tomdev retweeted
Secure AI by Design at @Hacker0x01: hackerone.com/blog/secure-ai…
7/ This incident reminded us that no dependency is trivial. Stay vigilant and prepare for the unexpected—because sometimes, a time zone can take down your platform. 💻🚨
6/ The result? Intermittent platform failures, user frustration, and a bunch of debugging. The lesson? Even seemingly unrelated global events can ripple into major issues if external dependencies aren’t monitored.
5/ We traced the inconsistency down to Ubuntu, our server OS, rolling out updates asynchronously. Some servers had updated the time zone data already, while others didn’t. This caused mismatched constants.js hashes.
4/ Turns out, it wasn’t our code—it was Kazakhstan! Starting on March 1st, 2024, Kazakhstan transitioned to a single time zone to simplify life. But this global event created inconsistencies in our time zone data.
3/ Deep dive time! The difference in content came from a list of time zones. Specifically, the position of the city "Almaty" had shifted. But why would time zone data be non-deterministic? 😲
2/ The culprit? A discrepancy in the hash of constants.js. Our Rails asset pipeline appends a hash to filenames based on content, and somehow, the content was different across some server instances.
1/ On March 1, 2024, users started reporting intermittent issues. Some pages failed to load, and we traced the problem to a critical JavaScript file, constants.js. But why was it missing? 🤔
tomdev retweeted
Today, @Hacker0x01 is announcing Automations, a powerful feature that enables customers to automate the majority of their (often currently manual) processes. It is offered in two flavors: no-code for basic use cases and a full blown code sandbox for more advanced use cases. All hosted in HackerOne’s secure infrastructure.
Automations also integrates with Hai, HackerOne’s copilot assistant, to unlock AI agent-like behavior in the platform. For example, it is now possible to automatically evaluate reports on submission to assign it to the right owner, determine the criticality based on the risk profile of your company’s data, or even automatically add remediation advice with code examples tailored to your company — all directly in a HackerOne report.
Automations is a powerful tool and we can’t wait to see what you’ll build with it to further automate vulnerability intake and reduce time to triage and time to remediation.
Start using it today: docs.hackerone.com/en/articl…