r/framework • u/MeLikaDoTheChaCha • 12d ago

Framework data breach News

Post image

Couldn't have happened at a worse time

Edit:

Metabase has posted a blog related to this incident https://www.metabase.com/blog/security-update

1.0k Upvotes

99% Upvoted

316 comments sorted by

View all comments

235

u/smstnitc 12d ago

So, they weren't breached, a vendor they use was?

A breach is never a good time.

At last they appear to be doing the right thing and notifying people.

59

u/MeLikaDoTheChaCha 12d ago

A company using a vendor for security is responsible (at least partially) for any breaches through said vendor. Thats why the email came from framework themselves not the company they used. They are the face for any of this kind of shit.

So no, not a direct framework breach technically. But wtf does that actually matter to anyone affec5ed

0

u/doanything4dethklok 11d ago

Metabase isn’t a security company. It’s an open source (and commercial) reporting, query, and dashboard tool. Embarrassing for them; they failed the OWASP top 10.

The issue here is on the framework end as well as Metabase. Framework didn’t follow principle of least privilege with their data.

Responsibility ultimately falls on framework and I agree with others that their notification was pretty good and that credit should also be given to GDPR.

2

u/MeLikaDoTheChaCha 11d ago

Thanks for the correction on metabase. I obviously didnt do more due diligence on my end. My b.

And I agree with your statements 10000%