Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

31–40 of 205 posts

Re: GitHub and Rails: You have let us all down.

#31

Post by vidarh »

ericflo wrote: post #21
vidarh wrote: post #19

Earlier quoted context omitted.

I lost a tremendous amount of respect for Github when I heard they'd suspended his account. I have more of an issue with the Rails team for not accepting that this "feature" is a massive bug that they should've changed ages ago, though.

Why? I would expect any company to suspend the account of someone hacking them.

He did it under his own name, in a way dad not damage anything, using a problem that has been well known for ages, after attempting to draw attention to the issue several times and being ignored.

It is pretty obvious that he did not have any malicious intent, nor intended to do damage (if he wanted to, he could've done massive damage from an anonymous account in ways that wouldn't draw attention to it).

The only thing suspending his account accomplished is to punish someone who has helped draw attention to a very serious problem.

It just comes across as an incredibly childish and petty response given the circumstances.

Re: GitHub and Rails: You have let us all down.

#32

Post by epistasis »

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another).

I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the future. I had a similar response with my (non-paid) DropBox account. I guess I didn't rationally evaluate cloud resources, and have trusted far too many people.

Re: GitHub and Rails: You have let us all down.

#33

Post by vidarh »

wycats wrote: post #26
vidarh wrote: post #19

Earlier quoted context omitted.

I lost a tremendous amount of respect for Github when I heard they'd suspended his account. I have more of an issue with the Rails team for not accepting that this "feature" is a massive bug that they should've changed ages ago, though.

All of my public comments on this topic agree that this is a problem that we should fix. Are you conflating me with other people? Am I not part of "the Rails team"?

The issue is that it needed to go this far before someone actually paid attention to it. It indicates a cultural problem that is not going to get addressed by fixing a single technical issue.

Re: GitHub and Rails: You have let us all down.

#34

Post by marekmroz »

collypops wrote: post #22

> Beyond any shadow of a doubt, a shit storm of epic proportions has just gone down... > ...this episode has been handled is a face-palm fail of epic proportions. I'm all for, like, the evolution of language, but can we please all, like, agree that 'fail' isn't, like, a noun, and 'epic' is, like, totally overused.

And don't get me started on "should of", used twice in this article...

Re: GitHub and Rails: You have let us all down.

#35

Post by dos1 »

ericflo wrote: post #21
vidarh wrote: post #19

Earlier quoted context omitted.

I lost a tremendous amount of respect for Github when I heard they'd suspended his account. I have more of an issue with the Rails team for not accepting that this "feature" is a massive bug that they should've changed ages ago, though.

Why? I would expect any company to suspend the account of someone hacking them.

Sure, that was my knee jerk reaction too. Of course they should suspend the account! But I think that was the wrong choice.

Shutting down the one account will do nothing. He can create a second account in a matter of seconds. They fixed the code that permitted the exploit, right? So the fix alone should be plenty to prevent any more malicious attacks.

And now, because of the suspension, they have a wave of bad PR (justified or not). This guy is clearly infatuated with Github. He got a tattoo of the Octocat for crying out loud. Why would you punish this guy for loving your service and caring enough about it to warn you of a security vulnerability?

Seems like there are only minuses to suspending the account, not a lot of pluses.

Re: GitHub and Rails: You have let us all down.

#36

Post by nirvdrum »

augustl wrote: post #23
elithrar wrote: post #8

> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable. I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked. BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you…

I agree wholeheartedly. I always facepalm when people aren't able to work because the internet is down (read: no github access). Just start an SSH server, netcat some keys around (or use an USB stick), and get back to work again :) Transmitting files via Google's email servers from two computers on the same network in the same office in the same room, especially if you're in europe (ridicilously far away from GMail's…

While GitHub's uptime has improved immensely, it was a serious problem. It's not as simple as pushing your repo someplace else when you use submodules. If anyone has a fix for that I'd love to hear it. I've ceased using submodules in most cases precisely because GitHub used to go down so frequently, but now I have the same problem with anything that's a :git entry in my Gemfile.

Re: GitHub and Rails: You have let us all down.

#37

Post by artursapek »

ericflo wrote: post #21
vidarh wrote: post #19

Earlier quoted context omitted.

I lost a tremendous amount of respect for Github when I heard they'd suspended his account. I have more of an issue with the Rails team for not accepting that this "feature" is a massive bug that they should've changed ages ago, though.

Why? I would expect any company to suspend the account of someone hacking them.

The point is he did them no harm when he could have done a lot of it.

Re: GitHub and Rails: You have let us all down.

#38

Post by augustl »

ktizo wrote: post #30
augustl wrote: post #23

Earlier quoted context omitted.

I agree wholeheartedly. I always facepalm when people aren't able to work because the internet is down (read: no github access). Just start an SSH server, netcat some keys around (or use an USB stick), and get back to work again :) Transmitting files via Google's email servers from two computers on the same network in the same office in the same room, especially if you're in europe (ridicilously far away from GMail's…

LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.

I guess it's just about familiarity. We do have the tools (mdns/avahi/bonjour, tcp/netcat, ...). But the internet is usually up, so we don't need to learn how to set up our own local servers, and there's no punishment for transmitting a file across the atlantic when it could have been transferred to another room in the same building and back again.

Re: GitHub and Rails: You have let us all down.

#39

Post by mason55 »

stock_toaster wrote: post #29
refulgentis wrote: post #20

Earlier quoted context omitted.

You're conflating two issues here. He's arguing that the Rails team was ignoring an important issue by noting it was an easy end-user fix, and GitHub overreacted by suspending him after he tried several times to bring it to their attention, and then grossly mislead their user base as to the extent of the issue (which sounds like a really fundamental security issue that any professional Rails developer should know how…

Did he notify github directly, or did he notify the rails team in a github-issue in the rails project? If he didn't actually contact github directly and just assumed they would see the rails issue on a weekend, then I wouldn't exactly call it 'notice'. If he did submit it to github via the proper channels before taking action, and nothing was done within a reasonable timeframe (eg. not just an hour or two on a sunday…

The reason for exploiting github was to get the rails issue noticed, not to notify github of a vuln. If he quietly notifies github then there are still thousands of github sites out there that remain vulnerable. By exploiting GitHub and getting this huge response he allows the news of the vulnerability to get tons more coverage than it would have otherwise.
Post reply on HN