Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

111–120 of 240 posts

Re: Hacked: commit to rails master on GitHub

#111

Post by nfm »

nate wrote: post #54

Shouldn't rails by default protect belongs_to associations. There is probably a minute number of cases where someone wants mass assignment changes to include the parent's id of that record.

In my uses of rails, belongs_to associations get changed frequently. Any time anything gets 'assigned' to something, this occurs: assigning something to a user, to a milestone, to a plan, to an account, maybe even to a priority. YMMV but I'd say this isn't minute.

That said, there are certainly places in my apps where I don't want this to occur. And whitelisting is much better than blacklisting!

Re: Hacked: commit to rails master on GitHub

#114

Post by technoweenie »

maratd wrote: post #66
holman wrote: post #33

We've patched and fixed this on GitHub.

As a paying customer, whose sole reason in paying you is to keep his data secure, I expect a bit more than "we fixed it" ... details please.

https://github.com/blog/1068-public-key-security-vulnerabili...

Re: Hacked: commit to rails master on GitHub

#115

Post by pdufour »

ceejayoz wrote: post #109
teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

The point, though, is that this is more of a Rails issue than a Github issue. If Github gets it wrong, others are likely to.

It is a Github issue in the fact that they didn't protect against this issue when they easily could have.

Re: Hacked: commit to rails master on GitHub

#116

Post by grabastic »

maratd wrote: post #66
holman wrote: post #33

We've patched and fixed this on GitHub.

As a paying customer, whose sole reason in paying you is to keep his data secure, I expect a bit more than "we fixed it" ... details please.

I am also a paying customer, but I don't feel entitled to a thorough explanation anywhere but through their own official channels... even if one of their employees has chosen to comment here.

Re: Hacked: commit to rails master on GitHub

#117

Post by fijal »

cagenut wrote: post #84
holman wrote: post #33

We've patched and fixed this on GitHub.

Thank you commenter "holman" on this third party discussion site, but as a paying customer could github please post something official somewhere like now

Can you give him some slack? It's sunday, he says the vulnerability is fixed and this is all you should care about. Surely you would rather have him looks if it's really fixed rather than issuing an official statement. Surely an official statement can wait a day or two no?

Re: Hacked: commit to rails master on GitHub

#118

Post by nate »

nfm wrote: post #111
nate wrote: post #54

Shouldn't rails by default protect belongs_to associations. There is probably a minute number of cases where someone wants mass assignment changes to include the parent's id of that record.

In my uses of rails, belongs_to associations get changed frequently. Any time anything gets 'assigned' to something, this occurs: assigning something to a user, to a milestone, to a plan, to an account, maybe even to a priority. YMMV but I'd say this isn't minute. That said, there are certainly places in my apps where I don't want this to occur. And whitelisting is much better than blacklisting!

And you're using mass assignment to do those assignments?

Re: Hacked: commit to rails master on GitHub

#119

Post by angersock »

holman wrote: post #33

We've patched and fixed this on GitHub.

You've apparently also suspended his account...?

(http://homakov.blogspot.com/2012/03/im-disappoint-github.htm...)

If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).

Re: Hacked: commit to rails master on GitHub

#120

Post by BenjaminCoe »

jsnell wrote: post #91
BenjaminCoe wrote: post #86

Earlier quoted context omitted.

This clearly was malicious: * it provides a how to for other individuals to repeat the attack, in a public forum. * it was made against an innocent third-party. * I doubt steps were taken to contact the third-party. * it was made on a Sunday morning. making it difficult to scramble and get a fix out the door. "Clearly the Rails core team were not willing to consider any kind of changes to improve the situation" The t…

Whether it was malicious depends on the motives, and it's very hard for me to see where the malice is. To me it looks more like he just wanted to bring attention to the issue in order to get it fixed. I already agreed that GitHub were innocent bystanders and that the timing was unfortunate. But if getting publicity to the issue was the main point, it's also easy to see why GitHub was the perfect target. I also alread…

I think you're winning me over to Egor's actions being more irresponsible and misguided than malicious -- chalk it up to him being 18.

I'm finding it pretty hard to stay mad at someone with this tattoo:

http://homakov.blogspot.com/2011/07/octocat-tattoo.html

Post reply on HN