Notices by Bill Mill (llimllib@hachyderm.io)

@polotek That’s accurate, I kicked off the front-end then handed it off to teammates. A lot of the decision was choosing what they would be comfortable and familiar with.

There’s a lot of value for engineering teams to be able to work independently on the front-end and the back end, it lets you bring more people to work with less communication overhead.

Also I was coming from working on a rails app on healthcare.gov which was a terrible MPA plus rails asset pipeline mess, and the idea of…

@hrbrmstr We had this reported against us and had to fix it already! So I know it's been out in the wild.

I didn't have time to pin it down far enough to make a proper report, unfortunately

@hrbrmstr The vector for us was that somebody uploaded a file with a jpg extension that was actually an EPS (postscript) file. A javascript library passed the image to imagemagick, which detected it as a postscript file and passed it off to ghostscript (we had no idea it would do this), which then happily gave shell to the attacker. madness