Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I hacked Github again

homakov.blogspot.com

Post reply on HN
Print view View original

131–140 of 202 posts

Re: How I hacked Github again

#131

Post by null_ptr »

enscr wrote: post #48

Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…

I'm wondering if someone of Github's caliber can be hacked so easily, what about the rest of the masses developing web apps.

What do you think makes Github that much better than all the rest?

Re: How I hacked Github again

#132

Post by jmathai »

akerl_ wrote: post #34
jmathai wrote: post #28

Earlier quoted context omitted.

Not everyone's time is equal. If you're finding security holes like Egor then an hour of your time is absolutely worth $400/hr.

I totally believe that he's worth that amount of money. I'm sorry if you thought I was questioning that. I'm questioning the juxtaposition of his hourly rate with a request for donations.

Understood. But I imagine that his work isn't quite as "steady" as one might expect. He invests time by trying to find security exploits in hopes that the affected company compensates him. He doesn't set his price or even determine if he gets paid for his time.

I think that might be the rationale...or it might just be that he's found himself in a position where he can collect bounties AND donations :).

Re: How I hacked Github again

#133

Post by dasil003 »

null_ptr wrote: post #131
enscr wrote: post #48

Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…

I'm wondering if someone of Github's caliber can be hacked so easily, what about the rest of the masses developing web apps. What do you think makes Github that much better than all the rest?

It's a dream job for developers, in some ways a lot more so than the big boys like Google and Facebook. They have a hiring pipeline any tech company would kill for. They probably don't have the deep security talent that say Google or Microsoft have, but they should have enough.

Re: How I hacked Github again

#134

Post by [deleted] »

VBprogrammer wrote: post #100
ProAm wrote: post #86

Earlier quoted context omitted.

People shouldn't trust the cloud for important source storage. Always self-host anything you want to keep private.

I'm pretty sure many more codebases have been lost through failures to secure internal networks by corporate IT departments than through vulnerabilities in cloud hosting providers.

[deleted]

Re: How I hacked Github again

#135

Post by count »

ProAm wrote: post #86
chimeracoder wrote: post #76

Earlier quoted context omitted.

If you're talking about for company projects, the enterprise version of Github is self-hosted (e.g. on a VPN): https://enterprise.github.com/

People shouldn't trust the cloud for important source storage. Always self-host anything you want to keep private.

'People' shouldn't 'trust' anything.

Verify.

Important storage can be done 'in the cloud', but you need to audit and verify the cloud vendor is providing the proper controls. Just like you need to do 'privately'.

Re: How I hacked Github again

#136

Post by YuriNiyazov »

homakov wrote: post #56
leandrocp wrote: post #49

@homakov, have you thought about selling screencasts ?

Security screencasts with Russian accent? HA HA.

Especially with a Russian accent. Gives it a very "if you don't do like I say, other Russians will come and steal your shit" aura.

Re: How I hacked Github again

#137

Post by phillmv »

ultimoo wrote: post #63

@homakov finds 5 different bugs with github and manages to align them so that a bigger vulnerability is exposed in under 5 hours ? That's amazing! I used to think I'm a fast delivery-focused developer but I'm probably just a fraction of how fast some people are.

He's not counting all the time he's spent carefully reading the oauth spec and playing with different options ;).

Re: How I hacked Github again

#139

Post by usaphp »

shortly wrote: post #119
rdl wrote: post #105

Earlier quoted context omitted.

Is there a way to guarantee you will spend donations on alcohol and not waste them on things like rent or food?

yes. donate to someone who makes $400/hour.

Charging $400/hour does not mean he does not need extra money. His nature of business is a short term projects, it's not like a regular web developer who has to work 40 hours a week for many month to finish a project, he only does audits which don't last long because of that you see this "high" (I personally don't think it's high) hourly rate.
Post reply on HN