Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

231–240 of 240 posts

Re: Hacked: commit to rails master on GitHub

#231

Post by rsynnott »

GrumpySimon wrote: post #221
rsynnott wrote: post #155

Earlier quoted context omitted.

Well, it's a beginner-level Rails mistake; it is not precisely an obscure issue. Googling 'attr_accessible' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in Github, though.

Allow me to rephrase that: "Well, it's a beginner-level PHP mistake; it is not precisely an obscure issue. Googling 'SQL Injection/register_globals/get_magic_quotes/etc' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in ..., though." Ten+ years of register_globals, get_magic_quotes and SQL injection attacks (etc etc etc) in PHP show that eve…

I don't think it's on the same scale as register_globals or magic_quotes; both of those were much stupider. It's still very stupid, granted, but not on the same scale as register_globals.

Re: Hacked: commit to rails master on GitHub

#232

Post by zerostar07 »

teej wrote: post #95

Posting it as an issue on the Rails repo and then exploiting GitHub with it is a great way to get attention, but not necessarily the most responsible. I disclosed a vulnerability to GitHub before. I dropped it into their Issues system marked private with the heading "URGENT". It was a Sunday and I got a response + a fix from Tom Preston-Wener himself within a few hours. That, in my mind, would have been a more respon…

Fact is, if he hand't exploited the vulnerability in a high profile site, the extent of the vulnerability would be unknown and it wouldn't have been fixed. Since (damage done) << (benefit) i think we should be thanking this guy.

Re: Hacked: commit to rails master on GitHub

#233

Post by flomo »

nailer wrote: post #227
rsynnott wrote: post #155

Earlier quoted context omitted.

Well, it's a beginner-level Rails mistake; it is not precisely an obscure issue. Googling 'attr_accessible' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in Github, though.

My understanding is that it's an insecure built-in default. Ie, the mistake is by the Rails framework developers, and Rails users have to explicitly secure it. Is that incorrect?

IMHO, it's a bad practice which is very widely promoted in Rails guides and scaffolding code.

Mass-assignment is very difficult to get right in any complex app (e.g. with multiple user roles) and the simplest way to avoid these problems would be to discourage the use of 'update_attributes' and teach people to explicitly set model properties.

(Of course, Rails folks probably hate the non-DRY aspect of this, but I prefer to look at my code and see exactly what's happening with user input.)

Re: Hacked: commit to rails master on GitHub

#234

Post by beagle3 »

hemancuso wrote: post #212
ceejayoz wrote: post #109

Earlier quoted context omitted.

The point, though, is that this is more of a Rails issue than a Github issue. If Github gets it wrong, others are likely to.

The users who trust Github don't care if it was a "rails issue" or a "github issue" It's a Github issue no matter what the cause or responsible party. If Github was run on unpatched windows XP boxes with all IPs public, you wouldn't argue that it was Microsoft's fault because "everyone knows" what a bad idea that would be. The base assumption should not to be completely reliant on your environment and frameworks to b…

But (to continue your analogy), github was run on fully patched XP boxes, in which case: yes, it would have been Microsoft's fault.

And it would have ultimately been Github's fault (in the eyes of their users) in that case too -- because they are providing the service, and their choices (XP / Rails, Firewall / Application Firewall / Audit) is their fault.

Contrary to how a lot of things are handled today, fault can be shared by multiple parties. what Egor did was get exposure and reaction from a lot of involved parties, where he was unable to get any reaction from some of them (Rails team) in the past.

Re: Hacked: commit to rails master on GitHub

#235

Post by _vdk5 »

nwmcsween wrote: post #170
tylermenezes wrote: post #163

Earlier quoted context omitted.

First he submitted a bug, and they closed it. Then, he reopened the bug to prove it was a bug, and they closed it again. Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)" Then, he committed a text document to master, and they got all upset about it and got Github staff involved. How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to ma…

"This is why I refuse to learn Ruby. I don't want to be associated with that community. "Learn Ruby if you want to be associated with a bunch of people who call themselves Rockstar Programmers."" You refuse to learn a language due to how a project acts? Have you ever read the {open,free,net}BSD or Linux mailing lists? You're not going to make it far in software development with an attitude like that.

