How Homakov hacked GitHub & the line of code that could have prevented it
1–10 of 91 posts
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#2I must say that this episode is the best example of how to handle such cases.
Homakov found the issue and made his point without any sign of maliciousness.
Github, also handled is extremely professionally by accepting it and fixing the problem and then publishing a full report on it, rather than get into a pissing match with Homakov and getting law enforcement and lawyers involved.
BigCo's should take a note.
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#3It's surprising to me (not a very experienced Rails developer) that the default behavior should be so open to abuse.
Why isn't the default the opposite?
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#4Just a heads up for those who only read the TL;DR: Please be aware that if you just put that single line of code in your initializers for your existing app, your app will break anywhere you are using update_attributes(). They do call it out later in the article, but you have to set attr_accessible on all your models.
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#5I wonder how many Rails apps there are out there that is still vulnerable to this sort of flaw. Both GitHub and Posterous has fixed it, but there's probably thousands of smaller less known Rails sites/apps that still haven't been patched.
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#6[deleted]
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#7[deleted]
and hence, like hn did with google+ subdomain, every link should include subdomain if its not www.
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#8I posted a link to the relevant part of it (http://news.ycombinator.com/item?id=3665429) on another thread regarding this exploit already, but the official Rails Security Guide covers this and other common security pitfalls really well. It is worth reading over thoughtfully if you are building a Rails app:
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#9[deleted]
[deleted]
Re: How Homakov hacked GitHub & the line of code that could have prevented it
#10I'm a Python/Django developer and don't really know much Ruby or Ruby on Rails. Does anyone have an outsiders/non-rubyist explaination of how this hack was carried out? Did he modify HTTP headers? POST parameters?