Hacked: commit to rails master on GitHub • Hacker News Board

Re: Hacked: commit to rails master on GitHub

#101

Post by zdouglas » Sun, Mar 04, 2012, 8:03 PM UTC

lgeek wrote: post #83

patrickaljord wrote: post #57

Funnily, the first Diaspora release had the same issue and the devs were ridiculed and called noobs by a big part of the HN community and security "experts" wrote big posts about it. The different reaction here is interesting to say the least.

In the case of Diaspora it was a less subtle and more obvious issue. They just weren't checking for authorization, as in: def destroy @album = Album.find_by_id params[:id] @album.destroy [...] end when the second line should have been something like: user.albums.find_by_id params[:id] But, well, they're both pretty bad mistakes.

Palpability is in the eye of the beholder. There's a lot of talk in the GH issue comments dismissing GH's "obvious" failure of not using `attr_accessible`.

Re: Hacked: commit to rails master on GitHub

#102

Post by mgkimsal » Sun, Mar 04, 2012, 8:07 PM UTC

moe wrote: post #94

wycats wrote: post #44

Here's my proposal for improving the situation: https://gist.github.com/1974187 Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there. Moving it into the controller will also make it easier to solve the tension between reducing the friction of getting up and running quickly and having good security defaults. In general, Rails' conventi…

self-evident It is. The more interesting question is why it takes rails 7 years (and counting) to come to this conclusion. I'll take it one further and sing my song about the Rails ActiveRecord implementation here, which is tangentially related. The promise of AR is to reflect on the database at startup and then "magically work". The problem in rails is that nothing magically works. What you get out of the box is an…

No downvote here. I'm by far no Rails guru - I've done one moderate-sized project in it (as an apprentice to someone far more experienced) and a couple of smallish projects, Rails feels brittle. I thought I was pretty alone in that thinking, but based on your rant above, I'm not 100% on my own. I've gotten used to Grails/GORM, which has its own set of issues, for sure, but has always felt more natural.

Re: Hacked: commit to rails master on GitHub

#103

Post by mekoka » Sun, Mar 04, 2012, 8:08 PM UTC

mcav wrote: post #96

cagenut wrote: post #84

Earlier quoted context omitted.

Thank you commenter "holman" on this third party discussion site, but as a paying customer could github please post something official somewhere like now

Holman works at GitHub.

He meant that the present thread is still in Hacker News, not GitHub and it would be helpful if there was an official GitHub post about it.

Re: Hacked: commit to rails master on GitHub

#104

Post by xnxn » Sun, Mar 04, 2012, 8:12 PM UTC

moe wrote: post #94

wycats wrote: post #44

Here's my proposal for improving the situation: https://gist.github.com/1974187 Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there. Moving it into the controller will also make it easier to solve the tension between reducing the friction of getting up and running quickly and having good security defaults. In general, Rails' conventi…

self-evident It is. The more interesting question is why it takes rails 7 years (and counting) to come to this conclusion. I'll take it one further and sing my song about the Rails ActiveRecord implementation here, which is tangentially related. The promise of AR is to reflect on the database at startup and then "magically work". The problem in rails is that nothing magically works. What you get out of the box is an…

> cue the downvotes

Why end your rant with an insult to its readers? Please leave the martyrdom out next time.

Re: Hacked: commit to rails master on GitHub

#105

Post by tvon » Sun, Mar 04, 2012, 8:13 PM UTC

Nothing makes you look like more of a jackass then throwing gifs into rails commit comments.

Re: Hacked: commit to rails master on GitHub

#106

Post by moe » Sun, Mar 04, 2012, 8:14 PM UTC

xnxn wrote: post #104

moe wrote: post #94

Earlier quoted context omitted.

self-evident It is. The more interesting question is why it takes rails 7 years (and counting) to come to this conclusion. I'll take it one further and sing my song about the Rails ActiveRecord implementation here, which is tangentially related. The promise of AR is to reflect on the database at startup and then "magically work". The problem in rails is that nothing magically works. What you get out of the box is an…

> cue the downvotes Why end your rant with an insult to its readers? Please leave the martyrdom out next time.

You are right, sorry, I've removed that now. It was not meant as an insult, but didn't add anything meaningful either.

Re: Hacked: commit to rails master on GitHub

#107

Post by nfm » Sun, Mar 04, 2012, 8:14 PM UTC

wycats wrote: post #44

Here's my proposal for improving the situation: https://gist.github.com/1974187 Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there. Moving it into the controller will also make it easier to solve the tension between reducing the friction of getting up and running quickly and having good security defaults. In general, Rails' conventi…

I don't have a well-formed opinion on this, but how would you propose handling nested attributes if mass assignment protection was managed in the controller?

Re: Hacked: commit to rails master on GitHub

#108

Post by natehunzaker » Sun, Mar 04, 2012, 8:16 PM UTC

atambo wrote: post #3

arturadib wrote: post #2

I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.

I think it's a mass assignment vulnerability: https://github.com/rails/rails/issues/5228

Yeah I really feel for this guy. I don't blame his final solution, it was totally necessary. Issue #5228 is painful to read.

Re: Hacked: commit to rails master on GitHub

#109

Post by ceejayoz » Sun, Mar 04, 2012, 8:20 PM UTC

teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

The point, though, is that this is more of a Rails issue than a Github issue. If Github gets it wrong, others are likely to.

Re: Hacked: commit to rails master on GitHub

#110

Post by polemic » Sun, Mar 04, 2012, 8:27 PM UTC

teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

He took ownership and made it highly visible.

That might be unprofessional but it was also audacious - and easily the best way to get the word out quickly about an 'in the wild' exploit that will impact a huge number of apps.

Additionally: GitHub is a critical piece of infrastructure for a huge number of companies, contractors and start-ups. On balance, protecting GitHub from public embarrassment is far outweighed by the potentional impact of this sort of flaw. If a good old public "git@github ~ $ rake over coals" is what is needed to ensure that our IP is sufficiently protected, so be it.