Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rack-webconsole: a Ruby/Rails console inside your browser

blog.codegram.com

Post reply on HN
Print view View original

11–20 of 57 posts

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#11

Post by nicholaides »

patio11 wrote: post #6
txus wrote: post #4

Earlier quoted context omitted.

It is meant for development environments only. Nobody would risk putting a Ruby console in production :) In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.

I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard. Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.

Can you expand on this? What's the risk? What's the attack vector?

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#12

Post by sabat »

patio11 wrote: post #2

This is a very bad idea.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development, this is invaluable and awesome.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#13

Post by sabat »

jrom wrote: post #5

I think this is a pretty cool tool, for both development/staging and also for production in a very restricted way. Every site has some kind of admin panel. I see this like a phpMyAdmin on asteroids for rack apps. Definitely interesting.

Except for extreme circumstances (emergency debugging) I wouldn't let this thing near production. For development, it's super-handy, though.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#14

Post by ciupicri »

nicholaides wrote: post #11
patio11 wrote: post #6

Earlier quoted context omitted.

I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard. Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.

Can you expand on this? What's the risk? What's the attack vector?

I think he's saying that someone can make you open a web page that includes an image with the proper src attribute and bang, your Rails site is broken.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#15

Post by tptacek »

nicholaides wrote: post #11
patio11 wrote: post #6

Earlier quoted context omitted.

I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard. Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.

Can you expand on this? What's the risk? What's the attack vector?

Cross-site request forgery.

I should add though that even if this thing gets an XSRF token and it's secure, you might as well take the passwords off your SSH keys if you're running this, because you're coughing up an unprotected remote shell to anyone who can talk to a dev server once you turn this on.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#16

Post by tptacek »

ciupicri wrote: post #14
nicholaides wrote: post #11

Earlier quoted context omitted.

Can you expand on this? What's the risk? What's the attack vector?

I think he's saying that someone can make you open a web page that includes an image with the proper src attribute and bang, your Rails site is broken.

More likely, your whole data center.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#17

Post by tptacek »

sabat wrote: post #12
patio11 wrote: post #2

This is a very bad idea.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development , this is invaluable and awesome.

He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment".

At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later.

At worst, you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN. Now you're a cute cat picture away from attackers with direct TCP access to your database servers. Wee!

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#18

Post by irahul »

nicholaides wrote: post #11
patio11 wrote: post #6

Earlier quoted context omitted.

I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard. Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.

Can you expand on this? What's the risk? What's the attack vector?

> What's the attack vector?

CSRF.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#20

Post by sabat »

tptacek wrote: post #17
sabat wrote: post #12

Earlier quoted context omitted.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development , this is invaluable and awesome.

He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…

after running this you are one Twitter shortened link away from losing your development machine

Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit.

you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN

I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94. I have never, ever heard of such a thing, and would freak out if I did. 80% of companies? Maybe you've got stats to back this up, and my experience is merely anecdotal -- but I've never heard of a single instance of something so obviously stupid. SQL injection vulnerability, sure. XSRF, XSS vulnerability, sure. Running a database server on the same host as your app server, with the webserver running as the DBA user? Sure, it happens.

Certainly someone is bound to misuse this gem as well. But that doesn't mean it's "a very bad idea". It's a very good idea. It's just that it takes knowledge and experience to run a web site, and some people have to find out the hard way.

Post reply on HN