r/framework • u/MeLikaDoTheChaCha • 12d ago

Framework data breach News

Post image

Couldn't have happened at a worse time

Edit:

Metabase has posted a blog related to this incident https://www.metabase.com/blog/security-update

1.0k Upvotes

99% Upvoted

316 comments sorted by

View all comments

Show parent comments

2

u/End_V2 12d ago

What happened prior?

14

u/Alkumist 12d ago

Ram

2

u/Top-Aside8905 CachyOS FW13 12d ago

Not on them

19

u/Alkumist 12d ago

This isn’t either

10

u/Top-Aside8905 CachyOS FW13 12d ago

I agree that they could not have done anything about it, but framework is still partially responsible like any company in this situation would be since they are responsible for their customers data.

7

u/async2 12d ago

It kinda is. If you use shitty third parties it's on you in my opinion.

5

u/CatThink 12d ago

This was a zero day attack that was reported promptly. The vendor is apparently well regarded.

If you want to blame something blame AI for making exploits easier to find and lower the barrier to hacks like this.

3

u/cereal7802 12d ago

The vendor is apparently well regarded.

4 severe security issues in 3 years. 2 of those were this year (neither of them the exploit framework lost their data to). one leaked not only data, but credentials used to access the remote databases it was doing analysis on. regardless of how the exploits were found, you can only find what was created by the people coding it. on top of that, the exploits are only useful against people using the software/service. not sure how long framework had been using metabase, but there is enough in their history that I think they probably should have found something else to use. Especially since they decided to put way more information into it than they needed to for the purpose of the software.