We take our users’ security seriously here at Yahoo!. Because a big part of what people love about our product are the thousands of Widgets created by independent authors that are available through the Yahoo! Widget Gallery, our commitment to security extends to those Widgets as well. Every Widget in our Gallery goes through automated and manual checks to help ensure that it meets the standards for product safety and security that people have come to expect from Yahoo!. This process is revisited and updated to keep up with the latest threats.

Yesterday, Aviv Raff from Finjan’s Malicious Code Research Center made a presentation on security issues in widgets at the DEFCON conference. As part of his presentation, Aviv disclosed a vulnerability in the Yahoo! Contacts Widget. Thanks to Aviv, we were already aware of this issue and published an updated version of the Yahoo! Contacts Widget to the Yahoo! Widget Gallery on July 31. Our subsequent investigation revealed that the vulnerability Aviv described existed in more than just our Contacts Widget, and we’ve been taking a number of steps over the last several days to address this issue.

When a threat arises, we try to respond quickly. Typically, we first identify all the Widgets that are potentially affected by the security issue, immediately remove them from the Yahoo! Widget Gallery, and notify their authors that a fix is required. A lot of Widget authors may be wondering why we do things in that order and don’t give the authors of the affected Widgets notice before removing them from the Gallery. The answer is that by informing people of the vulnerability (even if those people are the authors) we increase the risk that someone might try to exploit it. We know the suddenness of events like these can be an inconvenience for our authors, for which we apologize. With that said, the safety and security of the platform is important to everyone in the Yahoo! Widgets ecosystem. In dealing with this particular vulnerability, we have tried to make things a little easier for authors by proactively reaching out with instructions on how to fix this issue and build more secure Widgets going forward.

In more serious cases, we next disable the affected Widgets that have already been downloaded from running on our platform. In those cases, of which this is one, we try to give the authors of the affected Widgets a short grace period to get security updates of their Widgets to existing users before the older versions are disabled.

We’ve always worked hard to live up to the trust our users place in Yahoo! Widgets. And it’s an ongoing effort. In future releases of the Yahoo! Widgets platform and Gallery, you will see continued improvements to help ensure the safety and security of our users as well as making events like these less burdensome for authors.