Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I hacked Github again

homakov.blogspot.com

Post reply on HN
Print view View original

171–180 of 202 posts

Re: How I hacked Github again

#171

Post by tripzilch »

codygman wrote: post #150
jbinto wrote: post #85

Earlier quoted context omitted.

> Infosec is hard. In computer security, you have to get it right every single time. The bad guys only need to get it right once.

What opinions does infosec in general have of correctness? What about languages like Haskell which focus on separating IO and pure functions?

well it gives the advantage that (used to?) keep desktop-Linux clear of most viruses: it's too little a fish for blackhats to go after.

until that's different it's harder to answer your actual question. my guess, it'll be better but inevitably still have some holes.

Re: How I hacked Github again

#173

Post by 66d8kk »

Kudos wrote: post #106
GuiA wrote: post #101

Earlier quoted context omitted.

I don't get why Github just hasn't hired the guy already.

In his earlier work at least, he's seemed like a loose cannon.

I'm incredibly interested in angling my career towards security and have no real experience.

Wouldn't it also be wise to keep people like him 'out of the loop', I imagine it's much harder to audit when they have access to internal code/architecture that would be difficult for an outsider to stumble-upon?

Re: How I hacked Github again

#174

Post by [deleted] »

igorhvr wrote: post #155
Kudos wrote: post #106

Earlier quoted context omitted.

In his earlier work at least, he's seemed like a loose cannon.

I don't think that is a fair assessment of him, even then. At any case, I hired him fairly recently for a security audit and he worked quickly, and was very effective (he found several important vulnerabilities and reported them in a crystal clear manner). He was also a pleasure to deal with (no bullshit stance, something I find enjoyable). The 4000 USD for ~20 hours of work were definitely well spent!

[deleted]

Re: How I hacked Github again

#175

Post by uloweb »

homakov wrote: post #71
zaidf wrote: post #59

Earlier quoted context omitted.

Ah. How did you get the motivation now? How long did it take to find these bugs?

They launched bounty, this was the motivation to check things i always wanted to check. It took me about 4-5 hours, most of that time I was watching TV shows.

almost $1000/hour for watching TV shows.. nice job)

Re: How I hacked Github again

#176

Post by mpeg »

jqueryin wrote: post #26

If @homakov is finding security holes without access to Github repositories, imagine what he'd find if you had him code audit for a few days... He's clearly been going about this the proper white-hat way and ensuring holes are patched before open disclosure... what's there to lose? On the flip side, you could go about doing what you're doing under the presumption nobody is maliciously targeting your user base. In thi…

But hiring him offers no guarantee that he will be able to find any other bugs.

That's the beauty of bounties, it allows people to decide whether they want to do the right thing or not, if there was no bug bounty more people are just tempted to exploit the bug.

Re: How I hacked Github again

#177

Post by Einstalbert »

interstitial wrote: post #91

Half the comments are about his pay scale, imagine the ruckus if he had been paid in unwithdrawable bitcoins at mtgox.

$400 is such chump change compared to the PR disaster that can come from exploited, or even just leaked, vulnerabilities. I honestly think any SaaS needs to have this somewhere in their budget once a year.

Re: How I hacked Github again

#178

Post by abcd_f »

ojr wrote: post #161
GuiA wrote: post #101

Earlier quoted context omitted.

I don't get why Github just hasn't hired the guy already.

he gets paid $400/hr doing consulting for YC Companies and other startups and companies, he is from Russia, and now lives in Bangkok, when he becomes rich he wants to live in Hong Kong, pretty nice for a 20 year old, I don't see any glaring reasons to work for Github http://egorhomakov.com/

$400/hr is meaningless if comes from an one-off gig.

Re: How I hacked Github again

#179

Post by Kudos »

homakov wrote: post #149
Kudos wrote: post #106

Earlier quoted context omitted.

In his earlier work at least, he's seemed like a loose cannon.

There was 2 or 3 cases I regret about. The rest of my work is alright and responsible, no?

Yeah, the first Github and Rails exploit is the one that still sticks out in my mind. That kind of thing can be hard to shake, but it helps that you were quite young at the time. I'm happy to see you've matured a lot since then.

Re: How I hacked Github again

#180

Post by Kiro »

homakov wrote: post #55
enscr wrote: post #48

Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…

///host.com bug is not well documented. It's "0day" for most of websites.

How did you find out about it?
Post reply on HN