Re: Twitter users: password change soon-ish

Quoting Robert Freiberger ([email protected]):

> Written to an internal log (secure behind sudo) or also indexed by
> ELK/Splunk for everyone to see?

They say internal.  I have no special reason to think this shades the
truth.

Looking from outside, this incident seems like an all-too-familiar
example of inattentive assigning and implementation of coding work:
Someone charged a team with developing software plumbing to handle a
logfile data stream without bothering to mention that the data stream
included not-yet-hashed passwords.  The assigned coders didn't bother to
look and think 'Hey, why are there plaintext passwords in here?', not
seeing that as their remit.  Work was completed, a checkmark entered on
some project plan, and everyone failed to notice the gaffe until
suddenly, one day, someone did.  That person rang the alarm, everyone
said 'Oops', and the calamity got patched.

None of that should have ever happened.  The scary bit is that things
like it happen all the time.  And the public most certainly isn't always
informed about the 'Oops' bit.