Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Commit that changed my life

egorhomakov.com

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Commit that changed my life

#21

Post by carterschonwald »

homakov wrote: post #9
brokentone wrote: post #8

I was never against Egor, I don't know that he had a lot to apologize for -- but others do. Either way it's very mature of him to offer apologies. Shows personal growth while learning and demonstrating very succinct security POCs. This kid is one to keep your eyes on. Egor, if you make it to NYC, let me buy you a drink.

thanks! i'm already choosing a flight for June :)

Awesome. Feel free to hit me up at well when you're in NYC! Stumbling into doing what you really love is .... magical. Consulting is a lot of work, make sure you have your work pipelined far ahead of time yet avoid overloading yourself!

Sounds like you've had a benignly interesting year and learned a lot. What more could someone want?

Re: Commit that changed my life

#23

Post by MojoJolo »

I read almost all the notes in the Github page and it lasted for months. There are different sides shown.

BTW, I think travelling cost and need so much money. I wonder what are Egor's source of income. Don't know him that much so I just assumed consulting (Sakurity) is just his source of income. Also, if Egor is in South East Asia at the moment, he should visit the Philippines!

Re: Commit that changed my life

#24

Post by homakov »

artursapek wrote: post #22
homakov wrote: post #7

Earlier quoted context omitted.

that design costs $10k, appreciate it!

Trust me - as a design student, seeing talented people not care about design can be very refreshing. Keep on keeping on my friend.

I really REALLY care about design. I think it matters a lot. But so far don't have much spare time / money to get something decent. too busy these days :/

Re: Commit that changed my life

#25

Post by asveikau »

InclinedPlane wrote: post #17
mikek wrote: post #14

What's the backstory on this?

He discovered a major vulnerability in github and pointed it out by making a commit to the rails master repository (which has rather obvious serious repercussions from a security standpoint).

My recollection (though I don't know much about rails and this is just going from memory) is that he attempted to make an argument to the rails team for more secure defaults in parameter parsing and for the framework to steer apps towards more secure use. When they brushed him off and said it was ultimately the caller's responsibility to use it right, he exploited github to make his point.

Re: Commit that changed my life

#26

Post by InclinedPlane »

homakov wrote: post #19
InclinedPlane wrote: post #15

In my impetuous 20s I did something similar. I was rather ... well, rude, really in pointing out a major security flaw on the forums of one of the more famous tech sites. Things devolved from there and I ended up being banned, though they did fix the problem rapidly even so. Since then I've learned the value of tact.

I agree about responsible disclosure but that problem had many facets, and I was rather trying to point out rails problem, sadly, using github hole.

It's a fine line sometimes. I think your commit is mostly defensible. It's really an open question. What do you do when you point out a serious security issue and it doesn't get the attention it deserves? I think your commit definitely proved that the issue was being downplayed far too much. Is there some better middle ground? If proving a vulnerability results in it getting fixed overnight and merely describing it results in it getting fixed never then what's the right course of action?

Re: Commit that changed my life

#27

Post by shadowsun7 »

Egor, if you're ever in Singapore, please hit me up. I'll organize a meetup via NUS Hackers at the National University of Singapore. Would be interesting to let other university-level students hear about your experience.

(My email address's on my personal site (which, in turn, may be found on my profile)).

Re: Commit that changed my life

#28

Post by dguido »

homakov wrote: post #9
brokentone wrote: post #8

I was never against Egor, I don't know that he had a lot to apologize for -- but others do. Either way it's very mature of him to offer apologies. Shows personal growth while learning and demonstrating very succinct security POCs. This kid is one to keep your eyes on. Egor, if you make it to NYC, let me buy you a drink.

thanks! i'm already choosing a flight for June :)

Come for SummerCon http://www.summercon.org

Re: Commit that changed my life

#29

Post by pragone »

homakov wrote: post #9
brokentone wrote: post #8

I was never against Egor, I don't know that he had a lot to apologize for -- but others do. Either way it's very mature of him to offer apologies. Shows personal growth while learning and demonstrating very succinct security POCs. This kid is one to keep your eyes on. Egor, if you make it to NYC, let me buy you a drink.

thanks! i'm already choosing a flight for June :)

Likewise Egor - I'd be very excited to meet. I was extremely impressed with the issues you had raised last year, and would love to buy you a beer

Re: Commit that changed my life

#30

Post by misiti3780 »

carterschonwald wrote: post #21
homakov wrote: post #9

Earlier quoted context omitted.

thanks! i'm already choosing a flight for June :)

Awesome. Feel free to hit me up at well when you're in NYC! Stumbling into doing what you really love is .... magical. Consulting is a lot of work, make sure you have your work pipelined far ahead of time yet avoid overloading yourself! Sounds like you've had a benignly interesting year and learned a lot. What more could someone want?

Ill drink some beers in NYC also
Post reply on HN