5 ms·
What? Correct me if I'm wrong, but it looks like they're just releasing the source code, not taking new users for "the" Diaspora or sharing access to any kind o
by dandelany 16y ago
What? Correct me if I'm wrong, but it looks like they're just releasing the source code, not taking new users for "the" Diaspora or sharing access to any kind of central database of users. It's just a ruby web app you can download and run locally (or on a web server if you're that dumb...), right? And in that case, how is this any worse than the hundreds of other bits of (unsafe, untested) social networking code floating around the interwebs?
- tel 16y agoBecause it raised $200,000 from random web benefactors. It has quite a bit more pull and expectation than those unwashed hundreds.
- patio11 16y agohow is this any worse than ... is a question which would be better to answer privately, to a security contact. Use your imagination as to what the email would likely say. This may just be a difference of philosophy, but I don't think "It isn't really a release, so nobody would be stupid enough to actually run this on a publicly accessible server." After all, consumers of The New Hotness have a lot less incentive to think through the security implications of running it than the developers did. [Edit: And the developers apparently have a publicly accessible instance running. That decision is curious.] This will be running in production today. If very bad things happen, the TechCrunch article about it will have Diaspora in the headline. That is enough of an incentive to have a security page.
- dandelany 16y agoThanks for the response. I agree that a security page is a good, even necessary idea, it just doesn't strike me as a pressing emergency for them at the moment.
- patio11 16y agoThey're currently getting coverage on the Guardian, BBC, etc, and will get it on the New York Times within 24 hours. That is about to create an emergency for them, because being the secure, privacy-aware alternative to Facebook gives people some expectations as to how the software will work. Many of those expectations match the designed behavior. None match the software as actually implemented. They just did a media launch and they're in for their earliest users getting burned in a very painful, public manner. If this isn't an emergency, what does an emergency look like?
- bl4k 16y agoThere is no argument against having a policy for receiving, reviewing and patching security reports. It is that simple. "hundreds of other bits of (unsafe, untested) social networking code floating around the interwebs" is not a benchmark that this project should aspire to.
- danieldon 16y agoWell, there's at least one glaring security issue that should be obvious to any Rails developer.
- uptown 16y agoDid you remember to bring enough knowledge to share with the rest of the class? What glaring issue are you referring to?
- patio11 16y agoThis is the problem with public disclosure: I could tell you, but it would practically write exploit code which you could point at any one of the "Try Diaspora now!" sites popping up and do very bad things. Here, let me tell you what isn't a problem: you cannot type "system('rm -rf /')" into their username field on the signup form and wipe any machine with Diaspora installed because some idiot passed untrusted user input straight to exec. But if that were a problem, do you understand why mentioning publicly "Hey, the username field is passed straight to exec... that's sort of bad." is a bad idea? Because that lets any idiot immediately create wipe_arbitrary_diaspora_install.rb There are several vulnerabilities in Diaspora right now. They allow very bad things. There are multiple public Diaspora installations. They are all vulnerable to very bad things. I think releasing this was very, very premature.
- ErrantX 16y agoTrust me; this will not stop someone from using it. And they will be the same person that complains really loudly when it goes wrong :)
- deleted 16y ago[deleted]