good attack vector against Atlassian: For them, "integration" means adding links from one product to the other. If I were to pay for an integrated suite of tools, the least I would expect is that their bloody markup languages are consistent. But because Atlassian just buys random products and then doesn't seem to ever change a single thing about them, that's not going to happen.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#184

Post by hn_throwaway_99 »

numair wrote: post #179
hn_throwaway_99 wrote: post #146

Earlier quoted context omitted.

> The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. Regardless of what one thinks about Atlassian, this is a completely ridiculous bullshit statement, and anyone who works in the world of business software knows it. I don't think there is a company out there that hasn't had c…

I don’t disagree with what you’re saying about software having ongoing vulnerability issues. But, that’s exactly what the problem is with communications-centric solutions that don’t offer strong data security protections such as end-to-end encryption: you’re always one CVE away from having your company’s data exposed. And, in this specific case, there is a MAJOR difference between Chrome getting owned, and the progra…

> and stay out of critical systems that can create cascading vulnerabilities

Oh, you mean like Microsoft and Google in the examples I gave?

Why are you changing the goal posts? Your original statement was that this issue is evidence that "everyone is now aware of the awful engineering practices that underpin their products." My clear argument is that this is not the case, as lots of companies with systemically critical software also have bugs of this magnitude, or more.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#185

Post by namdnay »

numair wrote: post #179
hn_throwaway_99 wrote: post #146

Earlier quoted context omitted.

> The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. Regardless of what one thinks about Atlassian, this is a completely ridiculous bullshit statement, and anyone who works in the world of business software knows it. I don't think there is a company out there that hasn't had c…

I don’t disagree with what you’re saying about software having ongoing vulnerability issues. But, that’s exactly what the problem is with communications-centric solutions that don’t offer strong data security protections such as end-to-end encryption: you’re always one CVE away from having your company’s data exposed. And, in this specific case, there is a MAJOR difference between Chrome getting owned, and the progra…

Much as I hate everything Atlassian touches (although Portfolio was pretty useful as a stand-alone tool if you kept it far away from JIRA), It’s not like MS Office or Sharepoint have never had vulnerabilities..

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#186

Post by riffraff »

nerdponx wrote: post #162
cogman10 wrote: post #78

Earlier quoted context omitted.

Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement. You can't easily dump Jira if you are using Jira, confluence, bitbucket, and whatever their CI/CD product is called (bamboo?)

How many PMs actually use those features? In my organization, for example, I don't see any reason why we should prefer Atlassian over Taiga, other than familiarity and inertia.

There's a ton of things you can do in Jira, and different organizations use different things. It's like excel or word, in that sense.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#187

Post by Bahamut »

marcinzm wrote: post #93
pletnes wrote: post #74

Earlier quoted context omitted.

There are many jira alternatives out there, from what I can tell. Why are they not disrupted already, if it’s such a low hanging fruit? (Honest question - I don’t have any personal preference)

Because Jira is flexible and has the needed features and integrates with most things you care about. To the point where everyone in the org can tolerate it. Alternatives tend to focus on one group of users and the rest HATE the product. I've tried a lot of these products and in the end come back to Jira because it works better on average for everyone.

This comment nails it - anyone who has had to investigate other offerings that satisfy the needs of project management, design, and engineering will quickly find that all the other options out there are total garbage in comparison to Jira, which is why Jira remains at the top of the totem pole for what it does.

As an engineer & former manager, there are definitely things I didn't like about Jira like slowness, but everything else I investigated/used were worse in multiple significant ways.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#188

Post by dwild »

> An OGNL injection vulnerability exists that would allow an authenticated user, and in some instances unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance.

For god sake, can we all agree to stop using OGNL at this point? At my previous job I kept having to fix OGNL vulnerabilities on our stack, it was awful.

Don't remember Apple developer portal hack? OGNL

What about Equifax? OGNL

This thing is so freakingly insecure it's crazy.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#189

Post by gurkendoktor »

Cederfjard wrote: post #128
nicoburns wrote: post #112

Earlier quoted context omitted.

Well if your organisation wants crappy project management tools and processes then there's nothing to be done. But there are plenty of alternatives out there for those who seek them.

Thanks, I got you. But you didn’t really address the point of the person you responded to, then, which was that part of why this space hasn’t been disrupted to a larger degree is that Atlassian products are entrenched in many companies, and that a lot of people do want that complexity (disagree with that as you or I might).

> ... and that a lot of people do want that complexity (disagree with that as you or I might).

As much as I love to hate Atlassian, I feel like complaining about Atlassian is like techies complaining about management in general. Every single anecdote is both terrible and true, but it's not quite as easy as it seems to do it better.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#190

Post by nickspicer1993 »

edoceo wrote: post #170
nickspicer1993 wrote: post #104

Earlier quoted context omitted.

I think it already has been disrupted but no company is going to switch task management software without a really good reason. But I can't imagine and fresh companies are choosing Jira over Clubhouse, Asana, Trello or what I hope to be my company at some point! https://tahsk.com

My new companies aren't. Gitlab is the new hotness

Yeah I've heard a lot of people using Gitlab as you don't need to mess around with any integration and it's all in one place which is really nice. I find actually managing the issues super lacking and frustrating personally though.
Post reply on HN