Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

61–70 of 205 posts

Re: GitHub and Rails: You have let us all down.

#61

Post by hythloday »

stock_toaster wrote: post #29
refulgentis wrote: post #20

Earlier quoted context omitted.

You're conflating two issues here. He's arguing that the Rails team was ignoring an important issue by noting it was an easy end-user fix, and GitHub overreacted by suspending him after he tried several times to bring it to their attention, and then grossly mislead their user base as to the extent of the issue (which sounds like a really fundamental security issue that any professional Rails developer should know how…

Did he notify github directly, or did he notify the rails team in a github-issue in the rails project? If he didn't actually contact github directly and just assumed they would see the rails issue on a weekend, then I wouldn't exactly call it 'notice'. If he did submit it to github via the proper channels before taking action, and nothing was done within a reasonable timeframe (eg. not just an hour or two on a sunday…

He notified Github "last Friday", according to them:

https://github.com/blog/1068-public-key-security-vulnerabili...

Re: GitHub and Rails: You have let us all down.

#62

Post by mkramlich »

mquander wrote: post #44
ericflo wrote: post #7

I fail to see what GitHub did wrong here. They were attacked, they suspended the account doing the hacking, and they fixed the problem. Then, they blogged about it, explaining in detail what happened. Apparently they weren't quite reverent enough for the person who wrote this article.

Egor is a human whose motivations were totally obvious and whose actions were transparently harmless (and, in fact, net helpful.) The Github team are behaving foolishly if they can't or won't distinguish that from an "attack." Organizations should be expected to make decisions using reasoning that amounts to more than word association, e.g. he "attacked" us, so we'll "suspend" him.

Perhaps these conditions are not mutually exclusive. It can be an attack, and, something done with good intentions to illustrate a point.

Re: GitHub and Rails: You have let us all down.

#63

Post by mquander »

Fluxx wrote: post #56
mquander wrote: post #44

Earlier quoted context omitted.

Egor is a human whose motivations were totally obvious and whose actions were transparently harmless (and, in fact, net helpful.) The Github team are behaving foolishly if they can't or won't distinguish that from an "attack." Organizations should be expected to make decisions using reasoning that amounts to more than word association, e.g. he "attacked" us, so we'll "suspend" him.

I would disagree with this, quite a lot. He brought up an issue with the Rails team, they pointed him at the canonical, "here is where we talked about this before, sorry." Still not satisfied, he found the same exploit in Github to prove a point. Rather than do the sensible thing by creating a dummy account and contacting Github showing how he messed things up, he barged into the Rails organization and left a silly c…

I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, except that the former would probably get the bug fixed quietly; in contrast, now everybody is aware that the bug existed in Github and is aware of the potential for it to exist everywhere. He successfully proved his point, which apparently was a pretty good point. Isn't that a better outcome?

As for Github's responsibility: Github failed to protect people's data the minute the bug went live. That data was open to Egor since the moment he discovered the bug until the moment they fixed it. Making a silly commit did not make anyone's data more or less vulnerable, so I don't believe that "taking this shit seriously" implies flipping out over it.

Re: GitHub and Rails: You have let us all down.

#64

Post by [deleted] »

JackDanger wrote: post #55
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

They suspended the account, they didn't cancel it. On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account. On Monday morning you figure out what to do with them.

[deleted]

Re: GitHub and Rails: You have let us all down.

#65

Post by zalew »

dangrossman wrote: post #52
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/ I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan. My open source code is on GH, but it's all also pushed to RH, along with all my…

You should check out http://bitbucket.org

Re: GitHub and Rails: You have let us all down.

#66

Post by rdl »

stickfigure wrote: post #16
elithrar wrote: post #8

> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable. I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked. BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you…

I don't think anyone is dreadfully concerned about service availability - although that is certainly a concern. The problem is that source code is incredibly valuable and often represents many man-years of effort. A competitor could use this to bypass a lot of the early architectural fumbling around that we all do. Also, source code often contains passwords and shared secrets like Facebook secret keys. Disclosure wou…

Do people actually host confidential code on Github, vs. open source projects? I'm worried about the integrity of open source projects, but not really their confidentiality.

