11–20 of 185 posts
It looks like this was just the default Rails resource scaffolding.
I took a look at the team. Is it considered apropos to state how surprised you are that developers who come across as relatively senior are capable of making an incredibly fundamental security mistake such as this? It looks like this was just the default Rails resource scaffolding.
Only if you're concerned that you can't tell who is "relatively senior." In this case, your judgement was unfortunately wrong.
To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.
On one hand we all want to move quickly, get users, add new features, etc etc.
On the other, security issues like this are just so vital that nothing else really matter if your data is not secure. It's especially true for a BACKUP SERVICE that promises ridiculous stuff like "99.999999999%" uptime on the frontpage.
Cancan is great way to make sure that you can only read or edit your own records in the database with Rails.
if you've used that service, the information you entered was publicly visible (key to access aws, etc) (the thread linked above says it has now been patched).
[i don't understand why, but when i access the link for this thread i get the gzipped page as a download; linux + chrome 22; firefox displays what appears to be gzipped data; wget saves the gzipped data as index.html; same behaviour for chrome on opensuse and ubuntu; windows 7 + ie9 (in a vm) shows the gzipped data in notebook; is no-one else seeing this?!]
[update: fixed now - it looks like it wasn't changing the content type]
To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.
If it's accessible on the public internet and asks for something as secure as API keys, that is when you should worry about security, not when it's "meant to be picked up by HN".
Maybe if there was a service promised but not rendered, could you place full blame on the developer(s).
I would recommend using CanCan for security if they haven't done so already so you can't just type in other users user_id in the url to view or edit. https://github.com/ryanb/cancan Cancan is great way to make sure that you can only read or edit your own records in the database with Rails.
It's also interesting that the aws key/secret are "masked" on the page, but you can just visit http://www.iceboxpro.com/users/12.json and get the formatted json representation with no masking.
if anyone else is having problems viewing this: it's a serious hole in icebox, the service featured here http://news.ycombinator.com/item?id=4619132 if you've used that service, the information you entered was publicly visible (key to access aws, etc) (the thread linked above says it has now been patched). [i don't understand why, but when i access the link for this thread i get the gzipped page as a download; linux…