Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

131–140 of 205 posts

Re: GitHub and Rails: You have let us all down.

#131

Post by trotsky »

Jesus, HN goes from zero to lynch mob faster than reddit these days.

Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or two guys responding on a weekend.

The rest of the "oh my god the sky is falling" drivel about how terrible a bug it could have been and how they should never have had such a vulnerable bug in the first place is even worse. Security bugs are fuckups by nature - nobody sat and said well shit I was going to code this wrong but since it might allow a lot of access I won't. In terms of OH SHIT bugs this is actually rather small - I'm sure github's live infrastructure has been open to lower level remote execution vulnerabilities over the years - newsflash: we all have been. Getting user or superuser or db admin is going to almost certainly be a lot worse than an application authentication level vulnerability.

You say none of that matters because it's such an obvious bug and people have known not to do that kind of thing for years? Say hello to our old friends "buffer overflow" & "use after free" - still grabbing msft aapl & goog after all these years.

TL;DR - stop acting like children.

Re: GitHub and Rails: You have let us all down.

#132

Post by javascriptlol »

knodi wrote: post #115

This is the first thing in securing your rails app a developer learns, how to properly handle mass-assignment. I don't blame rails, I blame Github.

A system that is designed to rely on human diligence is inherently flawed. It's a mercy that drills and other dangerous tools aren't designed in the same way that a lot of software is.

Re: GitHub and Rails: You have let us all down.

#133

Post by reidmain »

trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

Correct me if I'm wrong but this wasn't a "zero day". This issue was brought up four days ago https://github.com/rails/rails/issues/5228

Re: GitHub and Rails: You have let us all down.

#134

Post by _gd3l »

Shut the fuck up.

How many companies get hacked regularly like this but keep it under the rug? You think FaceBook's never been exploited? TurboTax? Mint? Stripe? PayPal? Shopify? Tumblr? Pick your app that "so so so so many businesses" use regularly, and I guarantee something like this has happened with all of them.

But were they open about it?

GitHub's been open the whole time.

Your post is like saying "All criminals are stupid". This is ridiculous, as the only sample you know of and can work with are the criminals who have been caught. You don't know how many other criminals are out there getting away with their crimes, because...they haven't been caught yet.

Who knows how many other companies have had hacks like this in the past two months alone, for example? I don't, and neither do you.

But GitHub, as an open, honest company that so so so many of use regularly (which means we know right away when there's a problem, especially with a hugely popular repo like Rails/rails) has been in the spotlight since the second this happened.

GitHub, in my opinion, has acted really cool about this. They addressed the issue, explained what the issue is, patched the hole, and even reinstated the hacker's account. DHH addressed the issue in twitter, other people in the community have admitted they fucked up, and now we as a community can work on fixing this.

That doesn't sound like "Letting us all down".

Someone who expects everything to work perfectly all the time and have no vulnerabilities is someone will be let down by anything, a pessimist, and stupid. And certainly not worthy of the front page of Hacker News.

Re: GitHub and Rails: You have let us all down.

#135

Post by tdoggette »

raganwald wrote: post #126
angrycoder wrote: post #119

Earlier quoted context omitted.

Clearly the only secure and rational solution for all of us is to print out our source code every hour and store it in a shoebox under our beds.

Try to be serious. What are you gonna do, type your source back in by hand? Punch cards, paper tape, cassette recorder, pick one.

OCR, duh.

Re: GitHub and Rails: You have let us all down.

#136

Post by trotsky »

reidmain wrote: post #133
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

Correct me if I'm wrong but this wasn't a "zero day". This issue was brought up four days ago https://github.com/rails/rails/issues/5228

I thought there were two different issues, though not being a rails jockey I could easily be mistaken. Even if it was disclosed four days before it was exploited I stand by my take if not my terminology.

Re: GitHub and Rails: You have let us all down.

#137

Post by ktizo »

eropple wrote: post #101
ktizo wrote: post #30

Earlier quoted context omitted.

LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.

We...don't? I mean, if you're reliant on cloud services, yeah, you'll have problems--that's obvious. But if you self-host your important stuff (I run my own redmine instance off a local machine) and know how to use SSH, you should be fine in the majority of cases where the LAN is fine but has no Internet access. There's nothing "broken" here.

It seems so. I freelance, so have to jump into various different offices. And on the whole, a hell of a lot of small companies that shouldn't need to be that net-dependent seem crippled these days if their net connection is being flaky.

Re: GitHub and Rails: You have let us all down.

#138

Post by kamaal »

eugenejen wrote: post #130
tylermenezes wrote: post #104

Earlier quoted context omitted.

Coincidentally, the incident with Zed was also fueled by the ruby guys being dicks. He just happens to be a higher-profile personality.

It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?

It doesn't work that way. Rails is a major reason for the kind of push Ruby got.

There was a time when CGI and Perl were synonymous. You won't believe how many people have a similar opinion about JQuery and Javascript these days.

A few days back I wanted to use a object oriented language for a big project. Generally I straight away go and use Perl for all my experiments. But since this time I wanted Java programmers to be working with my project later I thought let me use Python as its more syntactically closer to Java. When I started coding, my manager peeked over my shoulder and asked if it was Python in which I was coding I replied yes. He immediately asked me to stop writing in it, as he thinks writing in 2.x is waste of time as it is going to go away, 3.x is not yet having all the libraries. And writing 2.x will force a huge rewrite effort later. I tried and reasoned enough to convince other wise. But alas, it didn't fly.

That is how it works with pointy haired managers. They read something some where and then hold strong opinions about a particular technology.

As programmers we can try and educate people in forums like these.

But managers don't read these forums. They are likely to read magazines from IBM and Oracle, where XML's are glorified and eclipse is presented as the biggest productivity booster ever. Unless we get a forum on such magazines, we won't be able to make much difference.

Re: GitHub and Rails: You have let us all down.

#139

Post by maratd »

trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

> and how they should never have had such a vulnerable bug in the first place is even worse.

Bugs happen. Even stupid oh-my-god-i-can't-believe-i-did-that bugs happen. And they happen to the best of us.

However, when someone reports a vulnerability about my code to me or I discover a problem myself, the very first thing I do is break out the grep. I grep the shit out of my code. Because I am a human being. I am a creature of habit. And if I screwed up in one place, I promise you, I did it in other places too.

The problem? Github didn't do that. At least, that's the impression from the information coming out. The guy reported the issue on Friday, they fixed that specific instance of the issue ... and it remained a problem in other places. That is unacceptable and unprofessional. They should have burned the midnight oil and made sure the same problem wasn't prevalent in other parts of the code.

Having said that, I am a loyal Github client and will remain so. Every service provider I use gets a once-a-year-screw-up credit. Github just used theirs. Switching because of one incident is premature and will be sure to cause regrets.

Re: GitHub and Rails: You have let us all down.

#140

Post by [deleted] »

technoweenie wrote: post #94
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.

[deleted]
Post reply on HN