ARGH ARGH ARGH!

[branchandroot]

OMG, LJ YOU UTTER FUCKERS!

Not ONLY do they fuck up the latest release so it allows random people access to random other people's journals and HAVEN'T ROLLED THE RELEASE BACK, but NOW LJ-SEC CAN'T LOG IN. Because those remote log-in pathways that just changed?

AFFECT THE ONLY APPLICATION THAT CAN DO BULK DELETION OF LJ ENTRIES.

RAGE.

*breathing heavily* I can only hope that the lj-sec developer is a kind soul and releases an update soon. Because this is absolutely it, I'm not leaving my content on that service for another second than I have to. Nothing but public links to other sites!

ETA: It has been suggested by a party who wishes to remain unnamed, but who has some cause to know, that the reason a release like this will not be rolled back despite security failure is most usually that this release fixes some /other/ security bug that was being actively exploited. Additional recommendation: try logging out of LJ and not logging back in until it's fixed. This would kill one possible cause of the mad account access swapping. If it's another cause, apparently we're fucked until LJ's worker bees can scramble a fix. *sighs*

Comments

[foxinthestars]

Not being knowledgeable about programming at all, my initial reaction was "that can even happen!?" After reading the comments here I put up a quick post offering my DW invites to my LJ friends, logged out and restarted my browser...

[branchandroot]

*glum* Yeah. On the off chance that it works, I am not logging into LJ again until someone keeping track reports that there are no new log-in bugs reported.

[dragonwolf]

If by "that" you mean the Varnish snafu...it's one of those things that can, but really shouldn't. You have to actually tell Varnish to cache anything that goes over HTTPS, which is what the really sensitive pages, at least (login, account info, etc), if not everything when logged in, should go over. If it truly is/was a Varnish issue, that says to me that someone who's dealing with Varnish...well...shouldn't be.