Readit NewsWhat the article doesn’t mention is that pre-privatisation a new reservoir was built every year up to about 1960 and then every few years until privatisation in 1992.
So we are about 30 years behind in adding capacity to the system. This combined with the inadequate levels of investment in the system leading to enormous wastage, is the answer.
Water should never have been privatised. At least not without a framework for a national strategy for water. I suspect that wasn’t done because it would have made water companies and unattractive source of profit.
Life is complex and vulnerabilities happen. They quickly contacted the reporter (instead of sending email to spam) and deployed a fix.
> we've fundamentally restructured our security practices to ensure this scenario can't recur
People in this thread seem furious about this one and I don't really know why. Other than needing to unpack some "enterprise" language, I view this as "we fixed some shit and got tests to notify us if it happens again".
To everyone saying "how can you be sure that it will NEVER happen", maybe because they removed all full-privileged admin tokens and are only using scoped tokens? This is a small misdirection, they aren't saying "vulnerabilities won't happen", but "exactly this one" won't.
So Dave, good job to your team for handling the issue decently. Quick patches and public disclosure are also more than welcome. One tip I'd learn from this is to use less "enterprise" language in security topics (or people will eat you in the comments).
Point taken on enterprise language. I think we did a decent job of keeping it readable in our disclosure write-up but you’re 100% right, my comment above could have been written much more plainly.
Our disclosure write-up: https://www.todesktop.com/blog/posts/security-incident-at-to...
Hubris. Does not inspire confidence.
> We resolved the vulnerability within 26 hours of its initial report, and additional security audits were completed by February 2025.
After reading the vulnerability report, I am impressed at how quickly you guys jumped on the fix, so kudos. Did the security audit lead to any significant remediation work? If you weren't following PoLP, I wonder what else may have been overlooked?
Yes, we re-architected our build container as part of remediation efforts, it was quite significant.
This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for responsibly reporting this.
One evening my girlfriend was using a hair straightener in my bedroom, it tripped the central fuse and turned off the electricity. I told my GF that I would buy her a new hair straightener because this one isn't safe.
Now every time my housemate started blaring music at 3AM then I just needed to plug in the hair straightener. It only took 3 or 4 attempts for me to Pavlov my housemate into not playing loud music at 3am. :-)