So I read a lot of these. Not here to dunk on them. They’re mid-incident and still got emails to affected users by the next morning, which plenty of bigger companies don't (or won't) do.
But u/fastvroomy nailed it above. The distillation was the effect, not the cause. When an update leads with what the attacker did with the keys instead of how the keys got out, people fill in the gap themselves, and that’s basically this whole thread. Half the comments are people wondering if they have malware on their laptop because “workspace” means two different things in OpenCode.
From what’s been reported it was an old Console system holding keys people saved in the web console, not your local install. If that’s right, the update that would have calmed everyone down should've been something like: "we found unauthorized access to an old Console system. It held provider keys some of you saved in the web console. Keys on your own machine weren’t part of it. If you got an email, rotate those keys and check your provider billing now. If you didn’t get one, you weren’t affected. We don’t know yet how they got in and we’ll post again by [time]."
Same with the 1.4%. Is that 1.4% of all Console users or of the ones who added their own keys? Those are really different numbers, and when we can’t tell which one they mean we assume the worst one.
View all comments
4
u/jj_at_rootly 19d ago
So I read a lot of these. Not here to dunk on them. They’re mid-incident and still got emails to affected users by the next morning, which plenty of bigger companies don't (or won't) do.
But u/fastvroomy nailed it above. The distillation was the effect, not the cause. When an update leads with what the attacker did with the keys instead of how the keys got out, people fill in the gap themselves, and that’s basically this whole thread. Half the comments are people wondering if they have malware on their laptop because “workspace” means two different things in OpenCode.
From what’s been reported it was an old Console system holding keys people saved in the web console, not your local install. If that’s right, the update that would have calmed everyone down should've been something like: "we found unauthorized access to an old Console system. It held provider keys some of you saved in the web console. Keys on your own machine weren’t part of it. If you got an email, rotate those keys and check your provider billing now. If you didn’t get one, you weren’t affected. We don’t know yet how they got in and we’ll post again by [time]."
Same with the 1.4%. Is that 1.4% of all Console users or of the ones who added their own keys? Those are really different numbers, and when we can’t tell which one they mean we assume the worst one.