Ugh. Just.
Users should have been informed _immediately_ that they needed to rotate their passwords. You don't have to give details, but you _do_ have to tell people to do that _as soon as the breach happens_.
Users should also have been informed _as soon as possible_ that a breach had occurred, again even if you can't give details for whatever reasons.
"Without undue delay" is the language in the GDPR. That seems like a good guideline.
#Kolektiva
Users should have been informed _immediately_ that they needed to rotate their passwords. You don't have to give details, but you _do_ have to tell people to do that _as soon as the breach happens_.
Users should also have been informed _as soon as possible_ that a breach had occurred, again even if you can't give details for whatever reasons.
"Without undue delay" is the language in the GDPR. That seems like a good guideline.
#Kolektiva
Hrefna (DHC) •
What safeguards are you putting in place to prevent this? What policy, technical, or cultural changes are you putting into place? What have you learned?
Also let's note that #mastodon servers store more than just _your_ users data. You need to be doing due diligence to inform _them_ as well, and posting as an admin on your own server isn't it.
Hrefna (DHC) •
The way this was handled was deeply fraked up but the response makes it worse not better.
I handle data professionally. I am deeply professionally offended by this conduct, but it isn't the _conduct_—itself bad—that bothers me nearly so much as how it was framed and how the apologia was presented.
#Kolektiva
Hrefna (DHC) •
1. Do due diligence on a notification. Go through your logs and find every DM that was involved and message or email every participant. By hand if you have to
2. Recognize the scope and scale of the problem. Don't minimize it as a "small mistake" or talk about the security of mastodon generally. Talk about _your_ systems and decisions
3. Run a full postmortem. Publish it.
4. Take action from the results of that postmortem to prevent recurrence
#Kolektiva
Doug Webb hat dies geteilt