Datadog has a security footgun
Datadog has a security footgun
Bad API design leads to field day for domain-snatching data siphons
Saving this for when people try to claim that naming things isn't important!
Also that is clearly a security issue. Anyone who tries to claim otherwise is forgetting that humans exist. Though I suspect they were just trying to avoid admitting fault and doing work. Disappointing either way.
My takeaway from this is to use CSP to minimize your reliance on others doing things intelligently. And that Datadog is not doing things intelligently at the inconvenience of their consumers.
Unfortunately, retrofitting CSP on an existing site can be nightmare, especially if you have external dependencies. At my job, we spent months trying to enable CSP on one our oldest sites, but ultimately gave up because one of our dependencies won't work unless we added "unsafe-inline" everywhere, which kinda defeats the whole point of CSP.
Having something is better than nothing! In our case, having
connect-srcenabled would have avoided the incident.
I can't find the adjective to use for datadog's documentation, but I wouldn't call it good. It seems like it's written by different teams but every team writes everybody's documentation. There's no section just for a single team and nothing feels coordinated.
Anti Commercial AI thingy
I mean sure but that’s a lot of words to say “I didn’t read the directions and no one caught it in a merge request review because no one else read the directions either.”
Their documentation and examples are pretty easy to read and the site parameter is explained in the getting started guide and even linked from the readme for the JavaScript sdk, and in lots of sample configurations so I’m not sure how this made it into a release and then no one noticed the missing metrics for eleven days, sounds like lots of issues in that shop.
The behavior of the sdk isn’t great but the proposed solution wouldn’t work because you can use custom endpoints for all of the components using endpoints on domains you own anyway.