Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Lessons Learned From The Diaspora Launch

kalzumeus.com

Post reply on HN
Print view View original

71–80 of 142 posts

Re: Security Lessons Learned From The Diaspora Launch

#71

Post by woodson »

zeemonkee wrote: post #58

It's not that the pre-alpha Diaspora has insecurities that bothers me, it's the whole execution. What I really would like to see is a documented protocol - based on XMPP or some other established, well-tested protocol would be good, but if not then at least something. Once you have that protocol - which tells you how Diaspora "seeds" communicate securely - you can let others build their own implementation, using Rail…

That's what I found interesting when looking into OneSocialWeb, their focus on already existing protocols (XMPP plus some XEPs http://onesocialweb.org/developers-xmpp.html), instead of adhering to Not invented here.

Re: Security Lessons Learned From The Diaspora Launch

#72

Post by mike-cardwell »

tptacek wrote: post #3

I can probably go all night on this, but a couple things from a quick read of this (very good) post: First, mass assignment. The answer to mass-assignment bugs is "attr_accessible". Accessible attributes can be set via update/build/new; nothing else can. Every Rails AR model should have an "attr_accessible" line in it. I've met smart dev teams working under the misconception that attr_accessible means "these are the…

ruby -e "'=XX===============================' =~ /X(.+)+X/"

Why does that hang in Ruby? In Perl it's fine...

Re: Security Lessons Learned From The Diaspora Launch

#73

Post by rb2k_ »

jasonkester wrote: post #68
rb2k_ wrote: post #56

After reading the article, also read this comment: http://www.kalzumeus.com/2010/09/22/security-lessons-learned... The comment negates some of the statements made in the post

No, that comment just helps to explain how trivial these things would have been to work around. That's the whole point of the article, that these guys missed all the most obvious things that you need to do to secure your application. There are no deep, tricky issues explained because absolutely zero effort was needed to find a half dozen breathtakingly bad practices floating at the surface. So yes, of course it's tri…

Please read the whole comment I linked to. I was talking about things like the OP saying that browsers could delete things by prefetching (GET requests) or that update_attributes does a double assignment which are simply not true

Re: Security Lessons Learned From The Diaspora Launch

#74

Post by aidanf »

llimllib wrote: post #18
bl4k wrote: post #13

"For example, if you were logged in to a Diaspora seed and knew the ID of any photo on the server, changing the URL of any destroy action from the ID of a photo you own to an ID of any other photo would let you delete that second photo." When I was working as a pen tester I would completely scold developers for letting this happen - telling them that with everything we know today about security and good programming p…

> That was 11 years ago. The problem is, these kids are from college . They don't teach you stuff like "writing a secure web application" in college, or even try to. (Not that this is unreasonable, though perhaps I'm suggesting that there should be different career paths for CS majors and people who intend to be professional programmers. (I say as a CS-educated professional programmer))

Any decent rails book will have a section on common security flaws and how to avoid them. There are plenty of web tutorials on the same topic. All the flaws in the linked article are very basic and should have been avoided if they took the time to RTFM.

Re: Security Lessons Learned From The Diaspora Launch

#75

Post by avar »

mike-cardwell wrote: post #72
tptacek wrote: post #3

I can probably go all night on this, but a couple things from a quick read of this (very good) post: First, mass assignment. The answer to mass-assignment bugs is "attr_accessible". Accessible attributes can be set via update/build/new; nothing else can. Every Rails AR model should have an "attr_accessible" line in it. I've met smart dev teams working under the misconception that attr_accessible means "these are the…

ruby -e "'=XX===============================' =~ /X(.+)+X/" Why does that hang in Ruby? In Perl it's fine...

Because Ruby uses PCRE, but Perl uses its own regex engine which handles cases like that a lot better. That pattern is rejected right away by Perl's engine because it sees that there isn't another X in that string:

    anchored "X" at 0 floating "X" at 2..2147483647 (checking floating) minlen 3 
    Guessing start of match in sv for REx "X(.+)+X" against "=XX==============================="
    Found floating substr "X" at offset 2...
    Contradicts anchored substr "X", trying floating at offset 3...
    Did not find floating substr "X"...
    Match rejected by optimizer
Changing the pattern to /X(.)X/ will cause Perl to do real work. But it'll complete it in 0.003s while Ruby will just hang.

I wrote an article a while back about the differences between PCRE and Perl's engine: http://use.perl.org/~avar/journal/33585

Re: Security Lessons Learned From The Diaspora Launch

#76

Post by Tomek_ »

I had my doubts about Diaspora, but now I know for sure: it will be a complete fiasco. Those are horrendous errors that show that those guys have completely no idea about web programming - and I can't see them learning it quickly (certainly not before planned release date of the final version). Sad thing.

Re: Security Lessons Learned From The Diaspora Launch

#77

Post by mike-cardwell »

avar wrote: post #75
mike-cardwell wrote: post #72

Earlier quoted context omitted.

ruby -e "'=XX===============================' =~ /X(.+)+X/" Why does that hang in Ruby? In Perl it's fine...

Because Ruby uses PCRE, but Perl uses its own regex engine which handles cases like that a lot better. That pattern is rejected right away by Perl's engine because it sees that there isn't another X in that string: anchored "X" at 0 floating "X" at 2..2147483647 (checking floating) minlen 3 Guessing start of match in sv for REx "X(.+)+X" against "=XX===============================" Found floating substr "X" at offset…

Thanks for the explanation

Re: Security Lessons Learned From The Diaspora Launch

#78

Post by chegra »

I appreciate the two links with how to handling security issues in web application.

As many have pointed out, they do not teach this stuff in University and acquiring such knowledge you tend to have to be very proactive about your development if you do not have industry experience.

So thanks a lot for sending these nuggets our way.

You stated that the team is manifestly out of their depth in terms of web security, how do you suggest that they proceed given their month deadline? Can they pay a security expert to resolve these issue or no one wants to come within a mile of this?

Re: Security Lessons Learned From The Diaspora Launch

#79

Post by code_duck »

llimllib wrote: post #18
bl4k wrote: post #13

"For example, if you were logged in to a Diaspora seed and knew the ID of any photo on the server, changing the URL of any destroy action from the ID of a photo you own to an ID of any other photo would let you delete that second photo." When I was working as a pen tester I would completely scold developers for letting this happen - telling them that with everything we know today about security and good programming p…

> That was 11 years ago. The problem is, these kids are from college . They don't teach you stuff like "writing a secure web application" in college, or even try to. (Not that this is unreasonable, though perhaps I'm suggesting that there should be different career paths for CS majors and people who intend to be professional programmers. (I say as a CS-educated professional programmer))

If you need a college professor to tell you "Check that the resource is owned by the logged in user requesting a change before you change it", you might never, ever be a good programmer no matter what. This was apparent to me when I'd been doing PHP for like 6 months. These issues are common sense.

Re: Security Lessons Learned From The Diaspora Launch

#80

Post by code_duck »

mike-cardwell wrote: post #72
tptacek wrote: post #3

I can probably go all night on this, but a couple things from a quick read of this (very good) post: First, mass assignment. The answer to mass-assignment bugs is "attr_accessible". Accessible attributes can be set via update/build/new; nothing else can. Every Rails AR model should have an "attr_accessible" line in it. I've met smart dev teams working under the misconception that attr_accessible means "these are the…

ruby -e "'=XX===============================' =~ /X(.+)+X/" Why does that hang in Ruby? In Perl it's fine...

Well... basically, it sounds like Ruby's regex engine needs some work, hmm?
Post reply on HN