Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I hacked Github again

homakov.blogspot.com

Post reply on HN
Print view View original

161–170 of 202 posts

Re: How I hacked Github again

#161

Post by ojr »

GuiA wrote: post #101
jqueryin wrote: post #26

If @homakov is finding security holes without access to Github repositories, imagine what he'd find if you had him code audit for a few days... He's clearly been going about this the proper white-hat way and ensuring holes are patched before open disclosure... what's there to lose? On the flip side, you could go about doing what you're doing under the presumption nobody is maliciously targeting your user base. In thi…

I don't get why Github just hasn't hired the guy already.

he gets paid $400/hr doing consulting for YC Companies and other startups and companies, he is from Russia, and now lives in Bangkok, when he becomes rich he wants to live in Hong Kong, pretty nice for a 20 year old, I don't see any glaring reasons to work for Github http://egorhomakov.com/

Re: How I hacked Github again

#162

Post by dfc »

jbinto wrote: post #85
vezzy-fnord wrote: post #58

Earlier quoted context omitted.

As briefly as possible? Infosec is hard. Most companies have virtually no security policies. Nobody listens. Black hats are ahead in the arms race and anyone who has decent knowledge (doesn't even have to be anywhere near on a level like Homakov or Zalewski) can pull off all sorts of exploits. Even if they don't strike the application itself, they'll get you through infrastructure that your application relies on. Loo…

> Infosec is hard. In computer security, you have to get it right every single time. The bad guys only need to get it right once.

This is a little myopic but understandable in the context of a discussion on HN. Infosec is hard, but it is just one example of a bigger truth:

Defense is hard.

This comes up time and time again in any defensive discipline:

  Over two decades the  CIA had learned again and again that it  could not hope to
  defend against  terrorists by relying solely  on its ability to  detect specific
  attacks in  advance. No matter how many  warnings they picked up,  no matter how
  many  terrorist cells  they disrupted,  at least  some attackers  were going  to
  get  through. Officers  in  the  CTC privately  compared  themselves  to  soccer
  goalies: They wanted to  be the best in  their league, they wanted  to record as
  many shutouts as  possible, but they knew  they were going to give  up scores to
  their  opponents. Ultimately, many  of them  believed,  the only  way to  defeat
  terrorists was to get out of the net and try to take the enemy off the field.[1]
The final sentence above highlights the one pecularity of InfoSec; you do not have any offensive capabilities.

[1]: "Ghost Wars" (Steve Coll) pg 505

Re: How I hacked Github again

#163

Post by nowarninglabel »

erichocean wrote: post #152
dasil003 wrote: post #133

Earlier quoted context omitted.

It's a dream job for developers, in some ways a lot more so than the big boys like Google and Facebook. They have a hiring pipeline any tech company would kill for. They probably don't have the deep security talent that say Google or Microsoft have, but they should have enough.

It's a dream job for developers Really? I'm not so sure, AFAICT Github doesn't have any new or interesting problems to deal with. It's just a Rails app that's constantly developed on. You can do that, well, anywhere.

Having met several of them and spent a day in their offices (they gave Kiva engineering a tour day a couple years back), I can say they have an awesome company culture and space and great leadership and great brand recognition. Plus, people generally like them. I'd put it near the top of my list if I had one.

Re: How I hacked Github again

#164

Post by lostlogin »

phillmv wrote: post #137
ultimoo wrote: post #63

@homakov finds 5 different bugs with github and manages to align them so that a bigger vulnerability is exposed in under 5 hours ? That's amazing! I used to think I'm a fast delivery-focused developer but I'm probably just a fraction of how fast some people are.

He's not counting all the time he's spent carefully reading the oauth spec and playing with different options ;).

Or the time he spent learning to get to the level of expertise he has. Maybe that is why his hourly rate is somewhat more than mine.

Re: How I hacked Github again

#165

Post by Fogest »

ProAm wrote: post #103
VBprogrammer wrote: post #100

Earlier quoted context omitted.

I'm pretty sure many more codebases have been lost through failures to secure internal networks by corporate IT departments than through vulnerabilities in cloud hosting providers.

I agree. I was speaking more about security than we blew up our own code repository. Everyone has the ability to light their own house on fire.

I think he is referring to many people failing to secure their networks and having code stolen. It can be just as insecure, if not worse than a cloud provider if done wrong.

Re: How I hacked Github again

#166

Post by cenhyperion »

ProAm wrote: post #86
chimeracoder wrote: post #76

Earlier quoted context omitted.

If you're talking about for company projects, the enterprise version of Github is self-hosted (e.g. on a VPN): https://enterprise.github.com/

People shouldn't trust the cloud for important source storage. Always self-host anything you want to keep private.

For code projects that are between me and a couple of other devs, none of whom are infrastructure security experts, I trust a company like Github a lot more than one of us trying to hack something together on a server.

Re: How I hacked Github again

#167

Post by allochthon »

ultimoo wrote: post #63

@homakov finds 5 different bugs with github and manages to align them so that a bigger vulnerability is exposed in under 5 hours ? That's amazing! I used to think I'm a fast delivery-focused developer but I'm probably just a fraction of how fast some people are.

This guy is like a good security QA guy on steroids.

Re: How I hacked Github again

#168

Post by jethro_tell »

cenhyperion wrote: post #166
ProAm wrote: post #86

Earlier quoted context omitted.

People shouldn't trust the cloud for important source storage. Always self-host anything you want to keep private.

For code projects that are between me and a couple of other devs, none of whom are infrastructure security experts, I trust a company like Github a lot more than one of us trying to hack something together on a server.

With the exception that if you have three guys hacking something together a dedicated server or a box off your cable modem, with git tunneled over ssh using keys and a proper firewall, you'd probably be miles ahead. That might take you an afternoon to set up with almost no experience.

Not to say that it couldn't be compromised, but your not a target like github might be. If you're working with an enterprise level project with more complex auth and access methods, more users, performance and scaling needs, you'd need a real security implementation.

Post reply on HN