Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

151–160 of 240 posts

Re: Hacked: commit to rails master on GitHub

#151

Post by bascule »

patrickaljord wrote: post #57

Funnily, the first Diaspora release had the same issue and the devs were ridiculed and called noobs by a big part of the HN community and security "experts" wrote big posts about it. The different reaction here is interesting to say the least.

Ensuring input is properly validated is always the developer's concern. A framework can make that easier for you, but especially in cases like this, which are basic user authentication concerns, it is ABSOLUTELY the developer's responsibility to be 100% sure how all of those abstractions work and ensure there are no leaks anywhere.

You can't punt on security. Abstractions may make it easier, but you better be damn certain how they work.

Re: Hacked: commit to rails master on GitHub

#152

Post by sirclueless »

vvnraman wrote: post #140
teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

I don't think he can be blamed too much though. As per the bug filed here - https://github.com/rails/rails/issues/5228 , the bug was being closed by others after being given a cursory look, and was being reopened again for consideration. Maybe a little immature, but there was a mild provocation.

Exactly. The guy might not have the best English or highest level of maturity, but it's not like he found a flaw and ran around saying, "Haha, look what I can do!" with no justification.

He submitted a security flaw to the Rails issue tracker. It was shut down by committers saying, "This isn't a real flaw, it's everyone's responsibility to secure their own apps."

At that point, a reasonable response is, "Yes it is, you dummies. Watch as I use it to pwn multiple high-profile production rails sites."

Re: Hacked: commit to rails master on GitHub

#153

Post by cdcarter »

angersock wrote: post #144
cmelbye wrote: post #127

Earlier quoted context omitted.

This sort of behavior shouldn't be rewarded, though. He publicly exploited a 0-day vulnerability. He should've responsibly disclosed it to GitHub, and instead he revealed it to the public.

See here: https://github.com/rails/rails/issues/5228#issuecomment-4290... This isn't a 0-day vulnerability--this is an issue known to the rails devs, and one which they decided wrongly on. Sometimes you've got to take things to the next level of visibility.

It was a 0-day in github allowing malicious code being committed to any project. Egor never (seemingly) took the appropriate steps to inform anyone of this vulnerability in github.

Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties.

Re: Hacked: commit to rails master on GitHub

#154

Post by angersock »

grabastic wrote: post #148
angersock wrote: post #129

Earlier quoted context omitted.

Why? He didn't cause any harm, disclosed quickly, and only acted after being ignored by the framework community (multiple times, it would seem). It's not even being "rewarded"--it's being "not punished". Wouldn't you like to have people spot vulnerabilities on your site and report them promptly without also breaking things? Seems a little ungrateful, yeah? If we are all going to migrate to the cloud and assume our se…

So if you had a vulnerable product and this gentleman altered one of your customer's pages without permission you would be grateful? That is strange to me.

Provided that the he did so and made the change public, and the modification was not malicious?

Yes. I'd even send him a thank-you email, and add him to our list of contributors.

I'd then of course contact the customer (probably over phone, as quickly as possible), explain the vulnerability, explain what happened, and explain how we were fixing it. Then I'd write a post about it, and put it on the front of the site.

That's how you do business.

Re: Hacked: commit to rails master on GitHub

#155

Post by rsynnott »

ceejayoz wrote: post #109
teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

The point, though, is that this is more of a Rails issue than a Github issue. If Github gets it wrong, others are likely to.

Well, it's a beginner-level Rails mistake; it is not precisely an obscure issue. Googling 'attr_accessible' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in Github, though.

Re: Hacked: commit to rails master on GitHub

#156

Post by grabastic »

maratd wrote: post #124
grabastic wrote: post #116

Earlier quoted context omitted.

I am also a paying customer, but I don't feel entitled to a thorough explanation anywhere but through their own official channels... even if one of their employees has chosen to comment here.

> I don't feel entitled to a thorough explanation anywhere but through their own official channels Nor do I. However, there was no indication given that an explanation would be given through official channels. If that indication was made with the "fixed it" comment, trust me, I would have kept my mouth shut and waited.

I read more negativity into your comment than I should have. Apologies.

Re: Hacked: commit to rails master on GitHub

#157

Post by sirclueless »

bascule wrote: post #151
patrickaljord wrote: post #57

Funnily, the first Diaspora release had the same issue and the devs were ridiculed and called noobs by a big part of the HN community and security "experts" wrote big posts about it. The different reaction here is interesting to say the least.

Ensuring input is properly validated is always the developer's concern. A framework can make that easier for you, but especially in cases like this, which are basic user authentication concerns, it is ABSOLUTELY the developer's responsibility to be 100% sure how all of those abstractions work and ensure there are no leaks anywhere. You can't punt on security. Abstractions may make it easier, but you better be damn ce…

That said, when your tools generate an insecure scaffold by default with no easy path to discovery on how to fix it, your tools do have a security flaw as well.

You can't expect all of the developers in the world to be literate in security, especially the ones who choose batteries-included web frameworks as their go-to.

Re: Hacked: commit to rails master on GitHub

#158

Post by thibaut_barrere »

rsynnott wrote: post #155
ceejayoz wrote: post #109

Earlier quoted context omitted.

The point, though, is that this is more of a Rails issue than a Github issue. If Github gets it wrong, others are likely to.

Well, it's a beginner-level Rails mistake; it is not precisely an obscure issue. Googling 'attr_accessible' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in Github, though.

It's a beginner-level Rails mistake but it's very widely seen in codebases: it's a real, common threat.

Re: Hacked: commit to rails master on GitHub

#159

Post by thibaut_barrere »

judofyr wrote: post #141
thibaut_barrere wrote: post #75

Earlier quoted context omitted.

My thoughts exactly: the "asshole" is 18. People should give him a break already, and consider we're lucky he's getting the word out.

I think it's perfectly fine to not "give him a break." How else is he going to learn manners?

How else? By showing him how to securely disclose similar issues, for example.

Having the whole internet bashing him isn't good for anyone.

I'm for one very glad he kept pushing it out (but didn't do any real harm). This kind of vulnerability is just so common in Rails apps: I'd like to see safer defaults.

Re: Hacked: commit to rails master on GitHub

#160

Post by angersock »

cdcarter wrote: post #153
angersock wrote: post #144

Earlier quoted context omitted.

See here: https://github.com/rails/rails/issues/5228#issuecomment-4290... This isn't a 0-day vulnerability--this is an issue known to the rails devs, and one which they decided wrongly on. Sometimes you've got to take things to the next level of visibility.

It was a 0-day in github allowing malicious code being committed to any project. Egor never (seemingly) took the appropriate steps to inform anyone of this vulnerability in github. Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties.

He'd already been ignored by the rails devs.

For a normal project, sure, whatever, but when the security hole is in a framework--especially one as widely deployed as rails--you eventually must cede that, yeah, the fastest way to get something serious fixed is to do a public exploit.

What if he'd submitted the fix to github and they'd quietly patched it and said nothing? What if they'd said something but nobody cared because hey, it's fixed now? What if they'd flat-out ignored it as the rails devs did (perhaps even citing that as their reason)?

No, security only reliably gets addressed when it hurts and hurts publicly.

The combination of hitting the exploit on perhaps the most visible site for the target audience and doing so in a way that didn't harm anything is impressive.

Post reply on HN