Earlier quoted context omitted.
I think he's saying that someone can make you open a web page that includes an image with the proper src attribute and bang, your Rails site is broken.
More likely, your whole data center.
Hyperbolic.
Rack-webconsole: a Ruby/Rails console inside your browser
21–30 of 57 posts
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#22Earlier quoted context omitted.
He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…
after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94…
Everybody runs development machines that can (a) be spoken to by machines with human-driven browsers and (b) can speak to other machines.
You're a dev/ops guy, I'm an appsec security assessor. I think we just look for different things. Trust me, this isn't just common it's standard practice.
It's a clever bad idea. Minimal payoff. Maximum risk.
Incidentally: I'm not sure I'm in love with this "everyone has to find out the hard way" notion. No, they don't. We can just tell them: DON'T RUN STUFF LIKE THIS, IT WILL HURT YOU. You have 20+ years of experience. Most people on HN do not; they see this, think "ooo, shiny", and install it. As a practitioner yourself, you have a responsibility --- in fact, if you're keeping that CISSP cert current, an obligation --- to step in and help that not happen.
By the way: hey, you asked.
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#23Earlier quoted context omitted.
More likely, your whole data center.
Hyperbolic.
I know you've been a dev/ops guy for 20 years and I respect the fact that your development machines are sealed in vaults, but I've gotten to assess more than half of the top 10 biggest Rails apps in the world over the past couple of years and trust me, you're just wrong about this. Development machines are within reach of developer browsers. Database machines are within reach of development machines.
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#24Earlier quoted context omitted.
It is meant for development environments only. Nobody would risk putting a Ruby console in production :) In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.
I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard. Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.
You're right, that's a risk. I've opened an issue to implement a simple pseudorandom token to protect AJAX requests. What do you think? https://github.com/codegram/rack-webconsole/issues/4
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#25Earlier quoted context omitted.
He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…
after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94…
You're a dev/ops guy, I'm an appsec security assessor. I think we just look for different things. Trust me, this isn't just common it's standard practice.
Actually I'm a CISSP and was CISO for a major financial web site for >5 years. I look at things the way you do, trust me.
It's just that I try to temper my security reflexes. Just because something might be potentially dangerous doesn't means it's automatically a bad idea.
Everybody runs development machines that can (a) be spoken to by machines with human-driven browsers and (b) can speak to other machines.
Indeed we do. And if you can't trust that environment to be private and secure, then you've got bigger problems than a web console. I wouldn't stop at shutting down SSH; I'd disconnect entirely. Hell, I'd quit.
If your dev environment is exposed to people who are malicious, you're screwed. Web console is not going to hurt you, because it's too late -- you've already been hacked.
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#26Earlier quoted context omitted.
after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94…
You're a dev/ops guy, I'm an appsec security assessor. I think we just look for different things. Trust me, this isn't just common it's standard practice. Actually I'm a CISSP and was CISO for a major financial web site for >5 years. I look at things the way you do, trust me. It's just that I try to temper my security reflexes. Just because something might be potentially dangerous doesn't means it's automatically a b…
I think you're missing the part about how your dev machine doesn't have to be exposed to malicious people here.
My condolences on having to get the CISSP. ;)
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#27Earlier quoted context omitted.
He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…
after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94…
Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit.
I apologize for not having an underground cold war bunker with which to develop my software on. Until i get one, I'll stick with my one and only machine (which, as you can tell, has internet access) for doing development.
EDIT: And because of it, i'd never put this code on a machine i run.
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#28Earlier quoted context omitted.
after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94…
Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. I apologize for not having an underground cold war bunker with which to develop my software on. Until i get one, I'll stick with my one and only machine (which, as you can tell, has internet access) for doing development. EDIT: And because of it, i'd never put this code on a machine i run.
Most professional shops do indeed have dev machines. They live at Rackspace alongside the prod servers. They are protected from the Internet by firewall rules; you need a VPN connection to access them. Unfortunately, everyone who writes code has that VPN connection accessible at all times, because that's their job, and so rack-webconsole puts them a cute cat picture away from giving an anonymous Twitter user access to their data center.
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#29I think this is a pretty cool tool, for both development/staging and also for production in a very restricted way. Every site has some kind of admin panel. I see this like a phpMyAdmin on asteroids for rack apps. Definitely interesting.
I see this like a phpMyAdmin on asteroids for rack apps.
Dear christ, please do not ever put this near production.
Re: Rack-webconsole: a Ruby/Rails console inside your browser
#30It's sweet to see internet browsers opening up for development within themselves. We can surely do this securely with some amount of effort. I'd love to see a world without the need for Eclipse / Aptana.