Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

161–170 of 240 posts

Re: Hacked: commit to rails master on GitHub

#161

Post by elithrar »

cdcarter wrote: post #153
angersock wrote: post #144

Earlier quoted context omitted.

See here: https://github.com/rails/rails/issues/5228#issuecomment-4290... This isn't a 0-day vulnerability--this is an issue known to the rails devs, and one which they decided wrongly on. Sometimes you've got to take things to the next level of visibility.

It was a 0-day in github allowing malicious code being committed to any project. Egor never (seemingly) took the appropriate steps to inform anyone of this vulnerability in github. Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties.

> Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties.

100% agree here. The Rails devs may have ignored his issue, but GitHub are the victims here. Why not email GitHub and inform them, on the provision they communicate the fix they just made?

Doing this and saying "P.S. GH sorry, I was bored" is not acceptable.

Re: Hacked: commit to rails master on GitHub

#162

Post by grabastic »

angersock wrote: post #154
grabastic wrote: post #148

Earlier quoted context omitted.

So if you had a vulnerable product and this gentleman altered one of your customer's pages without permission you would be grateful? That is strange to me.

Provided that the he did so and made the change public, and the modification was not malicious? Yes. I'd even send him a thank-you email, and add him to our list of contributors. I'd then of course contact the customer (probably over phone, as quickly as possible), explain the vulnerability, explain what happened, and explain how we were fixing it. Then I'd write a post about it, and put it on the front of the site.…

"Hey customer, someone hacked your page thanks to a vulnerability in my service, but don't worry... I've added him as a contributor to my project and sent him a thank you email."

Like that?

Re: Hacked: commit to rails master on GitHub

#163

Post by tylermenezes »

krobertson wrote: post #134
angersock wrote: post #119

Earlier quoted context omitted.

You've apparently also suspended his account...? ( http://homakov.blogspot.com/2012/03/im-disappoint-github.htm... ) If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).

He clearly violated their Terms Of Service: 5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub. You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later. I love how he punts on the te…

First he submitted a bug, and they closed it.

Then, he reopened the bug to prove it was a bug, and they closed it again.

Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)"

Then, he committed a text document to master, and they got all upset about it and got Github staff involved.

How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to make things simple? Yet, somehow, making rational default choices only applies to everything but this. I know that you love to feel better than everyone else (see: http://37signals.com/svn/posts/3124-give-it-five-minutes), but seriously, you shouldn't get all upset about it later when it turns out you're wrong.

This is why I refuse to learn Ruby. I don't want to be associated with that community. "Learn Ruby if you want to be associated with a bunch of people who call themselves Rockstar Programmers."

Re: Hacked: commit to rails master on GitHub

#164

Post by codesuela »

I don't get how many of you seem to take this issue lightly. Imagine what would've happened if this guy was a black hat. I use github for private code hosting and this a definite breach of trust and if I don't trust github how can I pay them? Sure they fixed the issue within an hour but still this could have ended far worse.

Re: Hacked: commit to rails master on GitHub

#165

Post by Mikushi »

grabastic wrote: post #148
angersock wrote: post #129

Earlier quoted context omitted.

Why? He didn't cause any harm, disclosed quickly, and only acted after being ignored by the framework community (multiple times, it would seem). It's not even being "rewarded"--it's being "not punished". Wouldn't you like to have people spot vulnerabilities on your site and report them promptly without also breaking things? Seems a little ungrateful, yeah? If we are all going to migrate to the cloud and assume our se…

So if you had a vulnerable product and this gentleman altered one of your customer's pages without permission you would be grateful? That is strange to me.

Well, if like in this case, he warned me and I told him to "fuck off", I kinda would be grateful, even more like "Should've seen that one coming...".

Re: Hacked: commit to rails master on GitHub

#166

Post by angersock »

tylermenezes wrote: post #163
krobertson wrote: post #134

Earlier quoted context omitted.

He clearly violated their Terms Of Service: 5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub. You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later. I love how he punts on the te…

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

whoa whoa whoa

Ruby is a really cool language with some fascinating features--don't limit yourself by assuming that you also have to learn the Rails stuff.

Seriously, give it a shot in one of its more palatable forms.

Re: Hacked: commit to rails master on GitHub

#167

Post by subdigital »

tylermenezes wrote: post #163
krobertson wrote: post #134

Earlier quoted context omitted.

He clearly violated their Terms Of Service: 5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub. You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later. I love how he punts on the te…

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

I think you're confusing Ruby with Rails. Flat out refusing to learn a wonderful programming language because you don't agree with it's dominant web framework is silly.

Re: Hacked: commit to rails master on GitHub

#168

Post by sounds »

sirclueless wrote: post #152
vvnraman wrote: post #140

Earlier quoted context omitted.

I don't think he can be blamed too much though. As per the bug filed here - https://github.com/rails/rails/issues/5228 , the bug was being closed by others after being given a cursory look, and was being reopened again for consideration. Maybe a little immature, but there was a mild provocation.

Exactly. The guy might not have the best English or highest level of maturity, but it's not like he found a flaw and ran around saying, "Haha, look what I can do!" with no justification. He submitted a security flaw to the Rails issue tracker. It was shut down by committers saying, "This isn't a real flaw, it's everyone's responsibility to secure their own apps." At that point, a reasonable response is, "Yes it is, y…

Although it's risky to impute motives, I really think it was intentional that he pwned...

_rails_ _git_ _master_

Re: Hacked: commit to rails master on GitHub

#169

Post by cmelbye »

angersock wrote: post #144
cmelbye wrote: post #127

Earlier quoted context omitted.

This sort of behavior shouldn't be rewarded, though. He publicly exploited a 0-day vulnerability. He should've responsibly disclosed it to GitHub, and instead he revealed it to the public.

See here: https://github.com/rails/rails/issues/5228#issuecomment-4290... This isn't a 0-day vulnerability--this is an issue known to the rails devs, and one which they decided wrongly on. Sometimes you've got to take things to the next level of visibility.

This is NOT a vulnerability in Rails. If you've ever used Rails, you'll probably be aware that it has several features for preventing things like this from happening (attr_accessible, attr_protected, etc). GitHub failed to use those methods, so it's a vulnerability in GitHub. All sites powered by Rails are not necessarily vulnerable to this, only ones that have not been properly coded using the aforementioned security features.

Re: Hacked: commit to rails master on GitHub

#170

Post by nwmcsween »

tylermenezes wrote: post #163
krobertson wrote: post #134

Earlier quoted context omitted.

He clearly violated their Terms Of Service: 5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub. You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later. I love how he punts on the te…

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

"This is why I refuse to learn Ruby. I don't want to be associated with that community. "Learn Ruby if you want to be associated with a bunch of people who call themselves Rockstar Programmers.""

You refuse to learn a language due to how a project acts? Have you ever read the {open,free,net}BSD or Linux mailing lists? You're not going to make it far in software development with an attitude like that.

Post reply on HN