The Loop

« first day (2805 days earlier) ← previous day next day → last day (2147 days later) »

7:17 AM

@TomJNowell Yes, the error log contains the errors of every website hosted on the entire server, including the other people's sites. And here's the worse part: It's intentional. AND here's the worst part! It exposes your IP and tells you that you can filter the results based on your IP

This is seriously unexpected since bluehosts is recommended by wordpress.org itself

5 hours later…

Tom J Nowell

11:53 AM

@JackJohansson that's a serious data breach

and that's before we get on to GDPR

you have access to personally identifiable information, and should report it

Tom J Nowell

12:08 PM

you need to contact them and start considering data breach regulations and processes

including potential breaches of your own users data

I'd advise at this point that you should start talking to an appropriate lawyer for legal counsel

and make a lot of noise in bluehosts direction

Jack Johansson

@TomJNowell Do you think a big company like bluehost will care about a single report? Should I even consider it?

Tom J Nowell

@JackJohansson regulators and customers will

this affects your own compliance with GDPR

if I were you, at a minimum I would explore alternative hosting

and see what results are in your error logs, you may well have to notify your users/customers

@JackJohansson I can't tell from that screenshot

and you shouldn't be sharing it with me eitherway

Jack Johansson

Well that's all I have, if you can't tell I can't tell either.

Tom J Nowell

that message at the very top is all I need to know to know it's a problem

Jack Johansson

The one that says the main log is shared?

Tom J Nowell

12:21 PM

otherwise it's an image, I can't search through it, it's visually difficult to read

and i have no idea which is yours and which isn't

it would honestly take me several hours to go through that

yes, the main log is shared

lets say there's an abortion website on the same server

Jack Johansson

It was just to demonstrate how they share the log, I didn't want you to read specific content

Tom J Nowell

and the dev was sloppy and it throws a warning on every page load

you can go through and collect an IP list of users of that abortion website

that's personally identifiable information

IPs are considered personally identifiable under GDPR

and uRLs might contain other sensitive information

it's a significant breach, I strongly recommend seeking legal counsel and finding a new host

and reporting it immediatley

in the UK I would report it to ICO but Bluehost should be your first port of call

Jack Johansson

I'll contact their support first to see what they reply

Tom J Nowell

don't be under any allusions that this is insignificant or a minor thing

Jack Johansson

Then I have to consult a lawyer, I have no experience in such pursuits

I usually dump sensitive data in the log when I'm developing, I was lucky to see this before doing so

Usually logs can be cleared too, but this one's can't

Should I also ask a question regarding this on Law SE?

Tom J Nowell

12:28 PM

don't accept legal advice from online communities

your first step should be to contact bluehost and ask them what they're going to do about it

and look into alternative hosting

Jack Johansson

I just changed to bluehost...

Tom J Nowell

judging from what's on their homepage, a digital ocean VPS would be both cheaper and faster

that sucks :/

but at least you have grounds for a refund

Jack Johansson

Ya about 2 weeks ago. The speed and quality is fine, but this seems like an issue

I would sue them if you're right

Tom J Nowell

I haven't a very high opinion on shared hosting, but i know VPS' are just as cheap and can be orders of magnitude faster

a lawsuit shouldn't be necessary

there's regulators for this

legal advice would be to determine what you can do next to protect yourself and your customers

Jack Johansson

Managed VPS isn't that cheap, and the client paid for this, so I couldn't make him buy something expensive

Tom J Nowell

12:31 PM

e.g. if a customer was financially deprived as a result of this, or privacy was breached, and it was found you were aware and did nothing, that would not be good

hmm I'm used to managing my own VPS and making it auto-update

have you considered offering hosting you manage yourself?

if it's the client who's chosen bluehost then perhaps the liability is more with them than you

I'd say contacting the client and bringing this to their attention would be your first port of call

Jack Johansson

I can manage it, I have my own VPS, but this customer didn't want so

Tom J Nowell

then that's their choice

Jack Johansson

I'm afraid so, all I can do is to inform them

Tom J Nowell

you've a duty to report it to your client, but if the client wants to be negligent then that's their choice

and it's the clients customers privacy at risk

you can try and make sure that nothing reaches the error log as a good dev, and you could even report Bluehost to a privacy regulator after a best effort attempt with their support

Jack Johansson

Shouldn't disabling the error log be enough for now?

Tom J Nowell

12:34 PM

I don't know if that's effective or not

but it's still an issue for bluehost

Jack Johansson

If I set the error log to none, nothing will appear there though

Tom J Nowell

still best to talk to them

Jack Johansson

I'm on chat with the support now

Jack Johansson

12:46 PM

The tech guy on the support chat is asking for my password. Could they take security less serious?

Tom J Nowell

1:24 PM

that's awful

Jack Johansson

This is what I got as a reply: "Our specialists informed that we are still working on GDPR compliance until the 25th of June."

I think they were waiting for 25th of June since 1996 to fix the security issue.

Tom J Nowell

I would note that they're already in violation of older laws

e.g. the Data Protection act of 1997 in the UK

nm PCI compliance

Jack Johansson

I'll wait till 25th and then take action if this is not resolved then.

1 hour later…

Mark Kaplun

2:36 PM

there is basically nothing IMO that justifies not being on VPS

if you use shared hosting you should assume bad security and privacy until proven otherwise

and this obviously includes WPE

2 hours later…

Feeds

4:10 PM

Rolling out the Welcome Wagon: June Update

Joe Friend on June 21, 2018

Back in late Spring, we posted “Stack Overflow Isn’t Very Welcoming. It’s Time for That to Change.” We know it’s all too common for companies to announce they really want to do a thing, and then… not much happens. So, it is time to share the work we’ve been doing behind the scenes and how our team of data scientists, developers, long term community managers, and UX specialists will continue iterating on our plans for the future.

This new workflow should help new askers craft questions more successfully with less stress. Each step gathers specific input that’s generally needed to help answerers. …

« first day (2805 days earlier) ← previous day next day → last day (2147 days later) »

all rooms

Transcript for

Jun20

Jun '1821

Jun22

Where humor doesn’t work.

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC