Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

141–150 of 240 posts

Re: Hacked: commit to rails master on GitHub

#141

Post by judofyr »

thibaut_barrere wrote: post #75
ericb wrote: post #24

Earlier quoted context omitted.

He's being an asshole. On the other hand, if the defaults in Rails lead even strong Rails developers into making mistakes, perhaps it is time for Rails to develop an "opinion" about this. I hope the asshole messenger doesn't obscure the importance of the message because people often push back harder against a message when it is delivered in an obnoxious manner by an obnoxious person.

My thoughts exactly: the "asshole" is 18. People should give him a break already, and consider we're lucky he's getting the word out.

I think it's perfectly fine to not "give him a break." How else is he going to learn manners?

Re: Hacked: commit to rails master on GitHub

#142

Post by judofyr »

thibaut_barrere wrote: post #75
ericb wrote: post #24

Earlier quoted context omitted.

He's being an asshole. On the other hand, if the defaults in Rails lead even strong Rails developers into making mistakes, perhaps it is time for Rails to develop an "opinion" about this. I hope the asshole messenger doesn't obscure the importance of the message because people often push back harder against a message when it is delivered in an obnoxious manner by an obnoxious person.

My thoughts exactly: the "asshole" is 18. People should give him a break already, and consider we're lucky he's getting the word out.

I think it's perfectly fine to not "give him a break." How else is he going to learn manners?

Re: Hacked: commit to rails master on GitHub

#143

Post by krobertson »

angersock wrote: post #136
krobertson wrote: post #134

Earlier quoted context omitted.

He clearly violated their Terms Of Service: 5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub. You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later. I love how he punts on the te…

He didn't exploit anything, technically--that's all in the service API. (thanks Rails!) More seriously, just because he violated the ToS doesn't mean that they have to be dicks.

Where have they been dicks? Please elaborate.

From all appearances, GH is taking it quite seriously. Because it is a serious matter. Egor on the other hand wasn't taking it seriously.

Re: Hacked: commit to rails master on GitHub

#144

Post by angersock »

cmelbye wrote: post #127
angersock wrote: post #119

Earlier quoted context omitted.

You've apparently also suspended his account...? ( http://homakov.blogspot.com/2012/03/im-disappoint-github.htm... ) If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).

This sort of behavior shouldn't be rewarded, though. He publicly exploited a 0-day vulnerability. He should've responsibly disclosed it to GitHub, and instead he revealed it to the public.

See here: https://github.com/rails/rails/issues/5228#issuecomment-4290...

This isn't a 0-day vulnerability--this is an issue known to the rails devs, and one which they decided wrongly on. Sometimes you've got to take things to the next level of visibility.

Re: Hacked: commit to rails master on GitHub

#145

Post by davidblondeau »

moe wrote: post #94
wycats wrote: post #44

Here's my proposal for improving the situation: https://gist.github.com/1974187 Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there. Moving it into the controller will also make it easier to solve the tension between reducing the friction of getting up and running quickly and having good security defaults. In general, Rails' conventi…

self-evident It is. The more interesting question is why it takes rails 7 years (and counting) to come to this conclusion. I'll take it one further and sing my song about the Rails ActiveRecord implementation here, which is tangentially related. The promise of AR is to reflect on the database at startup and then "magically work". The problem in rails is that nothing magically works. What you get out of the box is an…

While not mitigating most of the issues you listed, I thought I would mention the awesome https://github.com/ctran/annotate_models plugin in case you did not know about it. I personally could not work on Rails without it.

AR was born with a set of very opinionated decisions. I believe those that prefer a more declarative approach (and built-in identity map) can use DataMapper.

Re: Hacked: commit to rails master on GitHub

#146

Post by danmaz74 »

I would say that homakov's angry and not very mature reaction to his warning being ignored just did a very big favor to a lot of rails developers, that reading about his exploit on HN (and other places) will rush to check their websites and will fix a LOT of serious vulnerabilities they didn't have any idea they had. But which somobody could have already been secretly exploiting.

Understandably, Github would have liked much more to be one of those companies that will be able to quietly fix this vulnerability without anybody knowing, but now that the damage to their image is done I really hope they'll not add to that damage by persisting in their banning of a 18 year old that acted irresponsibly yes, but maliciously - definitely not.

From a PR perspective, I guess that having titles like "Silicon Valley company rewards Russian teenager who helps them eliminating a security risk" could even spin the episode in their favor.

Re: Hacked: commit to rails master on GitHub

#147

Post by winstonm »

Scriptor wrote: post #35
martingordon wrote: post #19

Earlier quoted context omitted.

It's a vulnerability in Rails, which is what GitHub is built on. The vulnerability was demonstrated by adding a commit to the Rails project on GitHub, indicating that GitHub suffers from the vulnerability. Here's the relevant issue. It might clarify things a bit better: https://github.com/rails/rails/issues/5228

The issue seems to be a result of an entire hash of the parameters passed in the request being sent to the new method for models. Is this really common practice in Rails code? Sure you can specify in the model that certain attributes can't be changed. But shouldn't this stuff be checked when validating form input? Normally I'd have a hash of filters, with the field/column name mapped to the appropriate set of rules f…

Yes, mass assignment with Model.new(params) and model.attributes=params is a best practice for professional production Rails websites. Business and security rules for field updates are coded in the model (attr_accessible/attr_protected/validates).

That's how it's been since Rails 1. Which is cool. But it's error-prone for newbies, especially when Rails's model and controller generators make all attrs writeable by default, with nary a generated comment about how or why to lock things down. In a culture of convention over configuration, attrs should be locked down by default: "config.active_record.whitelist_attributes=true" for new apps, and throw a helpful message when I mass assign to a model that has no accessible attrs configured yet.

Re: Hacked: commit to rails master on GitHub

#148

Post by grabastic »

angersock wrote: post #129
grabastic wrote: post #125

Earlier quoted context omitted.

His behavior should not be rewarded.

Why? He didn't cause any harm, disclosed quickly, and only acted after being ignored by the framework community (multiple times, it would seem). It's not even being "rewarded"--it's being "not punished". Wouldn't you like to have people spot vulnerabilities on your site and report them promptly without also breaking things? Seems a little ungrateful, yeah? If we are all going to migrate to the cloud and assume our se…

So if you had a vulnerable product and this gentleman altered one of your customer's pages without permission you would be grateful? That is strange to me.

Re: Hacked: commit to rails master on GitHub

#149

Post by cbs »

cmelbye wrote: post #31
pyre wrote: post #21

Earlier quoted context omitted.

> Responsible disclosure If you look at the bug report, the core Rails Dev Team basically said that they like the defaults the way that they are. They have/had no intention of changing the defaults, and are trying to push responsibility on to the developers using Rails to use sane config settings. Looks like the guy did report it and the response was: "Not our problem" / "Not an issue." He got frustrated and decided…

The Rails team essentially argued that it isn't on them to secure sites built with Rails. Rails provides tools to avoid this, and GitHub chose to not use them, so this is a vulnerability in GitHub. They should be using attr_accessible, and they're not.

The Rails team essentially argued that it isn't on them to secure sites built with Rails.

I'm getting a good laugh seeing this card played to defend terrible practice as the norm for what sells itself as an opinionated framework that champions convention over configuration.

Re: Hacked: commit to rails master on GitHub

#150

Post by Estragon »

So, the vulnerability was public for at least days in homakov's bug report, and probably for years to anyone who wanted a crack at github badly enough to do a little research. Is it paranoid to worry about malicious commits in other important github repositories?
Post reply on HN