Live data from Hacker News

US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

zdnet.com

341–344 of 344 posts

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#341

Earlier quoted context omitted.

Dunno about all that but it doesn't support inline code snippets. You've gotta use formatted text, which doesn't look good. Seems like an intern project at best.

Huh? What do you mean, isn't Ordinary text blah blah {{interspersed code snippet}} some more ordinary blah blah text working, or haven't you tried it?

Just haven't tried it, didn't mean to imply they were false.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#342

Earlier quoted context omitted.

Huh? What do you mean, isn't Ordinary text blah blah {{interspersed code snippet}} some more ordinary blah blah text working, or haven't you tried it?

Just haven't tried it, didn't mean to imply they were false.

Ya gotta use the mark-up text tab to write, and only switch over to the other one ("visual" something?) to check that it looks OK.

Always annoys the heck outta me when I forget to switch back before submitting my comment. It remembers, and gives me the same tab next time I start to comment on any ticket.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#343
post #255

Earlier quoted context omitted.

> these products are nothing but garbage fires Would you care to give us alternatives, for example, to the JIRA bug tracker (which I used a lot, slowly :-))

> Would you care to give us alternatives, for example, to the JIRA bug tracker Paper. An Excel spreadsheet shared on a Windows for Workgroups share drive. Carrier pigeon. Quitting software to become a llama herder. Seriously, though, after over two decades of using different tracking systems I think that the real alternative to stuff like Jira is to not go there. You may think that you need all those bells and whistl…

I don't disagree that Atlassian programs are generally bloated, but it is interesting to see everyone jumping at JIRA when its Confluence with the CVE...

JIRA is too many things to too many people - in the quest to be everyone's bug tracker, they wrote (badly) in the whole kitchen sink. This is a general issue with most software, though. Especially big software.

You cannot have complex capable software that is also simple. That's an oxymoron. You can have complex software which works, but it is difficult to get there, and keep it there. There is simply too much that can go wrong that over time, it almost must go wrong.

Keeping everything 'simple' is not an alternative - the world is complex and so even a bunch of simple things, when put together, make something complex. Think unix shell scripts which can be so much sphagetti. The unix philosophy is to keep things simple, and yet ignoring the complexity leads to its own complexity.

That's the real 'terrible engineeing practices' which get down Atlassian and everyone else's programs.

Someone said 'use paper' or 'quit and become a llamma herder' - these seem simple but again, paper burns, shepherds get shot or held up by drug gangs.

All to say, I don't think JIRA is actually that bad. There could be worse products, there could be better. But it would exceedingly difficult to make something simple which also served everybody.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#344
post #72

The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. We have to assume that there are problems of a similar nature in their cloud service, which is way more of a problem considering the number of orgs that depend on the JIRA SaaS offering. Maybe the founders could have used some…

Downloading 20MB of javascript to view a wiki page is all I needed to know that Atlassian is a garbage fire of acquired products stitched together. Well that and spending any amount of time using it and feeling the crustiness.

JIRA has a solid use case (if maybe breeding ground for CVEs), confluence is just a bad competitor to OneNote. Its not a wiki...it stopped being a wiki a long time ago.
Post reply on HN