201–210 of 240 posts
Earlier quoted context omitted.
> with some fascinating features If you come from PHP or Java anyway.
yes yes yes no new genuinely new programming ideas have happened since the 70s and 80s. Don't be obtuse.
Earlier quoted context omitted.
He clearly violated their Terms Of Service: 5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub. You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later. I love how he punts on the te…
First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…
* Not actually DHH.
How has he hacked Github? He's a contributor on rails/rails see here and search for homakov - https://github.com/rails/rails/contributors
Earlier quoted context omitted.
So if you had a vulnerable product and this gentleman altered one of your customer's pages without permission you would be grateful? That is strange to me.
Well, if like in this case, he warned me and I told him to "fuck off", I kinda would be grateful, even more like "Should've seen that one coming...".
Earlier quoted context omitted.
First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…
Not all security vulnerabilities can be protected automatically by a web framework. In many cases, frameworks provide features that developers can use themselves to secure their applications. Example: XSS is a common web security problem. In short, it means that putting user-originated data back on the page unescaped is unacceptable. Before Rails 3.0, the Rails approach to this problem was to provide a helper ( h ),…
It should be obvious that you can't anticipate every potential attack vector at design time. Therefore, a well-designed system is one for which, when expected or normal conditions are not met, the resulting action is nothing or error, not an unexpected action.
This principle is also known as fail-safe: http://en.wikipedia.org/wiki/Fail-safe
Funnily, the first Diaspora release had the same issue and the devs were ridiculed and called noobs by a big part of the HN community and security "experts" wrote big posts about it. The different reaction here is interesting to say the least.
Earlier quoted context omitted.
Ensuring input is properly validated is always the developer's concern. A framework can make that easier for you, but especially in cases like this, which are basic user authentication concerns, it is ABSOLUTELY the developer's responsibility to be 100% sure how all of those abstractions work and ensure there are no leaks anywhere. You can't punt on security. Abstractions may make it easier, but you better be damn ce…
That said, when your tools generate an insecure scaffold by default with no easy path to discovery on how to fix it, your tools do have a security flaw as well. You can't expect all of the developers in the world to be literate in security, especially the ones who choose batteries-included web frameworks as their go-to.
You can't blame the framework for people failing to validate input. The framework can provide you abstractions for helping you validate input, but at the end of the day, if you're being lazy or sloppy about what you do with data from the outside, that's your fault, not the framework's.