Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

191–200 of 240 posts

Re: Hacked: commit to rails master on GitHub

#191

Post by alexbell »

BenjaminCoe wrote: post #120
jsnell wrote: post #91

Earlier quoted context omitted.

Whether it was malicious depends on the motives, and it's very hard for me to see where the malice is. To me it looks more like he just wanted to bring attention to the issue in order to get it fixed. I already agreed that GitHub were innocent bystanders and that the timing was unfortunate. But if getting publicity to the issue was the main point, it's also easy to see why GitHub was the perfect target. I also alread…

I think you're winning me over to Egor's actions being more irresponsible and misguided than malicious -- chalk it up to him being 18. I'm finding it pretty hard to stay mad at someone with this tattoo: http://homakov.blogspot.com/2011/07/octocat-tattoo.html

Agreed. Immature - certainly. I don't think his actions were done with malicious intent. Maybe insolent, but that only counts in the military. If he wanted to he could have made his point in a far more malicious manner.

And the octocat tattoo... How can you not like a guy with an octocat tattoo!

Re: Hacked: commit to rails master on GitHub

#192

Post by acqq »

thibaut_barrere wrote: post #158
rsynnott wrote: post #155

Earlier quoted context omitted.

Well, it's a beginner-level Rails mistake; it is not precisely an obscure issue. Googling 'attr_accessible' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in Github, though.

It's a beginner-level Rails mistake but it's very widely seen in codebases: it's a real, common threat.

Obviously not beginner-level if more famous sites suffer from the same problem -- Egor mentions some in his posts and he is only one person -- imagine what all the black hats can do working in parallel.

Re: Hacked: commit to rails master on GitHub

#194

Post by masklinn »

danmaz74 wrote: post #146

I would say that homakov's angry and not very mature reaction to his warning being ignored just did a very big favor to a lot of rails developers, that reading about his exploit on HN (and other places) will rush to check their websites and will fix a LOT of serious vulnerabilities they didn't have any idea they had. But which somobody could have already been secretly exploiting. Understandably, Github would have lik…

> I would say that homakov's angry and not very mature reaction to his warning being ignored

Not just ignored but dismissed multiple times. It's not exactly surprising that he went and injected code into Rails's master.

Re: Hacked: commit to rails master on GitHub

#195

Post by wycats »

patrickaljord wrote: post #189
wycats wrote: post #178

Earlier quoted context omitted.

Not all security vulnerabilities can be protected automatically by a web framework. In many cases, frameworks provide features that developers can use themselves to secure their applications. Example: XSS is a common web security problem. In short, it means that putting user-originated data back on the page unescaped is unacceptable. Before Rails 3.0, the Rails approach to this problem was to provide a helper ( h ),…

What do you think of doing it this way http://blog.ricodigo.com/blog/2012/03/04/an-alternative-to-a... ?

I don't necessarily like having to have every ORM/data library have to know about this concern...

Re: Hacked: commit to rails master on GitHub

#196

Post by angersock »

masklinn wrote: post #190
angersock wrote: post #166

Earlier quoted context omitted.

whoa whoa whoa Ruby is a really cool language with some fascinating features--don't limit yourself by assuming that you also have to learn the Rails stuff. Seriously, give it a shot in one of its more palatable forms.

> with some fascinating features If you come from PHP or Java anyway.

yes yes yes

no new genuinely new programming ideas have happened since the 70s and 80s.

Don't be obtuse.

Re: Hacked: commit to rails master on GitHub

#197

Post by masklinn »

deanpcmad wrote: post #177

How has he hacked Github? He's a contributor on rails/rails see here and search for homakov - https://github.com/rails/rails/contributors

Being a contributor does not mean he has push access to the rails master, it just means one of his patches/pull requests got accepted into Rails in the past.

In fact, it's even better: the commit he pushed into Rails's master through the exploit would have automatically added him as a contributor even if he had not already been one.

Re: Hacked: commit to rails master on GitHub

#198

Post by masklinn »

angersock wrote: post #196
masklinn wrote: post #190

Earlier quoted context omitted.

> with some fascinating features If you come from PHP or Java anyway.

yes yes yes no new genuinely new programming ideas have happened since the 70s and 80s. Don't be obtuse.

There's nothing obtuse about it, new programming ideas have happened since the 70s and 80s but as far as I know none of them is in Ruby, and you're basically assuming tylermenezes does not know about any of the (much older) features which did get into Ruby.

Re: Hacked: commit to rails master on GitHub

#200

Post by DrPizza »

wycats wrote: post #178
tylermenezes wrote: post #163

Earlier quoted context omitted.

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

Not all security vulnerabilities can be protected automatically by a web framework. In many cases, frameworks provide features that developers can use themselves to secure their applications. Example: XSS is a common web security problem. In short, it means that putting user-originated data back on the page unescaped is unacceptable. Before Rails 3.0, the Rails approach to this problem was to provide a helper ( h ),…

Every C programmer has the tools they need to not create buffer overflows _and yet buffer overflows are abundant_.

Saying "we'll provide the tools and insist that developers use them safely and securely" is a bullshit answer, and always has been.

You're either secure by default, or not at all. In this case, not at all.

Post reply on HN