ARGH ARGH ARGH!

[branchandroot]

OMG, LJ YOU UTTER FUCKERS!

Not ONLY do they fuck up the latest release so it allows random people access to random other people's journals and HAVEN'T ROLLED THE RELEASE BACK, but NOW LJ-SEC CAN'T LOG IN. Because those remote log-in pathways that just changed?

AFFECT THE ONLY APPLICATION THAT CAN DO BULK DELETION OF LJ ENTRIES.

RAGE.

*breathing heavily* I can only hope that the lj-sec developer is a kind soul and releases an update soon. Because this is absolutely it, I'm not leaving my content on that service for another second than I have to. Nothing but public links to other sites!

ETA: It has been suggested by a party who wishes to remain unnamed, but who has some cause to know, that the reason a release like this will not be rolled back despite security failure is most usually that this release fixes some /other/ security bug that was being actively exploited. Additional recommendation: try logging out of LJ and not logging back in until it's fixed. This would kill one possible cause of the mad account access swapping. If it's another cause, apparently we're fucked until LJ's worker bees can scramble a fix. *sighs*

Comments

[branchandroot]

I can only imagine. Talk about a nightmare.

[synecdochic]

Even if it really was the Varnish caching problem they mentioned (which I'm not convinced of, given that the reports kept going for ~24h or so after the supposed fix), that post was nobody's idea of a good explanation :(

[dragonwolf]

So...um....why is Varnish even set up to cache the pages that should be encrypted and pretty much by security definition not cached, even if everything else is cached and not encrypted? Hell, if only the "sensitive" pages (ie - payment, login, etc) are the only ones that are encrypted (the issues with things like Firesheep notwithstanding), it should make it easier to filter out such stuff, because it will be on a different port. In fact, I'm fairly certain Varnish ignores port 443 by default, at least on the standard installs.

Yeah...their explanation seems fishy to me.

/end rant of fellow developer/sysadmin

[synecdochic]

I am pretty sure the answer involves a firm bit of Dunning-Krueger.