51–60 of 202 posts
Earlier quoted context omitted.
Exactly. + if github would really ask me for consulting I'd consider working for free, just for a testimonial.
I have a question for you! Roughly how many hours do you think you've spent looking for bugs on github before you found these stream of exploits?
Earlier quoted context omitted.
At least in my experience, I donate to groups that do good work but aren't getting paid for it. I wouldn't donate to people who are being paid (quite handsomely, in this case) for their labor. Especially when he's already clarified that GitHub paid him more than he thought his time was worth.
95% of my security research is not paid. I fix gems, libraries, websites etc. Donated money go right there, through beers and coffee I need.
But github, seriously? Why do you guys fail so hard at security?
Too much Brogrammer rather than programmer methinks.
Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…
@homakov, have you thought about selling screencasts ?
Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…
///host.com bug is not well documented. It's "0day" for most of websites.
Cheers !
Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…
It's assured that a ton of Rails apps are vulnerable, it's just that no one has found them, or more likely, is not publicly releasing or actively exploiting them.
Also, Rails doesn't address for all security pitfalls. Some of its mechanisms are actually underdeveloped and require rolling lots of checks by yourself, such as for proper session termination, IIRC.
Earlier quoted context omitted.
I have a question for you! Roughly how many hours do you think you've spent looking for bugs on github before you found these stream of exploits?
0. I spent less than an hour last year because there was no proper motivation.