582 karma · joined March 12, 2013
This screen shot came up in r/india a few days ago. They aren't really enforcing any such caps on encryption. It's a case of an outdated TOS, which was more likely a copy-paste job, where neither the copywriter nor the one who approved it, had no idea of what they are talking about.
Rehabilitation in India is a joke. The people attending to her neither have the knowledge not resources to cater to her.
Mental asylums and health centers in India are filled with sexual predators. They know that she can't complain about it nor would someone lend an ear if she tried to say something. Which makes her an easy target. Sexual abuse is the norm in mental health centers here.
Most mental health centers lack infrastructure, resources and fall short of trained personnel. It is a common sight to see patients chained, and thrown food at.
My first reaction when I heard the news - She was better in the forest away from the predators. I hope she gets the right sophisticated care and compassion she needs at this point of time.
Cloudflare, along with flatfile caching by Drupal's Boost module came to the rescue. Hope that stays alive for a while now.
Regarding not having disclosed this one discretely to Slack:
* I have considerable experience in a couple opensource projects including Drupal and have reported multiple vulnerabilities on various occasions for various modules discretely (though mostly of lesser significance and a very narrow/rare attack vector) to the right teams through various channels meant for this purpose. As such I am aware of the SOPs for the righteous to follow in case of discovering a vulnerability.
* I don't think this one is a security issue that would take a professional security expert to crack. Nor could this have been not noticed when Slack tested their product. This is an issue with 'common sense'. I am pretty sure that Slack designed it this way. It is just the customers that are surprised now. Not Slack.
Also, it looks like this was reported earlier to Slack by https://twitter.com/rootlabs/status/499723782244675584 a couple of months ago and it was rejected by Slack as "Not a bug". However I do acknowledge that I was not aware of this report when I first published the post and hence can not say that I disclosed it only after being rejected by Slack. I would say it was not a security vulnerability to report but just bad design that Slack had put in being totally aware of what it means.