> Beyond any shadow of a doubt, a shit storm of epic proportions has just gone down. Breathe.
...but don't relax, it might be messy
GitHub and Rails: You have let us all down.
141–150 of 205 posts
Re: GitHub and Rails: You have let us all down.
#142Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…
You are not getting the point about this situation.
The rants that are coming in are not about what has happened, but what could have happened.
Imagine a situation if somebody had deleted all the data or worse committed malicious code to important repos. And then used it create a bigger mess later it would have been disastrous.
If this can't be taken seriously I don't know what can be.
Re: GitHub and Rails: You have let us all down.
#143Earlier quoted context omitted.
Coincidentally, the incident with Zed was also fueled by the ruby guys being dicks. He just happens to be a higher-profile personality.
It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?
I code a lot in Ruby and have never touched Rails... Initially I got into Ruby because metasploit is written in it. Ruby might be popular because of Rails but it is not relevant to everyone who codes in Ruby.
Re: GitHub and Rails: You have let us all down.
#144Earlier quoted context omitted.
They suspended the account, they didn't cancel it. On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account. On Monday morning you figure out what to do with them.
If the vulnerability is that serious should they have not taken the site down instead?
Is there no middle ground?
Re: GitHub and Rails: You have let us all down.
#145Re: GitHub and Rails: You have let us all down.
#146Earlier quoted context omitted.
In what way do they have to prevent him from ever accessing the site from any account ever again? The best they can do is suspend his account per policy while they are investigating.
In what way do they have to prevent him from ever accessing the site from any account ever again? Who said they did? The best they can do is suspend his account per policy while they are investigating. Why? What's the point of suspending his account?
Why? What's the point of suspending his account?
There are two issues with any exploit: (1) prevent future exploits and (2) making sure that whoever discovered the exploit hasn't retained any unauthorized access.
Fixing the bug addresses (1) and suspending his account gives them time to address (2).
Re: GitHub and Rails: You have let us all down.
#147Earlier quoted context omitted.
Coincidentally, the incident with Zed was also fueled by the ruby guys being dicks. He just happens to be a higher-profile personality.
It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?
You're right of course. I've honestly been trying to avoid the Rails community for as long as possible (I'd like to avoid being associated with anyone who would call himself a "Rockstar Programmer"), and with Rails being as big as it is, I've pretty much avoided Ruby entirely.
Re: GitHub and Rails: You have let us all down.
#148Earlier quoted context omitted.
You should check out http://bitbucket.org
What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.) On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the…
> What makes you think they are saints?
What makes you think I think that?
Re: GitHub and Rails: You have let us all down.
#149Earlier quoted context omitted.
It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?
You're right of course. I've honestly been trying to avoid the Rails community for as long as possible (I'd like to avoid being associated with anyone who would call himself a "Rockstar Programmer"), and with Rails being as big as it is, I've pretty much avoided Ruby entirely.
Ruby community is quite reasonable. I usually avoid discussions in framework communities. At the other hand, programming language communities tend to be more reasonable and nerdy. I feel bad that you missed the chance to know ruby language due to anti rails.
Re: GitHub and Rails: You have let us all down.
#150Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…
I was on Egor's end of a similar incident back in my more impulsive years. I wasn't treated quite as well as he was but even so I eventually came around to the realization that being overly confrontational is never the right way to gain attention for security issues (even though it did result in the issue being fixed rather quickly).