It's a fairly rational argument to have a preference/affinity for programming languages based on communities surrounding them. He stated his preferences, and that's perfectly fine. You might have been too quick in passing that judgement.

Unless a quantum computing breakthrough alters the way we control computers, there will never be a one-language to rule them all. We'll continue having a wide diaspora and will take evolutionary steps to bind ideas together. Preemptive and comprehensive security model might be just one of those ideas.

Re: Hacked: commit to rails master on GitHub

#236

Post by Robin_Message »

lclarkmichalek wrote: post #201
angersock wrote: post #196

Earlier quoted context omitted.

yes yes yes no new genuinely new programming ideas have happened since the 70s and 80s. Don't be obtuse.

Tell that to STM. Sure most new programming languages are amalgamations of existing concepts, but new stuff does turn up from time to time.

But STM is from the 80s -- 1986 to be precise.

Re: Hacked: commit to rails master on GitHub

#237

Post by nfm »

nate wrote: post #118
nfm wrote: post #111

Earlier quoted context omitted.

In my uses of rails, belongs_to associations get changed frequently. Any time anything gets 'assigned' to something, this occurs: assigning something to a user, to a milestone, to a plan, to an account, maybe even to a priority. YMMV but I'd say this isn't minute. That said, there are certainly places in my apps where I don't want this to occur. And whitelisting is much better than blacklisting!

And you're using mass assignment to do those assignments?

Nah, just changing the _id column's value so that the belongs_to association changes.

Re: Hacked: commit to rails master on GitHub

#238

Post by nate »

nfm wrote: post #237
nate wrote: post #118

Earlier quoted context omitted.

And you're using mass assignment to do those assignments?

Nah, just changing the _id column's value so that the belongs_to association changes.

"There is probably a minute number of cases where someone wants mass assignment changes to include the parent's id of that record"

So it sounds like you aren't using mass assignment to change parent ids either. Most people don't. Most people use mass assignment to change the attributes of an object, not that objects association to a parent.

Re: Hacked: commit to rails master on GitHub

#239

Post by Blaisorblade »

acqq wrote: post #192
thibaut_barrere wrote: post #158

Earlier quoted context omitted.

It's a beginner-level Rails mistake but it's very widely seen in codebases: it's a real, common threat.

Obviously not beginner-level if more famous sites suffer from the same problem -- Egor mentions some in his posts and he is only one person -- imagine what all the black hats can do working in parallel.

By your reasoning, since tons of C programs can't use strcpy() correctly and thus contain buffer overflows, it takes a C master to use strcpy() correctly. I'd say instead that the kind of reasoning is wrong and that even experts can make beginner-level mistakes (not so often). But these are the kind of mistakes a good framework/language/etc. should try to prevent - especially if security-related. Tons of research tries to reduce error-prone programming activities.

Re: Hacked: commit to rails master on GitHub

#240

Post by nwmcsween »

_vdk5 wrote: post #235
nwmcsween wrote: post #170

Earlier quoted context omitted.

"This is why I refuse to learn Ruby. I don't want to be associated with that community. "Learn Ruby if you want to be associated with a bunch of people who call themselves Rockstar Programmers."" You refuse to learn a language due to how a project acts? Have you ever read the {open,free,net}BSD or Linux mailing lists? You're not going to make it far in software development with an attitude like that.

It's a fairly rational argument to have a preference/affinity for programming languages based on communities surrounding them. He stated his preferences, and that's perfectly fine. You might have been too quick in passing that judgement. Unless a quantum computing breakthrough alters the way we control computers, there will never be a one-language to rule them all. We'll continue having a wide diaspora and will take…

No it's not rational to assume a language isn't worth learning due to how some people act in fact it's ignorant. You use a tool due to it's merit not due to presumption of how everyone acts.
Post reply on HN