Responsible Disclosure Policy • Hacker News Board

Re: Responsible Disclosure Policy

#11

Post by [deleted] » Mon, Mar 05, 2012, 12:56 AM UTC

hythloday wrote: post #9

JumpCrisscross wrote: post #3

Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…

I'm inclined to agree with you, but, to play the devil's advocate, "we're temporarily suspending you...oops, no, it's permanent after all" is not a position they want to find themselves in.

[deleted]

Re: Responsible Disclosure Policy

#12

Post by MartinMond » Mon, Mar 05, 2012, 12:56 AM UTC

JumpCrisscross wrote: post #3

Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…

I agree with you, but even if this was a reaction to public outcry the real reason to be disturbed is that top-notch Ruby devs like the GitHub guys didn't use attr_accessible. I can't wrap my mind around that.

That you have to use attr_accessible is known throughout the Rails community since "ever". Only toy apps don't use it.

It's like saving passwords in plaintext, only arguably even worse.

Re: Responsible Disclosure Policy

#13

Post by skeletonjelly » Mon, Mar 05, 2012, 1:00 AM UTC

"and we worked with him to fix it in a timely fashion"

Did this take place in private? I can't see any evidence of this from his issue on the rails repo.

Re: Responsible Disclosure Policy

#14

Post by nknight » Mon, Mar 05, 2012, 1:00 AM UTC

hythloday wrote: post #9

JumpCrisscross wrote: post #3

Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…

I'm inclined to agree with you, but, to play the devil's advocate, "we're temporarily suspending you...oops, no, it's permanent after all" is not a position they want to find themselves in.

The usual phrase would be along the lines of "pending a full investigation", which is what they should have said, but people often fail to. PR is hard enough when you're calm and collected, in the middle of a shitstorm it's a miracle if you can fully articulate what is and will be happening.

Re: Responsible Disclosure Policy

#15

Post by Me1000 » Mon, Mar 05, 2012, 1:10 AM UTC

JumpCrisscross wrote: post #3

Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…

I'm inclined to believe GitHub did exactly what they thought was best. That is to say anyone's knee jerk reaction would be to suspend the account as quickly as possible, for whatever good it might do... I can't fault them for what they did. When someone hacks you, you need to act very quickly because your customers are more important than your ego. I do believe they should provide incentive for responsible disclosure though.

Edit: spelling

Re: Responsible Disclosure Policy

#16

Post by maaku » Mon, Mar 05, 2012, 1:17 AM UTC

JumpCrisscross wrote: post #3

Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…

If you're investigating a security situation, you don't have to say squat. Whether you were in the right or the wrong, explain what happened and apologize to those where were affected once the facts are understood, as they have done here.

It takes time and energy to come up with responses such as this (not a lot, but every bit counts in an emergency), and those are resources that you should be using the solve the problem. Not to mention that saying the wrong thing is worse than saying nothing at all.

It's basic emergency management: 1) stabilize the situation, 2) figure out what's going on, 3) fix it, and then 4) explain what happened to the stakeholders. I see nothing wrong with github's actions here.

Re: Responsible Disclosure Policy

#17

Post by technoweenie » Mon, Mar 05, 2012, 1:19 AM UTC

JumpCrisscross wrote: post #3

Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…

We saw some weird stuff on the account that he wasn't upfront about. Though, our first priority was clearing the bug up.

Re: Responsible Disclosure Policy

#18

Post by why-el » Mon, Mar 05, 2012, 1:20 AM UTC

maaku wrote: post #16

JumpCrisscross wrote: post #3

Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…

If you're investigating a security situation, you don't have to say squat. Whether you were in the right or the wrong, explain what happened and apologize to those where were affected once the facts are understood , as they have done here. It takes time and energy to come up with responses such as this (not a lot, but every bit counts in an emergency), and those are resources that you should be using the solve the pr…

Not to mention that this happened on a Sunday.

Re: Responsible Disclosure Policy

#19

Post by technoweenie » Mon, Mar 05, 2012, 1:20 AM UTC

skeletonjelly wrote: post #13

"and we worked with him to fix it in a timely fashion" Did this take place in private? I can't see any evidence of this from his issue on the rails repo.

Yup.

Re: Responsible Disclosure Policy

#20

Post by mojombo » Mon, Mar 05, 2012, 1:21 AM UTC

skeletonjelly wrote: post #13

"and we worked with him to fix it in a timely fashion" Did this take place in private? I can't see any evidence of this from his issue on the rails repo.

Yes, this happened via our support system which all happens through private emails.