A human error caused some sensitive server...

http://staff.tumblr.com/post/3959106211/update-regarding-security-issue

by GVRV • 15 years ago

49 18 15 years ago

staff.tumblr.com

j2d2j2d22• 15 years ago

Aren't all bugs effectively a human error at some level? In this case, the human wrote bad PHP.

I hope Tumblr will keep us more in the loop on this than when they were down for 24+ hours.

knowtheory2• 15 years ago

no?

Bugs can arise when a system or code base is being used in a manner that was not originally envisioned by its author.

That's not a bug, that's something more akin to failure due to scope creep.

j2d2j2d22• 15 years ago

I fail to see how that isn't also a human error?

nbpoole• 15 years ago

elliottcarlson• 15 years ago

Since all that really can be deferred from the dumped code is that someone made a typo in a globally included config file (whether it was outside of webroot or not can't really be determined). The obvious issue is that obviously there was no process for testing code prior to deployment. This could have been caught using a standard Dev/Stage/Production environment setup, or even a quick test prior to deployment to Production. Other possible ways to catch this is with proper Unit Testing (which would have broken when not a single service would work due to no config params coming through), or a proper Continuous Integration environment to handle all that.

krobertson• 15 years ago

I'm really beginning to wonder what the hell is going on at Tumblr. Constant downtime to where their down message is the new fail whale, cases of severe downtime with poor communication, and now this.

Hopefully the shape up. I'd have serious concerns even running a personal blog on there.

itsnotvalid2• 15 years ago

I think they need to further explain what exactly happened than simply stating "human error". If it is avoidable, admit what it is and also let other people to learn this lesson.

What configuration error (technically, by definitions from some IEEE guidelines, mistakes) did they make to have this happening?

donohoe• 15 years ago

No. I don't think they do. They've made a mistake and as long as they are willing to take responsibility for the consequences then I don't see the need for a public post-mortem just to satisfy our curiosity.

itsnotvalid2• 15 years ago

I guess you're right. Anyway the reason is pretty clear enough after actually reading the pasted code.

drdaeman• 15 years ago

> What configuration error (technically, by definitions from some IEEE guidelines, mistakes) did they make to have this happening?

They edited .php file on a production server and made a typo, so the file, containing sensitive information started with "i?php" instead of "<?php".

My guess that happened because someone used vi/vim and hit "i" twice.

jrockway• 15 years ago

The fact that this occurred at all is still unacceptable, and we’ll be seriously evaluating and adjusting our processes to ensure an error like this can never happen again.

I'm not aware of any theorem provers for Apache config files.

A human error caused some sensitive server...

Related Stories