So it's been a weird few days on the internet even by internet standards. In case you were away from a screen since Friday: the government shut down Tuesday because Congress couldn't agree on a budget, the FBI took down Silk Road and arrested the guy running it out of a public library of all places, and now, as of yesterday, Adobe is telling everyone that hackers got into their systems and walked off with customer data and, more interestingly to me, actual source code.
I want to talk about the Adobe one, because it's the one that actually touches something I use every day, and because it confirms a complaint I've had since May.
Adobe's blog post (written by their security chief, a guy named Brad Arkin) says the attackers accessed IDs and encrypted passwords for something like 2.9 million customers, plus customer names, encrypted debit and credit card numbers, and expiration dates. They're resetting passwords and offering credit monitoring, the standard playbook at this point. But the part that got my attention is that they also pulled source code, specifically for ColdFusion, ColdFusion Builder, and a product Adobe describes only as "currently in development." Most people who've been paying attention assume that's Photoshop, since Adobe hasn't denied it and the timing lines up with what security researchers have been poking at.
Source code theft is a different animal than a password dump. Passwords get reset. Source code getting loose means someone out there potentially has a much easier time finding the next vulnerability, because they're not guessing anymore, they're reading the actual logic. Whether that turns into anything is a separate question, but it's not nothing.
Here's my actual complaint, though, and it's not really about the breach itself. Back in May, Adobe announced they were moving Creative Suite to a subscription-only model. No more buying Photoshop outright and running it for six years like my brother still does with his CS6 install. Now it's Creative Cloud: $49.99 a month if you want the whole suite, $19.99 a month if you just want Photoshop, and that's with an annual commitment, month-to-month costs more. I didn't switch. I'm still running CS5 on my desktop and I intend to keep doing that until it stops opening files, because paying a monthly fee forever for software I used to just own outright feels backwards to me. People called me a dinosaur about it in the comments back then. Maybe I am one.
But this is exactly the thing that bugged me about the subscription model from the start, and it's not really about money. It's about how much of my stuff lives on somebody else's servers now, tied to an account I don't fully control. Under the old model, if Adobe got hacked, the worst outcome for me personally was maybe my credit card number, which is bad, sure, but it's a known, bounded kind of bad. Under Creative Cloud, your license, your synced settings, potentially your files depending on how deep you're using their cloud storage, all of it is sitting behind Adobe's authentication system. A breach isn't just "change your password" anymore, it's "hope the company that got compromised is being straight with you about the scope of it." And these companies rarely are, at first. Nobody ever announces the full number on day one.
I don't think Adobe is uniquely bad here, for what it's worth. Companies get breached constantly, and I'd bet a chunk of them just don't say anything until they're legally forced to. Adobe at least put out a statement within what looks like a reasonable window. That's something. But "at least they told us" is a pretty low bar to clear, and it's the bar we've all apparently agreed to.
I called Adobe support about something unrelated a couple months ago, a licensing question about an old Lightroom copy, and sat on hold for twenty-five minutes before getting transferred twice. Not really connected to any of this, I just think about it every time Adobe comes up now. Small thing. Sticks with you anyway.
Anyway. Change your Adobe password if you have one, even if you're not sure it was affected. And if you're one of the people still holding onto an old boxed copy of some Adobe app out of pure stubbornness, you have my permission to feel a little smug today.