Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

kalzumeus.com

Post reply on HN
Print view View original

21–30 of 80 posts

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#21

Post by laughinghan »

blahedo wrote: post #6

tl;dr: A Rails upgrade last January caused previously valid code to reset the session (but only once per user per session). The session reset caused a logged-in user to be suddenly logged out; but most users' use-flow (and Patrick's test-flow) made the session reset happen before login, so the bug only manifested visibly about 1% of the time. Moral: race conditions are hard! (Alternate moral: read the release notes c…

Technically, the reason it was once per use per session was not because of the Rails upgrade, but because once the A/Bingo human check missing the CSRF token resets the session, the visitor is marked human and not checked again.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#22

Post by laughinghan »

rlpb wrote: post #19

"Whereupon I learned that Rails 2.3.11 changed the behavior of CSRF protection: instead of throwing exceptions, it would silently just clear the session and re-run the request. For most sensitive operations (e.g. those which require a signed in user), this would force a signout and then any potentially damaging operation would be averted." Doesn't this change a CSRF attempt into a DoS? I don't understand the logic be…

How is this a DoS? It's not significantly more resource-intensive than any other request. If you could submit enough of these requests to DoS the server, you could submit enough of any request to DoS the server, so the server is no more vulnerable this way than otherwise.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#23

Post by drm237 »

While not directly related to this post, I feel like it's a good time to point out how great Github is. Patrick hosts everything himself (for the SEO benefit I would assume) which is fine, but it means we can't post issues, watch the abingo repo for changes like this, submit pull requests, etc. I can't imagine that many people searching for ABingo turn into BCC customers so is the SEO benefit at the expense of a great abingo community really worth it?

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#25

Post by neutronicus »

bgraves wrote: post #4

I really like this quote: Bingo Card Creator is not terribly complicated software when compared to most applications, but it sits on top of other pieces of code (Rails, the web server the browser, the TCP/IP stack, the underlying OS, the hardware on both ends, etc) which _collectively_ are orders of magnitude more complicated than any physical artifact ever created by the human race. You can insert any number of one-…

As a physicist, I really want to argue with that statement.

In particular, computer hardware operates (by design) as far as possible from any regimes where the laws of physics are well and truly complicated. A tokamak fusion reactor, by contrast, although it breaks down into orders of magnitude fewer logical parts, contains a big blob of monolithic, continuous complexity, namely the plasma itself and all its associated electromagnetic fields, which you CS types sell short. :p

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#26

Post by jbigelow76 »

neutronicus wrote: post #25
bgraves wrote: post #4

I really like this quote: Bingo Card Creator is not terribly complicated software when compared to most applications, but it sits on top of other pieces of code (Rails, the web server the browser, the TCP/IP stack, the underlying OS, the hardware on both ends, etc) which _collectively_ are orders of magnitude more complicated than any physical artifact ever created by the human race. You can insert any number of one-…

As a physicist, I really want to argue with that statement. In particular, computer hardware operates (by design) as far as possible from any regimes where the laws of physics are well and truly complicated. A tokamak fusion reactor, by contrast, although it breaks down into orders of magnitude fewer logical parts, contains a big blob of monolithic, continuous complexity, namely the plasma itself and all its associat…

Leave it to a physicist to make everyone aware of the gravity of the previous comment. :)

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#27

Post by tedunangst »

laughinghan wrote: post #22
rlpb wrote: post #19

"Whereupon I learned that Rails 2.3.11 changed the behavior of CSRF protection: instead of throwing exceptions, it would silently just clear the session and re-run the request. For most sensitive operations (e.g. those which require a signed in user), this would force a signout and then any potentially damaging operation would be averted." Doesn't this change a CSRF attempt into a DoS? I don't understand the logic be…

How is this a DoS? It's not significantly more resource-intensive than any other request. If you could submit enough of these requests to DoS the server, you could submit enough of any request to DoS the server, so the server is no more vulnerable this way than otherwise.

It allows you to grief the users of any rails site. You can log them out at will (for some value of at will).

In the dawn of time, you could use a CSRF exploit and really grief the users. Then CSRF checking made that go away. This is now a step backwards, where 3rd party sites can affect your users.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#28

Post by patio11 »

drm237 wrote: post #23

While not directly related to this post, I feel like it's a good time to point out how great Github is. Patrick hosts everything himself (for the SEO benefit I would assume) which is fine, but it means we can't post issues, watch the abingo repo for changes like this, submit pull requests, etc. I can't imagine that many people searching for ABingo turn into BCC customers so is the SEO benefit at the expense of a grea…

The SEO benefit from A/Bingo is not that I sell $30 of software to Rails hackers. The benefit is that A/Bingo convinces, without loss of generality, DHH to link to bingocardcreator.com despite him not having any interest in BCC. The fraction of DHH's substantial trust which rubs off on my domain as a result helps me rank for unrelated searches by elementary school English teachers. They pay my rent.

I don't feel that I owe "the abingo community" more than the millions I already made their for-profit companies while working for free, but if they really want to send pull requests, they can take the MIT licensed source code, put it in their own Github, and write me an email saying "Hey, pull my stuff", which happens every once in a while. Github did not invent requesting pulls.

Re: I Saw An Extremely Subtle Bug Today And I Just Have To Tell Someone

#29

Post by tedunangst »

Wow. Had a very similar CSRF problem once. Customer complained they were getting page expired errors constantly. But only one customer and only with Safari, not Firefox.

Turned out they were using an RSS reader on OS X that shared the system cookie jar with Safari. Every ten minutes it would log in with a password and get a new session cookie. Safari would then use the new session cookie which didn't match the CSRF form value.

Post reply on HN