D:

[azurelunatic]

I've been hearing some really disturbing shit about unfunny login(?)/security-type issues at LJ.

I don't think anything I could say would be in the least helpful, except that if you saw stuff that you don't think you ought to have seen, please, report it to Support.

Other people have been reporting that when they leave support requests they are moved private; moving to private was standard practice for security/sensitive/needs-staff/senior support requests when I was in Support, and I see no reason for this to have changed in that time. (Private support categories are standard for that sort of stuff at Dreamwidth too.)

DDDDDDDDDDDDDD:

Comments

[arkeiryn]

Um. Well, fuck?

I'm not sure what to do with this information. But my initial instinct is to delete my entire LJ...

[cleverthylacine]

http://www.livejournal.com/support/see_request.bml?id=1395082

[geekosaur]

I would like to point out, for the benefit of those who aren't used to working with security issues, that it is customary to not publish them publicly during discovery (and often until fixed) because it would be pretty much handing out free "hack me!" advice. Having knowledge that there's a problem out there is bad enough; providing what might be hints on how to exploit it is really not so smart. (Especially since someone might immediately test it on the reporter's journal. Reporting a discovered potential security issue really shouldn't involve hanging a kick-me sign on one's back.)

[azurelunatic]

*nodding from the choir section*

I maintain a security-issue "phone tree", of the people who need to know about LJ/DW-related problems that I have discovered or learned of, if the cat is still in the bag. It generally involves denise (or fu or mark, or someone from ToS), and often enough Kat (go go team Support) and possibly Trixie or Carrie(if it involves LJ).

If the cat is out of the bag, all bets are off.