Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rack-webconsole: a Ruby/Rails console inside your browser

blog.codegram.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#41

Post by rednaught »

patio11 wrote: post #40
rufugee wrote: post #39

Earlier quoted context omitted.

Help me understand this. In your example, how would this malicious string be any more worrisome with the console installed than without it? I realize you could trigger the console to be displayed by crafting a URL, but it would be displayed in my browser (and thus, localhost) as the consumer of your URL, correct? It'd be one thing if this gem caused any arbitrary query string to be executed as ruby code, but I don't…

It'd be one thing if this gem caused any arbitrary query string to be executed as ruby code That's pretty much the exact designed intent of the software. Read the Repl code, specifically, Repl#call at line 59 or so. https://github.com/codegram/rack-webconsole/blob/master/lib/... You'll note the code has recently been enhanced with check_legitimate, which was designed to patch the issue I raised on this thread (and vi…

Isn't this in the same vein as Ajaxterm/Anyterm? I suppose most uses of those (e.g. Slicehost/Linode) are behind SSL.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#42

Post by joeyespo »

patio11 wrote: post #33
sabat wrote: post #12

Earlier quoted context omitted.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development , this is invaluable and awesome.

Sabat, would you do the following for me? Turn on Rails. Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter. Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings. Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you…

Hmm. What would you say about the Werkzeug debugger? It's been around a while but also allows in-browser console debugging.

http://werkzeug.pocoo.org/docs/debug/

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#43

Post by aaronbrethorst »

jrom wrote: post #5

I think this is a pretty cool tool, for both development/staging and also for production in a very restricted way. Every site has some kind of admin panel. I see this like a phpMyAdmin on asteroids for rack apps. Definitely interesting.

phpMyAdmin on asteroids sounds about right. http://en.wikipedia.org/wiki/Cretaceous%E2%80%93Tertiary_ext...

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#44

Post by rmc »

sabat wrote: post #20
tptacek wrote: post #17

Earlier quoted context omitted.

He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…

after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94…

Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit.

I am reminded of Sony's plain text captcha. There are stupid people out there.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#46

Post by ssmoot »

sabat wrote: post #21
tptacek wrote: post #16

Earlier quoted context omitted.

More likely, your whole data center.

Hyperbolic.

You've probably figured this out by now, but I'm pretty sure you're missing the point. From your other comments in this thread you appear to think that the machine needs to be internet-accessible. Have a public IP. Open Firewall. All that.

The reason this is so dangerous is that it needs none of that. All it needs is for your development machine to have access to the internet.

I open up a project, enable this, and run rackup locally.

I then view your Twitter stream, where you've embedded a crafted link behind a URL shortener.

Because that link is executed by me, you've now remotely executed code on my machine. Assuming I'm anything like most Rails shops you can probably get to a number of other machines through my machine.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#47

Post by bhousel »

tptacek wrote: post #38
bhousel wrote: post #36

Earlier quoted context omitted.

I've read through the rest of this thread, and I'm still not understanding the big deal about this tool. If the entire dev environment is my macbook, and the app is localhost:3000, and the line to enable this thing exists only in the development environment initializer, and I leave it commented out all the time except for those rare cases where I want to inspect session variables and controller state or some other th…

There used to be web-based Rails debuggers, didn't there? I haven't used any kind of Ruby debugger since 2007. I just keep an SSH screen with "bundle exec rails console" running. I'm of the impression that this is what most people do. So what's the win here? Even with CSRF protection, you still have to worry about who can talk to port 3000 on your machine. There's a "rails server" running on my Macbook pretty much ev…

> There used to be web-based Rails debuggers, didn't there?

I'm not sure.. This is the first one that I've ever heard of. Well, remote debugging has been around for years for plenty of platforms, and this is the first remote debugging tool for Ruby that I have seen, and embedding it into Rack is kind of cool and useful. And sure, probably not very secure in version 0.0.5.

That doesn't mean "All remote debugging is bad and insecure, and you're stupid for even considering this," which sadly is the tone that people are taking. I can think of several ways that this thing could be made more secure. The gem initializer could take a private key, and the backtick command could prompt you to enter the public key, rather than just dropping you right into a console and executing your arbitrary code.

> So what's the win here?

Yes, normally I would just ssh to the remote machine and and "bundle exec rails console" too. OR far more likely, there is no remote machine, I just open another terminal window and keep a console running. (sorry I said "irb", though I meant "rails console" -- In my mind they are basically the same thing).

The win (at least, to me) is that I can inspect parts of the rails stack that change as the user (me) is interacting with the app, such as request details, session contents, controller variables.

>I just keep an SSH screen with "bundle exec rails console" running. I'm of the impression that this is what most people do.

>I bought a whole separate Macbook because I was worried about the attack surface that Rails runs with by default.

This seems a bit incongruous, don't you think? I'm not trying to pick a fight, but I read stuff like this and I just feel sad...

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#48

Post by rufugee »

joeyespo wrote: post #42
patio11 wrote: post #33

Earlier quoted context omitted.

Sabat, would you do the following for me? Turn on Rails. Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter. Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings. Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you…

Hmm. What would you say about the Werkzeug debugger? It's been around a while but also allows in-browser console debugging. http://werkzeug.pocoo.org/docs/debug/

I'd be interested in this as well (as someone preparing to start a flask project)...

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#49

Post by txus »

patio11 wrote: post #33
sabat wrote: post #12

Earlier quoted context omitted.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development , this is invaluable and awesome.

Sabat, would you do the following for me? Turn on Rails. Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter. Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings. Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you…

I insist, this is fixed in version v0.0.5, thanks to your very warning.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#50

Post by joeyespo »

rufugee wrote: post #48
joeyespo wrote: post #42

Earlier quoted context omitted.

Hmm. What would you say about the Werkzeug debugger? It's been around a while but also allows in-browser console debugging. http://werkzeug.pocoo.org/docs/debug/

I'd be interested in this as well (as someone preparing to start a flask project)...

Ah Flask is pretty incredible. You could probably learn it and build a functional MVP by the time we get a decent answer. (And no, I'm not hinting that it'll take a long time for him to answer :)

You can turn off the console debugger though if it's making you uneasy by doing this:

    app.run('localhost', debug=True, use_evalex=False)
You'll still get the nice stack trace and code context, but without the ability to run arbitrary code.
Post reply on HN