GitHub and Rails: You have let us all down. • Hacker News Board

Re: GitHub and Rails: You have let us all down.

#161

Post by kamaal » Mon, Mar 05, 2012, 5:37 AM UTC

InclinedPlane wrote: post #150

trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

I was on Egor's end of a similar incident back in my more impulsive years. I wasn't treated quite as well as he was but even so I eventually came around to the realization that being overly confrontational is never the right way to gain attention for security issues (even though it did result in the issue being fixed rather quickly).

After reading all this including your story,Personally I will never report any security or other incident to anybody(If I happen to find one).

Because no good deed goes unpunished. No one appreciates what good caused by your help.

It just bruises peoples egos and they violently lynch you for 'How dare you point a mistake at a genius like me, you should have tried whispering in my year'.

Its for incidents like this people refuse to help in not just security situations but also in emergency situations because you get entangled in unnecessary mess. People just let the world burn.

Re: GitHub and Rails: You have let us all down.

#162

Post by openbear » Mon, Mar 05, 2012, 6:02 AM UTC

reustle wrote: post #160

technoweenie wrote: post #109

Earlier quoted context omitted.

It's a fake.

Citation needed

Not sure if technoweenie was trolling or not, but Homakov said on Twitter "That tattoo is kind of fake made with henna".

http://twitter.com/#!/homakov/status/176476394455437312

"Thank you all,sweethearts! For support, and shit too. One more thing to clarify. That tattoo is kind of fake made with henna. eat vegetables"

Re: GitHub and Rails: You have let us all down.

#163

Post by yxhuvud » Mon, Mar 05, 2012, 7:07 AM UTC

kamaal wrote: post #161

InclinedPlane wrote: post #150

Earlier quoted context omitted.

I was on Egor's end of a similar incident back in my more impulsive years. I wasn't treated quite as well as he was but even so I eventually came around to the realization that being overly confrontational is never the right way to gain attention for security issues (even though it did result in the issue being fixed rather quickly).

After reading all this including your story,Personally I will never report any security or other incident to anybody(If I happen to find one). Because no good deed goes unpunished. No one appreciates what good caused by your help. It just bruises peoples egos and they violently lynch you for 'How dare you point a mistake at a genius like me, you should have tried whispering in my year'. Its for incidents like this pe…

Reporting security flaws is fine.

Doing it by demonstration on a live product without asking first is not as fine.

Re: GitHub and Rails: You have let us all down.

#164

Post by aneth » Mon, Mar 05, 2012, 7:14 AM UTC

The response to this makes me feel that HackerNews is now populated by a bunch of pretenders. This "bug" has been in Rails since Day 1, and any remotely experienced Rails developer is aware of this functionality. You can argue for a different default, but it's not a bug.

Github did have a bug and noone knowledgeable about Rails appears to have made even a cursory inspection of the security of their controllers - which is where attribute protection actually belongs, since different controllers and different users change different attributes. Protected attributes is a blunt tool for simple situations, which is why it's not enabled by default. Github had a pretty terrible bug, discovered, and fixed it. They may not have handled it perfectly, but the certainly don't deserve this sort of mon hatred - any competitor you go to is likely to have security flaws as well, perhaps more severe and subtle.

@homako didn't just expose the bug in github, he exploited it to make an unauthorized commit to Rails master. His account most certainly should have been at least temporarily suspended as GitHub had no idea what else he might do to prove his point.

So basically, most of the comments here are glaringly wrong or ignorant bandwagoning, and it makes me wonder about the accuracy of information here about topics I'm less familiar with. A sad day when you realize all this intelligent discussion you thought you'd been reading about new topics was probably just grandstanding by eloquent fools.

Re: GitHub and Rails: You have let us all down.

#165

Post by masklinn » Mon, Mar 05, 2012, 7:21 AM UTC

trotsky wrote: post #136

reidmain wrote: post #133

Earlier quoted context omitted.

Correct me if I'm wrong but this wasn't a "zero day". This issue was brought up four days ago https://github.com/rails/rails/issues/5228

I thought there were two different issues, though not being a rails jockey I could easily be mistaken. Even if it was disclosed four days before it was exploited I stand by my take if not my terminology.

> I thought there were two different issues

Nope, this bug is exactly what he used for his demonstration (and there are warnings about attr_accessible going back 3 or 4 years, so it's not a "0-day" by most accounts, more of a "3-years"" vuln)

Re: GitHub and Rails: You have let us all down.

#166

Post by jsnell » Mon, Mar 05, 2012, 7:21 AM UTC

raganwald wrote: post #125

As Zed Shaw pointed out, someone appearing to be Homakov has posted a comment dating back eight years . Is Posterous vulnerable as well? If so, that may not be Homakov, of course, but his twitter comments are consistent with him posting it. https://twitter.com/zedshaw/status/176497720817762304

Yes, one of Egor's comments in the github bugtracker had a small (but presumably not exhaustive) list of other vulnerable sites. It included Posterous.

Re: GitHub and Rails: You have let us all down.

#167

Post by InclinedPlane » Mon, Mar 05, 2012, 7:25 AM UTC

yxhuvud wrote: post #163

kamaal wrote: post #161

Earlier quoted context omitted.

After reading all this including your story,Personally I will never report any security or other incident to anybody(If I happen to find one). Because no good deed goes unpunished. No one appreciates what good caused by your help. It just bruises peoples egos and they violently lynch you for 'How dare you point a mistake at a genius like me, you should have tried whispering in my year'. Its for incidents like this pe…

Reporting security flaws is fine. Doing it by demonstration on a live product without asking first is not as fine.

"Houses aren't very secure, here's a video of me picking the lock on my own front door."

"I demonstrated how insecure your house is by picking the front door lock and leaving a note on your bed."

Sometimes it can be difficult to have the empathy and perspective to see how frightening and unconscionable the 2nd action can be, but it very much is.

Re: GitHub and Rails: You have let us all down.

#168

Post by meow » Mon, Mar 05, 2012, 7:41 AM UTC

For me the sad part is that there is an almost even split between people arguing the right way to bring this issue to every ones notice. I think this is the perfect way to show how serious the issue is and to get more sites to adopt the fix.

Exploits like this are worth a lot on black market. They are worth even more if you provide a precious and vulnerable target to go along (github).

Re: GitHub and Rails: You have let us all down.

#169

Post by jcoder » Mon, Mar 05, 2012, 7:50 AM UTC

batista wrote: post #108

dangrossman wrote: post #74

Earlier quoted context omitted.

I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops. It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; i…

I prefer to pay someone to host the private repos. Yeah, and people payed GitHub to host their private repos --how did that go?

It's going _just fine_.

Re: GitHub and Rails: You have let us all down.

#170

Post by [deleted] » Mon, Mar 05, 2012, 7:52 AM UTC

masklinn wrote: post #165

trotsky wrote: post #136

Earlier quoted context omitted.

I thought there were two different issues, though not being a rails jockey I could easily be mistaken. Even if it was disclosed four days before it was exploited I stand by my take if not my terminology.

> I thought there were two different issues Nope, this bug is exactly what he used for his demonstration (and there are warnings about attr_accessible going back 3 or 4 years, so it's not a "0-day" by most accounts, more of a "3-years"" vuln)

[deleted]