Re: GitHub and Rails: You have let us all down.

#67

Post by hythloday »

elithrar wrote: post #57
vidarh wrote: post #31

Earlier quoted context omitted.

He did it under his own name, in a way dad not damage anything, using a problem that has been well known for ages, after attempting to draw attention to the issue several times and being ignored. It is pretty obvious that he did not have any malicious intent, nor intended to do damage (if he wanted to, he could've done massive damage from an anonymous account in ways that wouldn't draw attention to it). The only thin…

> He did it under his own name, in a way dad not damage anything, using a problem that has been well known for ages, after attempting to draw attention to the issue several times and being ignored. He was ignored by the Rails devs, not by GitHub. Yet GitHub became the target of his attack, because he was "bored" (his word, not mine). At no stage, as far as we know, did he raise the issue directly with GitHub. As I've…

If you read the Github advisory, he did indeed raise the issue with them "last Friday":

https://github.com/blog/1068-public-key-security-vulnerabili...

Re: GitHub and Rails: You have let us all down.

#68

Post by stock_toaster »

hythloday wrote: post #61
stock_toaster wrote: post #29

Earlier quoted context omitted.

Did he notify github directly, or did he notify the rails team in a github-issue in the rails project? If he didn't actually contact github directly and just assumed they would see the rails issue on a weekend, then I wouldn't exactly call it 'notice'. If he did submit it to github via the proper channels before taking action, and nothing was done within a reasonable timeframe (eg. not just an hour or two on a sunday…

He notified Github "last Friday", according to them: https://github.com/blog/1068-public-key-security-vulnerabili...

> His previous report was fixed last friday

Makes it sound like a separate issue.

edit: looks like github clarified https://github.com/blog/1069-responsible-disclosure-policy

Re: GitHub and Rails: You have let us all down.

#69

Post by mkramlich »

I'm not too worried about the ability of an attack to push a commit, or cause a commit/object deletion in a repo's history, on GH, because most smart folks (if not everybody, by default) will have multiple copies of a repo across multiple machines, with backups, so anything can be undone or restored. (And trust me, I have the imagination to understand how an unauthorized commit/push could lead to a situation enabling remote execution on client machines who've pulled down tainted commits. Think build scripts that have "install rootkit/malware/keylogger" commands added to them in the mal commits.)

What would be more bad is if this vulnerability allowed an attacker to get unauthorized read access or pull/clone access to a private GH repo.

Can anyone clarify for me whether this was possible?

Re: GitHub and Rails: You have let us all down.

#70

Post by Fluxx »

mquander wrote: post #63
Fluxx wrote: post #56

Earlier quoted context omitted.

I would disagree with this, quite a lot. He brought up an issue with the Rails team, they pointed him at the canonical, "here is where we talked about this before, sorry." Still not satisfied, he found the same exploit in Github to prove a point. Rather than do the sensible thing by creating a dummy account and contacting Github showing how he messed things up, he barged into the Rails organization and left a silly c…

I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, except that the former would probably get the bug fixed quietly; in contrast, now everybody is aware that the bug existed in Github and is aware of the potential for it to exist everywhere. He successfully proved his point, which apparently was a pretty good point. Isn't that a better outcome? As for Github's responsi…

> I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, except that the former would probably get the bug fixed quietly; in contrast, now everybody is aware that the bug existed in Github and is aware of the potential for it to exist everywhere. He successfully proved his point, which apparently was a pretty good point. Isn't that a better outcome?

I'm not denying that by doing what he did it certainly got the word out and made everyone understand how serious of a problem this is. It was a very good point and I think the outcome is the right one. I'm just saying that Github's actions - to suspend the user who somehow got SSH rights to the rails org - is the right thing to do. They want to minimize his damage that he will do, and until they can do a full audit and understand how his commit got there, it's the right thing o do.

> Making a silly commit did not make anyone's data more or less vulnerable, so I don't believe that "taking this shit seriously" implies flipping out over it.

I fail to see how suspending a user is "flipping out" over it? I don't think you can color unauthorized commits to github repos with different levels of responses from Github. That's a dangerous line to walk IMO.

Post reply on HN