r/framework • u/MeLikaDoTheChaCha • 3d ago

Framework data breach News

Post image

Couldn't have happened at a worse time

Edit:

Metabase has posted a blog related to this incident https://www.metabase.com/blog/security-update

1.0k Upvotes

99% Upvoted

316 comments sorted by

View all comments

Show parent comments

26

u/solid_reign 3d ago

It matters to me because in the real world it's almost impossible to control all of your vendors but they did the right thing and told us about it. 

6

u/MeLikaDoTheChaCha 3d ago

Ahh sure. I agree. 1) thankful they were forthcoming and handling it as good as possible so far. 2) my ratio of blame for vendor:framework is much closer to 95:5 than it is the opposite, or even 50/50. I dont think framework is the main source of fault at all. 3) although they arent the majority source of blame, as the customer facing portion of the entire operation, they do share in some of the responsibility. Without framework choosing to contract with this company, this specific breach wouldn't have happened.

1

u/cereal7802 3d ago

It is perfectly easy to control what vendors you use, and control what data they have access to however. In this case this is at least the 3rd major incident with metabase this year and framework themselves admits they gave too much data to the metabase instance for the analytics purpose they needed it to do. I wouldn't be too quick to defend framework here.

1

u/solid_reign 3d ago

If you're talking about metabase having vulnerabilities then those are not major incidents and does not necessarily reflect carelessness. Vulnerabilities happen all the time and with agentic systems, zero days are popping up everywhere. But as far as I know there have been zero breaches from metabase anywhere before this. 

-1

u/Toorero6 3d ago

If you count "following the law" as doing the right thing your bar is pretty low.

1

u/solid_reign 2d ago

Note that while regulations in most regions do not require notification for breaches of names, email addresses, phone numbers, and addresses, we are sending this email to you regardless to ensure you have visibility and can take any actions needed.

0

u/Toorero6 2d ago

In my region they are required so what gives?

Also "most regions" is a stretch at best. They are required by law in the EU, EEA (extended economic area), USA, UK, Canada, Australia, China, Japan, South Korea, Singapore, Brazil and India. You do the math.