Hacked: commit to rails master on GitHub • Hacker News Board

Re: Hacked: commit to rails master on GitHub

#121

Post by ericb » Sun, Mar 04, 2012, 8:45 PM UTC

wycats wrote: post #65

bradly wrote: post #60

Earlier quoted context omitted.

> Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there. But wasn't Merb merged into Rails? :) Sigh...

Not every idea from Merb made it into Rails. Especially when an idea would cause significant backwards-compatibility breakage (return string from action vs. implicit rendering), we stuck with the Rails approach. I always felt that "it's up to the developer to do the right thing" violates the normal Rails convention over configuration principles, but I also weigh breaking a large % of existing Rails apps in a way that…

>Like mass assignment, previous vulnerabilities were caused by Rails defaults that caused most users to make mistakes (nearly everyone had at least a few cases where `h` was required but wasn't done).

But let me just add, fixing those when I moved rails 3 felt good.

Re: Hacked: commit to rails master on GitHub

#122

Post by javascriptlol » Sun, Mar 04, 2012, 8:50 PM UTC

Even a genius eventually makes a mistake. Systems should be safe by default unless there's a good reason (e.g. performance). Why bother with high level tools if they're not even protecting you from mistakes?

Re: Hacked: commit to rails master on GitHub

#123

Post by michaelf » Sun, Mar 04, 2012, 8:52 PM UTC

klodolph wrote: post #8

If this is a GitHub exploit, and I were GitHub, I would be talking to law enforcement. This is not how adults disclose software vulnerabilities.

I agree. If you exploit a site and then say "will you pay me for security audit?", then that's extortion.

Re: Hacked: commit to rails master on GitHub

#124

Post by maratd » Sun, Mar 04, 2012, 8:53 PM UTC

grabastic wrote: post #116

maratd wrote: post #66

Earlier quoted context omitted.

As a paying customer, whose sole reason in paying you is to keep his data secure, I expect a bit more than "we fixed it" ... details please.

I am also a paying customer, but I don't feel entitled to a thorough explanation anywhere but through their own official channels... even if one of their employees has chosen to comment here.

> I don't feel entitled to a thorough explanation anywhere but through their own official channels

Nor do I. However, there was no indication given that an explanation would be given through official channels. If that indication was made with the "fixed it" comment, trust me, I would have kept my mouth shut and waited.

Re: Hacked: commit to rails master on GitHub

#125

Post by grabastic » Sun, Mar 04, 2012, 8:55 PM UTC

angersock wrote: post #119

holman wrote: post #33

We've patched and fixed this on GitHub.

You've apparently also suspended his account...? ( http://homakov.blogspot.com/2012/03/im-disappoint-github.htm... ) If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).

His behavior should not be rewarded.

Re: Hacked: commit to rails master on GitHub

#126

Post by ben0x539 » Sun, Mar 04, 2012, 8:56 PM UTC

teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

I'd agree with it being "not the most responsible" way if you were talking about him publicly posting an exploit instead of privately talking to github. But the vulnerability was already known, he didn't disclose anything new, so I don't see the lack of responsibility.

Re: Hacked: commit to rails master on GitHub

#127

Post by cmelbye » Sun, Mar 04, 2012, 8:58 PM UTC

angersock wrote: post #119

holman wrote: post #33

We've patched and fixed this on GitHub.

You've apparently also suspended his account...? ( http://homakov.blogspot.com/2012/03/im-disappoint-github.htm... ) If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).

This sort of behavior shouldn't be rewarded, though. He publicly exploited a 0-day vulnerability. He should've responsibly disclosed it to GitHub, and instead he revealed it to the public.

Re: Hacked: commit to rails master on GitHub

#128

Post by marshray » Sun, Mar 04, 2012, 9:00 PM UTC

vidarh wrote: post #55

bryanbibat wrote: post #28

Earlier quoted context omitted.

If it's a simple mass-assignment vulnerability, the Rails team has nothing to do with it given that mass-assignment is a feature and the vulnerability is well documented: http://edgeguides.rubyonrails.org/security.html#mass-assignm... Heck, I even learned this way back when I was learning Rails: http://railscasts.com/episodes/26-hackers-love-mass-assignme...

The fact that this is even a discussion is sufficient for me to consider it a bug. It's irresponsible of the Rails team to leave this default the way it is given that it's long been a known risk. That they like to consider it a "feature" doesn't make it any better - it just makes them look like idiots

I was going to say the same thing.

The Security guide does describe the issue, and even describes attr_accessible as a "Countermeasure". http://guides.rubyonrails.org/security.html#mass-assignment

Without any precautions Model.new(params[:model]) allows attackers to set any database column’s value.

Unbelieveable! PHP showed long ago that allowing a web request to auto-populate arbitrary members in app objects is just a spectacularly bad idea.

Even the canonical "Hello Rails" example code neglects to specify attr_accessible. http://guides.rubyonrails.org/getting_started.html#hello-rai...

The general attitude of Rails developers towards security here is really shocking. I don't think I could recommend anyone use Rails.

Re: Hacked: commit to rails master on GitHub

#129

Post by angersock » Sun, Mar 04, 2012, 9:00 PM UTC

grabastic wrote: post #125

angersock wrote: post #119

Earlier quoted context omitted.

You've apparently also suspended his account...? ( http://homakov.blogspot.com/2012/03/im-disappoint-github.htm... ) If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).

His behavior should not be rewarded.

Why? He didn't cause any harm, disclosed quickly, and only acted after being ignored by the framework community (multiple times, it would seem).

It's not even being "rewarded"--it's being "not punished".

Wouldn't you like to have people spot vulnerabilities on your site and report them promptly without also breaking things? Seems a little ungrateful, yeah?

If we are all going to migrate to the cloud and assume our services (no longer under our control) are handled competently, we must place a higher premium on vetting that competency.

Re: Hacked: commit to rails master on GitHub

#130

Post by sad_panda » Sun, Mar 04, 2012, 9:03 PM UTC

This is a pretty huge security issue with wide-reaching implications. People everywhere pull and compile from master branches on Github without second thoughts. It's a big hole. But everybody's running defense for GitHub.

Contrast this with the enormous hue and cry against FB, MS, et al. when they have comparatively minor holes in their systems.

I'm not saying that we need to tar and feather GH, but we should at least be equal-opportunity in our condemnations and realize that everybody is capable of mistakes. So, if you're OUTRAGED about Apple making a minor boo-boo, you should be equally outraged about this.