101–110 of 202 posts
If @homakov is finding security holes without access to Github repositories, imagine what he'd find if you had him code audit for a few days... He's clearly been going about this the proper white-hat way and ensuring holes are patched before open disclosure... what's there to lose? On the flip side, you could go about doing what you're doing under the presumption nobody is maliciously targeting your user base. In thi…
Earlier quoted context omitted.
Not everyone's time is equal. If you're finding security holes like Egor then an hour of your time is absolutely worth $400/hr.
I totally believe that he's worth that amount of money. I'm sorry if you thought I was questioning that. I'm questioning the juxtaposition of his hourly rate with a request for donations.
Earlier quoted context omitted.
People shouldn't trust the cloud for important source storage. Always self-host anything you want to keep private.
I'm pretty sure many more codebases have been lost through failures to secure internal networks by corporate IT departments than through vulnerabilities in cloud hosting providers.
Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…
https://github.com/github/rails
http://www.kalzumeus.com/2013/06/17/if-your-business-uses-ra...
"P.S.2 Love donating? Help Egor on coinbase or paypal: homakov@gmail.com" Maybe it's just me, but asking for donations after saying you bill clients at $400/hr seems weird to me. I wish I could bill at that rate.
There's a number of people who would like donate but not interested in consulting.. There were always people complaining "Add a donate address" Now "why you added a donate address". Oh, Internet.
If @homakov is finding security holes without access to Github repositories, imagine what he'd find if you had him code audit for a few days... He's clearly been going about this the proper white-hat way and ensuring holes are patched before open disclosure... what's there to lose? On the flip side, you could go about doing what you're doing under the presumption nobody is maliciously targeting your user base. In thi…
I don't get why Github just hasn't hired the guy already.
Earlier quoted context omitted.
Ah. How did you get the motivation now? How long did it take to find these bugs?
They launched bounty, this was the motivation to check things i always wanted to check. It took me about 4-5 hours, most of that time I was watching TV shows.
Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…
It's worth mentioning that Github has forked Rails and is working off their own private branch of Rails 2.3. Not saying that was relevant to this exploit, mind you. https://github.com/github/rails http://www.kalzumeus.com/2013/06/17/if-your-business-uses-ra...
> I . . . decoded _gist_session cookie (which is regular Rails Base64 encoded cookie)
In Rails 4 the session cookie is encrypted with a server-side secret, so the end user can't decipher it.
Seeing stuff like this, I want to get into comp-sec. It always sounded interesting, and it looks like it pays well...
I'd put this in the same category as mobile app dev. There are a few people making money by the truckload, plenty of people making a decent living, and lots of folks who strike out. If it's something you're interested in, go for it. I just worry that people see this like the promise of gold in a faraway land and go rushing in, not thinking about the real distribution of success.
Earlier quoted context omitted.
As briefly as possible? Infosec is hard. Most companies have virtually no security policies. Nobody listens. Black hats are ahead in the arms race and anyone who has decent knowledge (doesn't even have to be anywhere near on a level like Homakov or Zalewski) can pull off all sorts of exploits. Even if they don't strike the application itself, they'll get you through infrastructure that your application relies on. Loo…
> Infosec is hard. In computer security, you have to get it right every single time. The bad guys only need to get it right once.