Earlier quoted context omitted.
The sad part is that the guy was your biggest fan: http://homakov.blogspot.in/2011/07/octocat-tattoo.html
It's a fake.
[deleted]
GitHub and Rails: You have let us all down.
111–120 of 205 posts
Re: GitHub and Rails: You have let us all down.
#112I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…
Yeah, I think we'll migrate all our private stuff to http://gitlabhq.com/ The way GitHub reacted (blocking @homakov) is just wrong and destroyed all my confidence in them. Even more so when it was pointed out that @zedshaw crashed GitHub and didn't get blocked. http://sheddingbikes.com/posts/1306816425.html Edit: Given that they have now stated that suspending @homakov was only temporary I no longer bear any ill will…
I actually wanted them to ban me for that, because then they'd have even more to explain about them allowing rape/abuse comics about me on their site:
https://github.com/nickmartini/dongml
Which has:
https://a248.e.akamai.net/assets.github.com/img/b0de87a4cf0c...
If I was a woman there'd be an international shit storm over that image, but I'm a dude, and one that TPW hates, so of course they won't do shit.
Then again I can usually handle myself so that's what I did.
Re: GitHub and Rails: You have let us all down.
#113Earlier quoted context omitted.
As the author of the post points out, hundreds of thousands of apps rely on Github, so to an extent it is their responsibility to block people who may jeopardize their users. But they haven't blocked him. They blocked his account , so all he has to do is create another. Github has put their users in far more danger by being dicks to a guy to gain nothing.
In what way do they have to prevent him from ever accessing the site from any account ever again? The best they can do is suspend his account per policy while they are investigating.
In what way do they have to prevent him from ever accessing the site from any account ever again?
Who said they did?
The best they can do is suspend his account per policy while they are investigating.
Why? What's the point of suspending his account?
Re: GitHub and Rails: You have let us all down.
#114Earlier quoted context omitted.
The fact that there is not persistent caching of mission dependent code and data as a fundamental commercial standard shows how badly we as a species in general can judge risk, even when the stakes are really high.
How so? Each git user has a local copy of the whole repository.
Git is not a fundamental commercial standard, I was winging about the state of industry in general.
Re: GitHub and Rails: You have let us all down.
#115This is the first thing in securing your rails app a developer learns, how to properly handle mass-assignment. I don't blame rails, I blame Github.
Re: GitHub and Rails: You have let us all down.
#116Earlier quoted context omitted.
LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.
99.9% of the time, tools which work for communicating over the internet work very well for communicating locally. It's not worthwhile for most people to devote the time to building, maintaining, or learning a second tool for the LAN side for that 0.1% of the time when your internet connection is down.
True, but they are rarely set up properly. Also, when they are set up they are often only used for things that are thought of as 'local tasks' such as a media store or printer server and not for replication of the online system that you have for some insane reason decided should be hosting your accounts or whatever.
Re: GitHub and Rails: You have let us all down.
#117Oh, they've let you all down? Then stop using other people's web applications and just run your own git/hg server. With blackjack, and hookers.
You are vulnerable to someone else's fuck-ups as long as you insist on giving up control over your data and code in exchange for the convenience of someone else doing the "hard work" of development and administration for you.
Hell, restore the network to being peer-to-peer rather than hierarchical, and hosting your own whatever will no longer be such a damn problem.
Re: GitHub and Rails: You have let us all down.
#118> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable. I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked. BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you…
You can get your code out, but what about all of the rest of your data? Wiki, issues, pull requests, etc.
Update: Apparently it's doable with some API magic, but you still have to handroll your exporter: http://www.lornajane.net/posts/2011/github-api-issues-list
Re: GitHub and Rails: You have let us all down.
#119I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…
Clearly the only secure and rational solution for all of us is to print out our source code every hour and store it in a shoebox under our beds.
Re: GitHub and Rails: You have let us all down.
#120I'm not sure if everyone noticed the last comment on this article: http://screencast.com/t/Nobted7zv5z Posted "almost 8 years ago" ie. posterous would appear to have the same vulnerability.
Isn't that Twitter?