Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

91–100 of 205 posts

Re: GitHub and Rails: You have let us all down.

#91

Post by Daniel_Newby »

mquander wrote: post #63
Fluxx wrote: post #56

Earlier quoted context omitted.

I would disagree with this, quite a lot. He brought up an issue with the Rails team, they pointed him at the canonical, "here is where we talked about this before, sorry." Still not satisfied, he found the same exploit in Github to prove a point. Rather than do the sensible thing by creating a dummy account and contacting Github showing how he messed things up, he barged into the Rails organization and left a silly c…

I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, except that the former would probably get the bug fixed quietly; in contrast, now everybody is aware that the bug existed in Github and is aware of the potential for it to exist everywhere. He successfully proved his point, which apparently was a pretty good point. Isn't that a better outcome? As for Github's responsi…

> I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, ...

The latter violates the Computer Fraud and Abuse Act, creating huge imprisonment and employability risks.

Re: GitHub and Rails: You have let us all down.

#92

Post by hermanjunge »

dkrich wrote: post #13

Give me an F'in break. I understand security is not something to take lightly, but no system is infallible. There was an oversight, plain and simple. It is debatable whether the Github/Rails Core Team was too lax, but I for one am tired of hearing developers whine and make a witch trial out of groups of developers that have moved the development community forward several huge steps just to make themselves sound smart…

I agree, and quote: "Please stop writing provocative statements and behaving as if the sky is falling on top of your head and the very fiber of our being is at stake. An open source language and a website written in that language were shown to have a flaw. Which has since been fixed. I hate developers who like to sound smart at the expense of somebody else. Get over yourself."

Re: GitHub and Rails: You have let us all down.

#93

Post by stock_toaster »

hythloday wrote: post #79
stock_toaster wrote: post #68

Earlier quoted context omitted.

> His previous report was fixed last friday Makes it sound like a separate issue. edit: looks like github clarified https://github.com/blog/1069-responsible-disclosure-policy

Same exploit, different endpoint. Github agree they "should have...immediately looked for related issues": https://twitter.com/#!/technoweenie/status/17645071550868684... ...though as they've now unbanned his account (good on them), it's somewhat moot.

Aha. Thanks for the extra info.

Re: GitHub and Rails: You have let us all down.

#94

Post by technoweenie »

epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.

Re: GitHub and Rails: You have let us all down.

#95

Post by res0nat0r »

icebraining wrote: post #86
dkrich wrote: post #24

Earlier quoted context omitted.

Fair enough. Ignoring the issue and not fixing it after it was brought to their attention to me is where they screwed up. As for the account suspension, I'm not sure I agree that the account should not have been suspended. Github is a code repository first, and I don't think they have an obligation to keep people around who are exposing security flaws by notifying the entire community. As the author of the post point…

As the author of the post points out, hundreds of thousands of apps rely on Github, so to an extent it is their responsibility to block people who may jeopardize their users. But they haven't blocked him. They blocked his account , so all he has to do is create another. Github has put their users in far more danger by being dicks to a guy to gain nothing.

In what way do they have to prevent him from ever accessing the site from any account ever again? The best they can do is suspend his account per policy while they are investigating.

Re: GitHub and Rails: You have let us all down.

#96

Post by niyazpk »

technoweenie wrote: post #94
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.

The sad part is that the guy was your biggest fan: http://homakov.blogspot.in/2011/07/octocat-tattoo.html

Re: GitHub and Rails: You have let us all down.

#97

Post by epistasis »

technoweenie wrote: post #94
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.

Oddly, I don't feel that GitHub is being upfront with everything that's going on here. It appears to be a very complicated story, but it was presented in an entirely different manner. I recognize that it's difficult to present a coherent story when everything is playing out in real time on the web, but the blog posts seem to have shared just the wrong amount of information.

Re: GitHub and Rails: You have let us all down.

#98

Post by aroberge »

Daniel_Newby wrote: post #91
mquander wrote: post #63

Earlier quoted context omitted.

I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, except that the former would probably get the bug fixed quietly; in contrast, now everybody is aware that the bug existed in Github and is aware of the potential for it to exist everywhere. He successfully proved his point, which apparently was a pretty good point. Isn't that a better outcome? As for Github's responsi…

> I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, ... The latter violates the Computer Fraud and Abuse Act, creating huge imprisonment and employability risks.

... if you want to take a US-centric view of things, then that last statement is correct I suppose... but not everyone is subject to US laws - including, unless I am grossly mistaken, the person you refer to.

Re: GitHub and Rails: You have let us all down.

#99

Post by dspillett »

dangrossman wrote: post #52
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/ I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan. My open source code is on GH, but it's all also pushed to RH, along with all my…

IMO the best location for private repositories is your own equipment. Or rented equipment but with the private code and data on encrypted block devices or filesystems.

I know it can be a faf to setup proper reliable secure backups and so forth (though with git it shouldn't be too hard give the whole thing is designed with wide but efficient distribution in mind), but if you stuff is sensitive enough (in a business sense, some other financial sense, or for more personal reasons) to care about keeping private then I would think twice before trusting a third party with the data. No matter how trustworthy, reliable, and secure they try to be, every one makes mistakes.

Maybe I'm just paranoid. Or just plain old fashioned. But "everything in the cloud" just scares me. Keep public stuff on public services by all means, but keep your private stuff under greater control.

Post reply on HN