Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

zdnet.com

Post reply on HN
Print view View original

71–80 of 344 posts

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#71

Post by niffydroid »

echelon wrote: post #4

I am not in the least bit shocked. Atlassian products are some of the worst glued-together garbage in the industry. The entire product surface area is probably rife with exploits. Using Confluence or Jira will show you just how much Atlassian cares about its own products. I'd love for this to be the straw that breaks the camel's back and makes IT/infosec orgs move away from this bilge.

Bitbucket recently has shockingly poor reliability. Quite often you see nothing on the status page but see other people having issues on twitter. We've nearly migrated everything to github, plus github has better features and more powerful.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#72

Post by numair »

The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. We have to assume that there are problems of a similar nature in their cloud service, which is way more of a problem considering the number of orgs that depend on the JIRA SaaS offering.

Maybe the founders could have used some of that time spent planning a tunnel between their side-by-side $100M houses, or engaged in Twitter rants, to actually bother delivering value to customers. It’s only a matter of time before this product suite is disrupted, and it might represent one of the most obvious low-hanging opportunities in our entire industry.

I still remember being in line at a WWDC a few years back, overhearing someone ask a developer, “where do you work?” When the developer responded with “HipChat,” the other person immediately chuckled and said, “oh — Atlassian... I’m sorry” — and then everyone around them also started laughing. It’s amazing that this company continues to fall up, and that the founders have taken on roles as the ruling digital gurus of Australia (shows you why it’s so easy for the government to run circles around the local tech industry and pass whatever laws they want).

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#73

Post by indigomm »

niffydroid wrote: post #71
echelon wrote: post #4

I am not in the least bit shocked. Atlassian products are some of the worst glued-together garbage in the industry. The entire product surface area is probably rife with exploits. Using Confluence or Jira will show you just how much Atlassian cares about its own products. I'd love for this to be the straw that breaks the camel's back and makes IT/infosec orgs move away from this bilge.

Bitbucket recently has shockingly poor reliability. Quite often you see nothing on the status page but see other people having issues on twitter. We've nearly migrated everything to github, plus github has better features and more powerful.

They've been doing a large transformation recently to put it on a new platform. Not saying that's an excuse, but it is an explanation for some of the problems they've had.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#74

Post by pletnes »

numair wrote: post #72

The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. We have to assume that there are problems of a similar nature in their cloud service, which is way more of a problem considering the number of orgs that depend on the JIRA SaaS offering. Maybe the founders could have used some…

There are many jira alternatives out there, from what I can tell. Why are they not disrupted already, if it’s such a low hanging fruit? (Honest question - I don’t have any personal preference)

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#75

Post by jordanbeiber »

galangalalgol wrote: post #70
jordanbeiber wrote: post #61

Earlier quoted context omitted.

Totally agree with your first two sentences. However, the final part has nothing to do with jira IMO. You would have the same behavior in these organizations regardless of tool. The dysfunction you describe goes way beyond a single or set of tools.

It is hard to say for sure, but this organization used configuration controlled documents for design documentation before atlassian came along. When they made the switch (and hired oodles of graduates) suddenly about half of them ignore confluence or latex for design, because "jira has markdown". Oh hurray, we have a bad typesetting language mixed in with our bug tracker, lets shove our entire design in there! It is…

Can't but help to feel that what you describe is a breakdown of both organization and work process.

It wasn't atlassian that "came along" - someone penned down an agreement and, from what it sounds, there was a lack of clarity both in regards to current and future principles of work and collaboration.

What we can do, as devs, to protect ourselves from the madness you describe is to be explicit about our work processes and their purpose. Nothing much, but just a set of agreed upon principles and ways of working which should have nothing to do with tools.

What you end up with, by being explicit, is for having "something" to be supported by one or several tools.

Makes it easier to evaluate, select and change tooling that is fit for purpose.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#76

Post by ssddanbrown »

unixhero wrote: post #32
m_eiman wrote: post #6

Earlier quoted context omitted.

Any suggestions on what to use instead of Confluence? Need to run on-prem, it's mostly the wiki-like features I'm interested in.

I am considering going with Bookstack Wiki for my company. But I am not a Fortune500 company. I would say it is very darn complete, perhaps without the syntactic linking that Confluence has. The only thing missing from it, is a very solid backup and restore method from the admin panel. The authors want users to rely on database backups and file level backups, that must be handled manually. Essentially saying "not my…

> The authors want users to rely on database backups and file level backups, that must be handled manually. Essentially saying "not my problem".

Just a note on this, this is something I'd like to build in eventually. It's just that each layer of our own we add upon the underlying methods increase the risk of error in something fairly critical.

A simple command-line based backup solution wouldn't be too difficult to add, but restore and admin-panel usage are more significant challenges once you get into it.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#77

Post by iso1631 »

polote wrote: post #25

That's one of the selling point of Saas compared to hosted instance honestly. Some company think that having Confluence hosted internally is going to increase the security. But this is wrong. When you rely on a Saas provider. The provider has people who monitor the infrastructure constantly whereas when you hosted on your own server, the confluence instance is just one of the many services that they manage. And even…

It's the selling point of self hosting. My jira is behind x509 client certs, others I know are behind oidc connections. You need to be an authenticated user to even load the page. There's two layers of protection from two different companies.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#78

Post by cogman10 »

pletnes wrote: post #74
numair wrote: post #72

The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. We have to assume that there are problems of a similar nature in their cloud service, which is way more of a problem considering the number of orgs that depend on the JIRA SaaS offering. Maybe the founders could have used some…

There are many jira alternatives out there, from what I can tell. Why are they not disrupted already, if it’s such a low hanging fruit? (Honest question - I don’t have any personal preference)

Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement.

You can't easily dump Jira if you are using Jira, confluence, bitbucket, and whatever their CI/CD product is called (bamboo?)

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#79

Post by ssddanbrown »

js4ever wrote: post #43
m_eiman wrote: post #6

Earlier quoted context omitted.

Any suggestions on what to use instead of Confluence? Need to run on-prem, it's mostly the wiki-like features I'm interested in.

You can try Wiki.js or bookstack, both are open source and nice

Thanks for suggesting BookStack [1]. I did initially create the project as a free open-source alternative to confluence as I didn't want financial approval being a limiter to documentation collaboration.

One of the main things to consider with BookStack is the semi-fixed Shelf > Book > Chapter > Page structure (Where pages have content, chapters & shelves are optional, and Books can be within multiple shelves). For some this structure is limiting, For others it helps drive organization.

[1]: https://www.bookstackapp.com/

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#80

Post by phreack »

pletnes wrote: post #74
numair wrote: post #72

The good thing about the fact that Atlassian offers both on-prem and cloud versions of their offerings is, everyone is now aware of the awful engineering practices that underpin their products. We have to assume that there are problems of a similar nature in their cloud service, which is way more of a problem considering the number of orgs that depend on the JIRA SaaS offering. Maybe the founders could have used some…

There are many jira alternatives out there, from what I can tell. Why are they not disrupted already, if it’s such a low hanging fruit? (Honest question - I don’t have any personal preference)

I wish I knew the answer as well. I believe many managers trained in the art of building software without knowing how to build software are too married to doing processes in a very specific way that's very tightly coupled to Jira, and feel safe and at home with the added complexity it provides, so they vouch for it. But that's just a theory from personal experience.
Post reply on HN