Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Government Rails Site Hit Hours After CVE Patch

rietta.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Government Rails Site Hit Hours After CVE Patch

#31

Post by throooooo »

bavell wrote: post #30
rietta wrote: post #29

Earlier quoted context omitted.

Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better. We recently updated the design. This is a very old site so it has some quirks in the design for sure.

Android Firefox here, top nav takes up 1/3rd of the viewport

Same. So much spacing between the 3 lines. If they want to keep that huge header I'd suggest it gracefully entirely disappear when scrolling down and reappear when scrolling up.

Re: Government Rails Site Hit Hours After CVE Patch

#32

Post by dleink »

stephenhuey wrote: post #18
shevy-java wrote: post #11

DHH needs to focus on Rails again rather than Omarchy.

He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!

I don't know. Austin isn't the city I fell in love with in the 90s and early 2000s. Chiefly because it's no longer full of native Texans.

Re: Government Rails Site Hit Hours After CVE Patch

#33

Post by adastra22 »

tyre wrote: post #14

This post could be 10% as long: - There was a bug with a patch - We applied it to our clients - There were live exploits within eight hours of the patch being released - The Rails team had to expedite release of the technical details because POCs obviated the need to embargo

What is shocking to me is that it took eight hours.

Re: Government Rails Site Hit Hours After CVE Patch

#34

Post by TeMPOraL »

XenoCyber0 wrote: post #26
bradly wrote: post #8

Earlier quoted context omitted.

Not running, but supported. You can check your app with: bin/rails runner ' require "vips" puts "ruby-vips #{Vips::VERSION} libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}" begin Vips::Operation.new("matload") puts "matload PRESENT - this build can reach libmatio" rescue Vips::Error puts "matload ABSENT - this build cannot reach libmatio" end ' This is from the Rails official docs for the CVE which,…

An agent skill is the official distribution format for the forensics on a 9.5. I mean, I get it, anyone running a Rails app right now is pasting "am I affected" into an agent anyway, but it's the kind of thing that would've sounded like a joke a couple years ago.

Makes sense though. Agent skills are - by a mix of LLM nature and fashion - just high-quality documentation. Documentation that only gets written now, because agents are what makes docs "something immediately and directly useful for me right now", vs. "something I should write so others may benefit, someday, somehow".

Human incentives are funny.

Re: Government Rails Site Hit Hours After CVE Patch

#35

Post by jcupitt »

throwatdem12311 wrote: post #22

Just sent this to my boss. Felt like tossing a grenade over a fence into a party of unsuspecting people. We don’t use ActiveStorage but Claude was able create a similar exploit in own our app in the exact same way via our own file upload library in 3 minutes simply by point Opus 5 at our site and asking it if we were vulnerable to an attack similar to KindaRails2Shell. What a time to be alive.

The fix is pretty easy -- you should call `block_untrusted` to stop loaders like matlab from running:

https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted

You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier.

You can block or allow specific load operations, so you can limit format support to just the types you need:

https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_met...

That might be even better.

There was a post on libvips.org about this a while ago:

https://www.libvips.org/2022/05/28/What's-new-in-8.13.html

And a note about it in the checklist for devs:

https://www.libvips.org/API/current/developer-checklist.html...

Re: Government Rails Site Hit Hours After CVE Patch

#36

Post by rietta »

throooooo wrote: post #31
bavell wrote: post #30

Earlier quoted context omitted.

Android Firefox here, top nav takes up 1/3rd of the viewport

Same. So much spacing between the 3 lines. If they want to keep that huge header I'd suggest it gracefully entirely disappear when scrolling down and reappear when scrolling up.

Thank you. I will work on that.

Re: Government Rails Site Hit Hours After CVE Patch

#37

Post by tclancy »

dleink wrote: post #32
stephenhuey wrote: post #18

Earlier quoted context omitted.

He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!

I don't know. Austin isn't the city I fell in love with in the 90s and early 2000s. Chiefly because it's no longer full of native Texans.

Took me a minute, but absolutely lovely.

Re: Government Rails Site Hit Hours After CVE Patch

#38

Post by stephenhuey »

dleink wrote: post #32
stephenhuey wrote: post #18

Earlier quoted context omitted.

He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!

I don't know. Austin isn't the city I fell in love with in the 90s and early 2000s. Chiefly because it's no longer full of native Texans.

I’m a native Texan, and I can deign to go to Austin for a couple days even though I live in a much bigger city in Texas which has delicious food from far more countries than Austin does. Plenty of Texans, and plenty of room for people from everywhere.

Re: Government Rails Site Hit Hours After CVE Patch

#39

Post by onemoresoop »

rietta wrote: post #29
onemoresoop wrote: post #28

This website is format is really weird for mobile, I can only read two lines of text. The rest is covered by a big banner. Im on IOS. Anybody else having this issue or is it just me?

Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better. We recently updated the design. This is a very old site so it has some quirks in the design for sure.

You’re welcome. The banner obscures the view almost totally and I can read only 2 lines of text and scroll through that. I have a small device, Iphone se2022 if it helps.

Re: Government Rails Site Hit Hours After CVE Patch

#40

Post by pmontra »

onemoresoop wrote: post #28

This website is format is really weird for mobile, I can only read two lines of text. The rest is covered by a big banner. Im on IOS. Anybody else having this issue or is it just me?

Same thing in Firefox on Android but I used uBO element picker to select the header and nuke it. There is a link to the home page on the HTML below it and links in the footer. There is little to gain from that sticky header and much to lose.
Post reply on HN