57 ms·

Has bitbucket had any security issues like github has had in the past?

by orangethirty 13y ago

jespern 13y ago
We've never had a breach.
- kelnos 13y ago
  ... that you know of. I think the parent was asking a broader question, even including security issues that were brought up and fixed without being exploited.
rogerbinns 13y ago
They had one I reported Oct 2010, took a while to convince was an issue and they finally fixed a few months after saying they would. The URLS for attachments to private issues in private repos were guessable and publicly accessible if you guessed right (ie no authentication for them). The URLs were like this https://bitbucket-assetroot.s3.amazonaws.com/<username>/<reponame>/<date>/<ticketnumber>/attachmentname https://bitbucket-assetroot.s3.amazonaws.com/<username&#... Obviously a bit tedious to guess for humans, but no big deal for computers.
- orangethirty 13y ago
  Do you put this issue in the same level as the ones github has had?
  - rogerbinns 13y ago
    Issues always happen. It is how they are handled that makes the difference. I've not paid close attention to Github but it appears they react responsibly and quickly. With my issue it seemed like Bitbucket was a one man shop and I suspect that if I had thrown a fit things would have happened quickly. Jesper was attending pycon and I was fine with addressing it after that, but then it was not promptly attended to afterwards. I have no records of how long it took to fix but it was at least several weeks and may have been months. He did dispute "easily guessable". (The Bitbucket service at the time was also overwhelmed with languishing tickets.) In my own view, private data being accessible no matter how improbable is always an immediate issue. Issues that initially seem improbable get turned into the probable very quickly by the bad guys who are far more imaginative. But as I said this was late in 2010. I have no idea if the culture of Bitbucket has changed since then or is better.
yawaramin 13y ago
They have a neat status page similar to GitHub's: http://status.bitbucket.org/ http://status.bitbucket.org/

Has bitbucket had any security issues like github has had in the past?

jespern 13y ago

We've never had a breach.

kelnos 13y ago
... that you know of. I think the parent was asking a broader question, even including security issues that were brought up and fixed without being exploited.

rogerbinns 13y ago

They had one I reported Oct 2010, took a while to convince was an issue and they finally fixed a few months after saying they would. The URLS for attachments to private issues in private repos were guessable and publicly accessible if you guessed right (ie no authentication for them). The URLs were like this https://bitbucket-assetroot.s3.amazonaws.com/<username>/<reponame>/<date>/<ticketnumber>/attachmentname https://bitbucket-assetroot.s3.amazonaws.com/<username&#... Obviously a bit tedious to guess for humans, but no big deal for computers.

orangethirty 13y ago
Do you put this issue in the same level as the ones github has had?
- rogerbinns 13y ago
  Issues always happen. It is how they are handled that makes the difference. I've not paid close attention to Github but it appears they react responsibly and quickly. With my issue it seemed like Bitbucket was a one man shop and I suspect that if I had thrown a fit things would have happened quickly. Jesper was attending pycon and I was fine with addressing it after that, but then it was not promptly attended to afterwards. I have no records of how long it took to fix but it was at least several weeks and may have been months. He did dispute "easily guessable". (The Bitbucket service at the time was also overwhelmed with languishing tickets.) In my own view, private data being accessible no matter how improbable is always an immediate issue. Issues that initially seem improbable get turned into the probable very quickly by the bad guys who are far more imaginative. But as I said this was late in 2010. I have no idea if the culture of Bitbucket has changed since then or is better.

yawaramin 13y ago

They have a neat status page similar to GitHub's: http://status.bitbucket.org/ http://status.bitbucket.org/