I'm not sure if everyone noticed the last comment on this article: http://screencast.com/t/Nobted7zv5z Posted "almost 8 years ago" ie. posterous would appear to have the same vulnerability.
[deleted]
GitHub and Rails: You have let us all down.
121–130 of 205 posts
Re: GitHub and Rails: You have let us all down.
#122There is so much bombastic talk in this post. This has to be a troll.
Re: GitHub and Rails: You have let us all down.
#123Earlier quoted context omitted.
I thought that he added his public key to the Rails user through his own account settings, which wouldn't give him access to the Rails web admin.
This is correct. People who don't understand what a mass-assignment bug is are running with this story. It's like when we witness a DDoS and have to tollerate people who think it means that the targeted party was infiltrated. This bug allowed one to add their public key to another user's account, and make changes to comments and issues.
What are the odds that there's a similar bug which allows changes to user accounts? If that's the case, then altering the password or email address is trivial.
Re: GitHub and Rails: You have let us all down.
#124I'm not sure if everyone noticed the last comment on this article: http://screencast.com/t/Nobted7zv5z Posted "almost 8 years ago" ie. posterous would appear to have the same vulnerability.
Ha! Alright he probably should quit doing that before he gets KimDotcom'd.
Re: GitHub and Rails: You have let us all down.
#125As Zed Shaw pointed out, someone appearing to be Homakov has posted a comment dating back eight years. Is Posterous vulnerable as well? If so, that may not be Homakov, of course, but his twitter comments are consistent with him posting it.
Re: GitHub and Rails: You have let us all down.
#126I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…
Clearly the only secure and rational solution for all of us is to print out our source code every hour and store it in a shoebox under our beds.
Try to be serious. What are you gonna do, type your source back in by hand? Punch cards, paper tape, cassette recorder, pick one.
Re: GitHub and Rails: You have let us all down.
#127Earlier quoted context omitted.
I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/ I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan. My open source code is on GH, but it's all also pushed to RH, along with all my…
You should check out http://bitbucket.org
What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.)
On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the URL. The values you had to guess in the URL were a ticket number (they start from 1), a repository name, a date (YMD) and a filename. Sure there is some variety in there but it is not in the billions of possibilities, just hundreds and that won't make any computer break into a sweat and in my words at the time "easy". To make matters worse you can't delete the attachments to tickets.
This may not affect you. It certainly affected me. For example we had some keyfiles in one ticket. Coredumps in others.
Two weeks later the issue still hadn't been fixed and I don't know when it was. I've never seen disclosure of the issue. There wasn't even any way of knowing if attachments had been accessed in an unauthorized way since there was no checking in the first place.
Re: GitHub and Rails: You have let us all down.
#128Earlier quoted context omitted.
> I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, ... The latter violates the Computer Fraud and Abuse Act, creating huge imprisonment and employability risks.
... if you want to take a US-centric view of things, then that last statement is correct I suppose... but not everyone is subject to US laws - including, unless I am grossly mistaken, the person you refer to.
GitHub's and its computers are governed by US laws, and many countries have extradition treaties. Many countries also have equivalent computer abuse laws.
My comment was to discourage such spectacular glory-seeking behavior by other people that claim to be trying to help. It's a serious crime, and the FBI does not care that your intentions were good.
Re: GitHub and Rails: You have let us all down.
#129Earlier quoted context omitted.
Clearly the only secure and rational solution for all of us is to print out our source code every hour and store it in a shoebox under our beds.
Try to be serious. What are you gonna do, type your source back in by hand? Punch cards, paper tape, cassette recorder, pick one.
He was being snarky.
Re: GitHub and Rails: You have let us all down.
#130Earlier quoted context omitted.
Yeah, I think we'll migrate all our private stuff to http://gitlabhq.com/ The way GitHub reacted (blocking @homakov) is just wrong and destroyed all my confidence in them. Even more so when it was pointed out that @zedshaw crashed GitHub and didn't get blocked. http://sheddingbikes.com/posts/1306816425.html Edit: Given that they have now stated that suspending @homakov was only temporary I no longer bear any ill will…
Coincidentally, the incident with Zed was also fueled by the ruby guys being dicks. He just happens to be a higher-profile personality.
It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?