GitHub and Rails: You have let us all down.
chrisacky.posterous.com
GitHub and Rails: You have let us all down.
1–10 of 205 posts
Re: GitHub and Rails: You have let us all down.
#2I'm not sure all the things you list as being possible are true.
- Every GitHub Repository could be access by anyone as if they had full administrator privileges.
- This means that anyone could commit to master.
- This means that anyone could reopen and close issues in issue tracker.
- Even the *entire* history of a project could be wiped out. Gone forever.
Re: GitHub and Rails: You have let us all down.
#3I'm not sure all the things you list as being possible are true. - Every GitHub Repository could be access by anyone as if they had full administrator privileges. - This means that anyone could commit to master. - This means that anyone could reopen and close issues in issue tracker. - Even the *entire* history of a project could be wiped out. Gone forever. As I understand it from his explanation[1] he added his publ…
The way he was able to add his key was via a web-based exploit, which effectively gave him administrative web access. So yes, the list is correct.
Re: GitHub and Rails: You have let us all down.
#4I'm starting to like homakov more after reading this article.
Re: GitHub and Rails: You have let us all down.
#5I'm not sure all the things you list as being possible are true. - Every GitHub Repository could be access by anyone as if they had full administrator privileges. - This means that anyone could commit to master. - This means that anyone could reopen and close issues in issue tracker. - Even the *entire* history of a project could be wiped out. Gone forever. As I understand it from his explanation[1] he added his publ…
The way he was able to add his key was via a web-based exploit, which effectively gave him administrative web access. So yes, the list is correct.
I thought that he added his public key to the Rails user through his own account settings, which wouldn't give him access to the Rails web admin.
Re: GitHub and Rails: You have let us all down.
#6I'm not sure all the things you list as being possible are true. - Every GitHub Repository could be access by anyone as if they had full administrator privileges. - This means that anyone could commit to master. - This means that anyone could reopen and close issues in issue tracker. - Even the *entire* history of a project could be wiped out. Gone forever. As I understand it from his explanation[1] he added his publ…
FWIW, that last bullet, aside from being the most egregious example of hyperbole in TFA, shows a complete lack of understanding of how git works.
Re: GitHub and Rails: You have let us all down.
#7I fail to see what GitHub did wrong here. They were attacked, they suspended the account doing the hacking, and they fixed the problem. Then, they blogged about it, explaining in detail what happened. Apparently they weren't quite reverent enough for the person who wrote this article.
Re: GitHub and Rails: You have let us all down.
#8> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable.
I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked.
BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you must trust all of your data with the one provider, who might go belly up at any point and take it with them.
Yes, GitHub provides some fantastic social features and helps with community involvement through these features, but if you are dependant on a "single service" and you're using a DSCM/DVCS, you should probably look at a few alternatives to reduce that dependancy.
Re: GitHub and Rails: You have let us all down.
#9> Beyond any shadow of a doubt, a shit storm of epic proportions has just gone down.
Breathe.
Re: GitHub and Rails: You have let us all down.
#10Earlier quoted context omitted.
The way he was able to add his key was via a web-based exploit, which effectively gave him administrative web access. So yes, the list is correct.
I thought that he added his public key to the Rails user through his own account settings, which wouldn't give him access to the Rails web admin.
This is correct. People who don't understand what a mass-assignment bug is are running with this story. It's like when we witness a DDoS and have to tollerate people who think it means that the targeted party was infiltrated.
This bug allowed one to add their public key to another user's account, and make changes to comments and issues.