Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

181–190 of 205 posts

Re: GitHub and Rails: You have let us all down.

#181

Post by gurkendoktor »

aneth wrote: post #164

The response to this makes me feel that HackerNews is now populated by a bunch of pretenders. This "bug" has been in Rails since Day 1, and any remotely experienced Rails developer is aware of this functionality. You can argue for a different default, but it's not a bug. Github did have a bug and noone knowledgeable about Rails appears to have made even a cursory inspection of the security of their controllers - whic…

> Github did have a bug and noone knowledgeable about Rails appears to have made even a cursory inspection of the security of their controllers > Github had a pretty terrible bug > but the certainly don't deserve this sort of mon hatred

For all the free fun you can have on github, they are in the business of selling private repositories. What could possibly have been worse than someone finding a bunch of bugs in a matter of days just to prove a point about Rails?

Re: GitHub and Rails: You have let us all down.

#182

Post by scriptproof »

maratd wrote: post #139
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

> and how they should never have had such a vulnerable bug in the first place is even worse. Bugs happen. Even stupid oh-my-god-i-can't-believe-i-did-that bugs happen. And they happen to the best of us. However , when someone reports a vulnerability about my code to me or I discover a problem myself, the very first thing I do is break out the grep. I grep the shit out of my code. Because I am a human being. I am a cr…

"The guy reported the issue on Friday, they fixed that specific instance of the issue ... and it remained a problem in other places."

If I have correctly understood the issue, Igor at first informed Rails, and this was the right thing to do. He was ignored by Rails and then he wanted to proof his view point by applying it to GitHub. How could GitHub inform other places? By contacting Rails, but they already downplayed the issue...

Re: GitHub and Rails: You have let us all down.

#183

Post by InclinedPlane »

polymatter wrote: post #178
InclinedPlane wrote: post #167

Earlier quoted context omitted.

"Houses aren't very secure, here's a video of me picking the lock on my own front door." "I demonstrated how insecure your house is by picking the front door lock and leaving a note on your bed." Sometimes it can be difficult to have the empathy and perspective to see how frightening and unconscionable the 2nd action can be, but it very much is.

"But thats exactly why I left you that note. Because it frightens me just how insecure your house is. I care about you and don't want to see you hurt. I did it as a last resort, I tried to inform you but you clearly didn't take me seriously. Empathy was casusing me pain everytime I saw you 'lock' your door with that elastic band. Attention seeking or malicious behaviour would have been to break into all the insecure…

How is that so very different from, say, kidnapping someone's children and holding them hostage until they fix whatever you want fixed?

The problem here is that when you violate someone's trust you change the landscape. People get scared, they question your motives, they go into a fight or flight response. Yes, this sometimes results in the problem being fixed faster because they are very much more motivated now, but the same is true if you kidnap their family, right?

If you think someone is letting down their customers by not responding fast enough, then you go public. But violating trust is a quick way to end a professional relationship.

Re: GitHub and Rails: You have let us all down.

#184

Post by negw »

tylermenezes wrote: post #147
eugenejen wrote: post #130

Earlier quoted context omitted.

It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?

You're right of course. I've honestly been trying to avoid the Rails community for as long as possible (I'd like to avoid being associated with anyone who would call himself a "Rockstar Programmer"), and with Rails being as big as it is, I've pretty much avoided Ruby entirely.

I've coded in Rails since forever (0.5) and I honestly don't see how that dongml thing is funny. I'm not even able to understand how it is supposed to be funny, is it the dicks?

For sure I think that a language shouldn't be avoided for something different than technical reasons, and nothing else.

Re: GitHub and Rails: You have let us all down.

#185

Post by ktizo »

polymatter wrote: post #178
InclinedPlane wrote: post #167

Earlier quoted context omitted.

"Houses aren't very secure, here's a video of me picking the lock on my own front door." "I demonstrated how insecure your house is by picking the front door lock and leaving a note on your bed." Sometimes it can be difficult to have the empathy and perspective to see how frightening and unconscionable the 2nd action can be, but it very much is.

"But thats exactly why I left you that note. Because it frightens me just how insecure your house is. I care about you and don't want to see you hurt. I did it as a last resort, I tried to inform you but you clearly didn't take me seriously. Empathy was casusing me pain everytime I saw you 'lock' your door with that elastic band. Attention seeking or malicious behaviour would have been to break into all the insecure…

This isn't breaking into someone's house and leaving a note.

This is breaking into a huge commercial factory with thousands of clients, where you could cause colossal damage, and only leaving a note.

Re: GitHub and Rails: You have let us all down.

#186

Post by einhverfr »

trotsky wrote: post #154
maratd wrote: post #139

Earlier quoted context omitted.

