3 ms·
Not only did this person make several large and irresponsible mistakes in the process of uncovering and reporting the bug (dumping tons of private user informat
by dperfect 11y ago
Not only did this person make several large and irresponsible mistakes in the process of uncovering and reporting the bug (dumping tons of private user information without permission, going far beyond simply discovering and reporting the bug, etc.), but they also keep referring to Ruby ("running Ruby 3.x, which is susceptible to code execution via the Ruby session cookie") as the vulnerable piece, when in reality, it's the version of Rails that had the vulnerability.
- kuschku 11y agoWell, that’s the point. An unexperienced person with half an hour on Google got full access to Instagrams systems. And the bug has been existing for 2 years. Wonder where the person who tipped him off had the info from – could very well have been a common target in the black hat scene.