Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

151–160 of 205 posts

Re: GitHub and Rails: You have let us all down.

#151

Post by kamaal »

maratd wrote: post #139
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

> and how they should never have had such a vulnerable bug in the first place is even worse. Bugs happen. Even stupid oh-my-god-i-can't-believe-i-did-that bugs happen. And they happen to the best of us. However , when someone reports a vulnerability about my code to me or I discover a problem myself, the very first thing I do is break out the grep. I grep the shit out of my code. Because I am a human being. I am a cr…

I don't think anything will happen to Github or even Rails users. There user base will not likely decrease.It will increase infact.

More importantly people reading this forum are very scanty in the larger picture of people writing software around the world. Software and tools get used in 99% of cases for average programmers because of jobs,popularity and usability reasons.

I bet of all the Rails programmers, and Git hub users very few would have heard the news. And of those few who have heard it very few would understand the seriousness of the issue.

The only benefit that has come out of this, is a serious problem has been averted. If this vulnerability had been discovered by some body who makes his bread and butter cracking systems. He could have done a great deal of damage to a lot of systems.

Lets hope that Rails finds and fixes these sort of vulnerabilities. To avoid bigger problems in the future.

Re: GitHub and Rails: You have let us all down.

#152

Post by rogerbinns »

zalew wrote: post #148
rogerbinns wrote: post #127

Earlier quoted context omitted.

What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.) On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the…

> What makes you think they are saints? What makes you think I think that?

You suggested bitbucket as an alternative to the github the thread starter had lost trust in.

Re: GitHub and Rails: You have let us all down.

#153

Post by InclinedPlane »

kamaal wrote: post #142
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

You are not getting the point about this situation. The rants that are coming in are not about what has happened, but what could have happened. Imagine a situation if somebody had deleted all the data or worse committed malicious code to important repos. And then used it create a bigger mess later it would have been disastrous. If this can't be taken seriously I don't know what can be.

What exactly would you require to have happened to demonstrate that github was taking the problem "seriously" enough?

Should they have shut down github.com entirely. Tweeted in all caps every 15 minutes until they fixed the problem? Called a televised press conference? What?

Re: GitHub and Rails: You have let us all down.

#154

Post by trotsky »

maratd wrote: post #139
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

> and how they should never have had such a vulnerable bug in the first place is even worse. Bugs happen. Even stupid oh-my-god-i-can't-believe-i-did-that bugs happen. And they happen to the best of us. However , when someone reports a vulnerability about my code to me or I discover a problem myself, the very first thing I do is break out the grep. I grep the shit out of my code. Because I am a human being. I am a cr…

They should have burned the midnight oil and made sure the same problem wasn't prevalent in other parts of the code.

I understand that's the feeling here, but it's unrealistic. I've reported dozens of bugs to shops that ranged in size from 1 to borg. You simply never see a whole set of bugs fixed and pushed live over a weekend. Not even close. Exactly what company have you seen set this standard for professional? The smallest amount of time between notification and public disclosure I've seen get called responsible disclosure is a month. Many, many, many enterprises take six months or longer to push fixes (which is far too long but that's another whole discussion)

Re: GitHub and Rails: You have let us all down.

#155

Post by [deleted] »

kamaal wrote: post #142
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

You are not getting the point about this situation. The rants that are coming in are not about what has happened, but what could have happened. Imagine a situation if somebody had deleted all the data or worse committed malicious code to important repos. And then used it create a bigger mess later it would have been disastrous. If this can't be taken seriously I don't know what can be.

[deleted]

Re: GitHub and Rails: You have let us all down.

#156

Post by maratd »

elithrar wrote: post #17
ricardobeat wrote: post #12

Earlier quoted context omitted.

People use services like GitHub because they provide security, reliability, uptime, protection against hw failure, centralized issues and patches, and so on. If we have to worry about each of these on our pwn, what's the point?

> If we have to worry about each of these on our pwn, what's the point? You should always have to worry about these things, regardless of who's hosting things. It just so happens that Github, to date, has been checking the boxes in these areas and has established a reputation for doing so. But, if GitHub losing your repo/having it trashed beyond repair will kill your project (or severely hamper it), the cost of setti…

That's not how git works. I have the entire repo locally. If I didn't, I wouldn't be able to commit anything. So if Github goes poof, I'd be pissed, but I wouldn't lose a single line of code. I would obviously lose things like issues/wiki. Actually, it would be pretty cool if Github turned issues/wiki into some sort of git repo of markdown files and allow me to pull them and commit to them. Something for them to think about =)

Re: GitHub and Rails: You have let us all down.

#157

Post by kamaal »

InclinedPlane wrote: post #153
kamaal wrote: post #142

Earlier quoted context omitted.

You are not getting the point about this situation. The rants that are coming in are not about what has happened, but what could have happened. Imagine a situation if somebody had deleted all the data or worse committed malicious code to important repos. And then used it create a bigger mess later it would have been disastrous. If this can't be taken seriously I don't know what can be.

What exactly would you require to have happened to demonstrate that github was taking the problem "seriously" enough? Should they have shut down github.com entirely. Tweeted in all caps every 15 minutes until they fixed the problem? Called a televised press conference? What?

Well I didn't blame Github, did I?

I'm just pointing out the seriousness of the situation.

Punishing Egor Homakov in this case is a classic example of 'No good deed goes unpunished'. Had this vulnerability been found by somebody with evil on his mind. We would be having a very different debate now.

We all make mistakes. And I don't really blame Github for this. But we must at no cost downplay this incident.

And discussing about this will only do good.

Re: GitHub and Rails: You have let us all down.

#158

Post by [deleted] »

[deleted] wrote: post #155
kamaal wrote: post #142

Earlier quoted context omitted.

You are not getting the point about this situation. The rants that are coming in are not about what has happened, but what could have happened. Imagine a situation if somebody had deleted all the data or worse committed malicious code to important repos. And then used it create a bigger mess later it would have been disastrous. If this can't be taken seriously I don't know what can be.

[deleted]

[deleted]
Post reply on HN