> and how they should never have had such a vulnerable bug in the first place is even worse. Bugs happen. Even stupid oh-my-god-i-can't-believe-i-did-that bugs happen. And they happen to the best of us. However , when someone reports a vulnerability about my code to me or I discover a problem myself, the very first thing I do is break out the grep. I grep the shit out of my code. Because I am a human being. I am a cr…

They should have burned the midnight oil and made sure the same problem wasn't prevalent in other parts of the code. I understand that's the feeling here, but it's unrealistic. I've reported dozens of bugs to shops that ranged in size from 1 to borg. You simply never see a whole set of bugs fixed and pushed live over a weekend. Not even close. Exactly what company have you seen set this standard for professional? The…

I agree to a point.

However, if such a problem was reported to LedgerSMB here is how we handle it:

1) Scope out the problem. What's affected? Are other related open source projects affected? How bad is it? This itself can take a bit of time. We do not rush this because we don't want a full disclosure when it happens to bring other problems into the fore.

2) Within a few days we let the reporter know what we have found and give them a chance to offer feedback.

3) Then we get everyone on the core team together and talk solutions. Once we implement it, we test and release a patch. Two weeks after the patch is released, we release a full disclosure along with a hat tip to the one who discovered it.

The whole process takes time. But the fact is that it's generally better to get a full fix out in two weeks than a partial fix out tomorrow.

So no, don't burn the midnight oil. More speed, less haste.

And this whole thing really doesn't look good for Github.

Re: GitHub and Rails: You have let us all down.

#187

Post by einhverfr »

InclinedPlane wrote: post #150
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

I was on Egor's end of a similar incident back in my more impulsive years. I wasn't treated quite as well as he was but even so I eventually came around to the realization that being overly confrontational is never the right way to gain attention for security issues (even though it did result in the issue being fixed rather quickly).

I disagree.

The LedgerSMB project started in a similar shitstorm. I found an ability to forge credentials in SQL-Ledger. I submitted it. I went back and tried a month later on a new version (no communication from the SL author) and it was a little harder but not too hard. I exploited again, sent another email, was told to bug off.....

I tried to get the issue fixed for six months. I finally gave up and forked. When we forked we issued a security advisory publicly and stated we would offer a full disclosure soon. That's when the shitstorm started in earnest. I was accused of fearmongering. I was told I didn't understand security, that the software was plenty secure, and many choice lines that out of professionalism I will refrain from reposting to this forum.

Dozens of emails.

The end result was that Dieter fixed SQL-Ledger shortly after the fork, because those who stayed behind made him. It would not have been fixed without the fork.

Sometimes you have to be confrontational.

Re: GitHub and Rails: You have let us all down.

#188

Post by unimpressive »

javascriptlol wrote: post #132
knodi wrote: post #115

This is the first thing in securing your rails app a developer learns, how to properly handle mass-assignment. I don't blame rails, I blame Github.

A system that is designed to rely on human diligence is inherently flawed. It's a mercy that drills and other dangerous tools aren't designed in the same way that a lot of software is.

Exactly. This is like saying that it was fine for older versions of windows to broadcast the users directory tree over an open file server because they should know better than to leave the server up. (This happened right? Correct me if it didn't.)

It's like no, you should have to turn the server on in the first place. The fact that it took some Russian kid in his basement breaking into the github rails master for this self evident truth to be realized by the core rails team is totally outrageous.

Re: GitHub and Rails: You have let us all down.

#189

Post by somestuff »

JackDanger wrote: post #55
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

They suspended the account, they didn't cancel it. On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account. On Monday morning you figure out what to do with them.

"On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account."

Haha what. Do you maintain any sites? Tell us what ones. I want to warn all of your users that the admin is someone who will disable an account of someone who committed to master on a project that is not theirs and feel he has accomplished something.

Re: GitHub and Rails: You have let us all down.

#190

Post by generalk »

DallaRosa wrote: post #175
trotsky wrote: post #131

Jesus, HN goes from zero to lynch mob faster than reddit these days. Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or t…

From 3 days ago: "What I want you to see in that thread I mentioned is the way the core team perceives this. You are not discovering anything unknown, we already know this stuff and we like attr protection to work the way it is." ( https://github.com/rails/rails/issues/5228#issuecomment-4292... ) After reading for how long he tried to bring attention to this and only got a top guy to say that kind of stuff. The guy w…

This, to me, is the craziest part.

I'm not condemning anyone, but it seems that when someone points out that your framework ships Insecure By Default code with absolutely no warning in the generated code, you'd take that seriously.

Instead, the thread is full of "We've discussed this before, we like it the way it is" and "Rails is not responsible here."

Post reply on HN