Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

181–190 of 240 posts

Re: Hacked: commit to rails master on GitHub

#181

Post by drogus »

tylermenezes wrote: post #163
krobertson wrote: post #134

Earlier quoted context omitted.

He clearly violated their Terms Of Service: 5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub. You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later. I love how he punts on the te…

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

tylermenezes: the first "closed/open" thing was done by accident, @homakove didn't reopen it. I closed the second bug as this was just kind of trolling to get attention, there was no point on keeping it open.

Re: Hacked: commit to rails master on GitHub

#182

Post by angersock »

cmelbye wrote: post #169
angersock wrote: post #144

Earlier quoted context omitted.

See here: https://github.com/rails/rails/issues/5228#issuecomment-4290... This isn't a 0-day vulnerability--this is an issue known to the rails devs, and one which they decided wrongly on. Sometimes you've got to take things to the next level of visibility.

This is NOT a vulnerability in Rails. If you've ever used Rails, you'll probably be aware that it has several features for preventing things like this from happening (attr_accessible, attr_protected, etc). GitHub failed to use those methods, so it's a vulnerability in GitHub. All sites powered by Rails are not necessarily vulnerable to this , only ones that have not been properly coded using the aforementioned securi…

"Buffer overflows are not a vulnerability in C. If you've ever used C, you'll probably be aware that has several features for preventing things like this from happening (strlen_s, memmove, etc.). Microsoft failed to use those methods, so it's a vulnerability in Microsoft. All apps powered by C are not necessarily vulnerable to this, only ones that have not been properly coded using the aforementioned security features."

And yet, people have stopped using C for a lot of things because of the security implications...

Look, when Rails is pushed as an out-of-the-box magic web stack--and it is--, and the out-of-the-box config has these problems available--which seems to be the case--maybe there is something to be said for the framework needing fixing.

Just because I can write code that prevents various exploits does not mean I expect the rest of the world to--and I sure as hell don't do so while brandishing about how even beginners can use my tools.

Re: Hacked: commit to rails master on GitHub

#183

Post by patrickaljord »

patrickaljord wrote: post #57

Funnily, the first Diaspora release had the same issue and the devs were ridiculed and called noobs by a big part of the HN community and security "experts" wrote big posts about it. The different reaction here is interesting to say the least.

This is how we do it by the way http://news.ycombinator.com/item?id=3664365

Re: Hacked: commit to rails master on GitHub

#184

Post by grabastic »

angersock wrote: post #176
grabastic wrote: post #162

Earlier quoted context omitted.

"Hey customer, someone hacked your page thanks to a vulnerability in my service, but don't worry... I've added him as a contributor to my project and sent him a thank you email." Like that?

More like: "Dear Grabastic, Today we had a demonstration by a user (xxx) of a security vulnerability on our site. ${VULNERABILITY_EXPLANATION} We believe that it is possible that your application or records are covered in the scope of the exploit, because of the fact that ${VULNERABILITY_APPLICATION}. In order to fix this issue, we have ${VULNERABILITY_PATCH}. We have thanked this user for their vigilance in spotting…

Not bad. You won me over. :)

Re: Hacked: commit to rails master on GitHub

#185

Post by mofey »

vvnraman wrote: post #140
teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

I don't think he can be blamed too much though. As per the bug filed here - https://github.com/rails/rails/issues/5228 , the bug was being closed by others after being given a cursory look, and was being reopened again for consideration. Maybe a little immature, but there was a mild provocation.

Hey, how come there are no comments by @dhh and @josevalim? Are we missing out on epicness of zedshaw-level?

Re: Hacked: commit to rails master on GitHub

#186

Post by hundredwatt »

I threw together a quick 'n dirty Rails generator that will generate the code for white/black listing all model attributes with attr_accessible/attr_protected.

Here's the file: https://gist.github.com/1975167, just add to lib/generators in your Rails 3 app, then do rails g mass_assignment_security -h

Hopefully others find this helpful

Re: Hacked: commit to rails master on GitHub

#188

Post by derekprior »

nfm wrote: post #107
wycats wrote: post #44

Here's my proposal for improving the situation: https://gist.github.com/1974187 Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there. Moving it into the controller will also make it easier to solve the tension between reducing the friction of getting up and running quickly and having good security defaults. In general, Rails' conventi…

I don't have a well-formed opinion on this, but how would you propose handling nested attributes if mass assignment protection was managed in the controller?

How about a nested hash of attributes?

class PostsController attr_accessible: :title, :body, :related_links => { :href, :title } end

This would accept the attributes: post_title, post_body, post_related_links_0_href, post_related_links_0_title, posts_related_ink_1...

The names might not be right. I forget exactly how rails names fields. But you get the point, yes?

Re: Hacked: commit to rails master on GitHub

#189

Post by patrickaljord »

wycats wrote: post #178
tylermenezes wrote: post #163

Earlier quoted context omitted.

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

Not all security vulnerabilities can be protected automatically by a web framework. In many cases, frameworks provide features that developers can use themselves to secure their applications. Example: XSS is a common web security problem. In short, it means that putting user-originated data back on the page unescaped is unacceptable. Before Rails 3.0, the Rails approach to this problem was to provide a helper ( h ),…

What do you think of doing it this way http://blog.ricodigo.com/blog/2012/03/04/an-alternative-to-a...?

Re: Hacked: commit to rails master on GitHub

#190

Post by masklinn »

angersock wrote: post #166
tylermenezes wrote: post #163

Earlier quoted context omitted.

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

whoa whoa whoa Ruby is a really cool language with some fascinating features--don't limit yourself by assuming that you also have to learn the Rails stuff. Seriously, give it a shot in one of its more palatable forms.

> with some fascinating features

If you come from PHP or Java anyway.

Post reply on HN