6 ms·

After reading the article, also read this comment: http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/#comment-5672 http://ww

by rb2k_ 16y ago

After reading the article, also read this comment: http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/#comment-5672 http://www.kalzumeus.com/2010/09/22/security-lessons-learned... The comment negates some of the statements made in the post

jasonkester 16y ago
No, that comment just helps to explain how trivial these things would have been to work around. That's the whole point of the article, that these guys missed all the most obvious things that you need to do to secure your application. There are no deep, tricky issues explained because absolutely zero effort was needed to find a half dozen breathtakingly bad practices floating at the surface. So yes, of course it's trivially fixable. The problem is that it wasn't trivially fixed and they thought they were ready to release it.
- rb2k_ 16y ago
  Please read the whole comment I linked to. I was talking about things like the OP saying that browsers could delete things by prefetching (GET requests) or that update_attributes does a double assignment which are simply not true
  - patio11 16y ago
    I don't understand what the comment means by double assignment, but I guarantee that update_attributes will indeed let me overwrite owner_id in the manner specified. Would you like me to demonstrate this with code against a specific git revision? It isn't hard.
    - rb2k_ 16y ago
      No, I'm happy to believe you. It just seems that assumptions like the "the code doesn’t check to see if the destroy action is called by an HTTP POST or not." are incorrect and still in the post. There also isn't a proper answer to that comment so far.
  - wglb 16y ago
    Then read a reply to your comment: http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/#comment-5678 http://www.kalzumeus.com/2010/09/22/security-lessons-learned...
    - rb2k_ 16y ago
      It wasn't my reply, I just thought it was an interesting one. The original post lists a lot of samples, the reply adds some more information to those, the "reply" moves this into almost to an argumentum ad hominem. I'm just saying that it would be nice if the OP would at least delete the stuff that is just plain wrong.

by rb2k_ 16y ago

jasonkester 16y ago

No, that comment just helps to explain how trivial these things would have been to work around. That's the whole point of the article, that these guys missed all the most obvious things that you need to do to secure your application. There are no deep, tricky issues explained because absolutely zero effort was needed to find a half dozen breathtakingly bad practices floating at the surface. So yes, of course it's trivially fixable. The problem is that it wasn't trivially fixed and they thought they were ready to release it.

rb2k_ 16y ago
Please read the whole comment I linked to. I was talking about things like the OP saying that browsers could delete things by prefetching (GET requests) or that update_attributes does a double assignment which are simply not true
- patio11 16y ago
  I don't understand what the comment means by double assignment, but I guarantee that update_attributes will indeed let me overwrite owner_id in the manner specified. Would you like me to demonstrate this with code against a specific git revision? It isn't hard.
  - rb2k_ 16y ago
    No, I'm happy to believe you. It just seems that assumptions like the "the code doesn’t check to see if the destroy action is called by an HTTP POST or not." are incorrect and still in the post. There also isn't a proper answer to that comment so far.
- wglb 16y ago
  Then read a reply to your comment: http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/#comment-5678 http://www.kalzumeus.com/2010/09/22/security-lessons-learned...
  - rb2k_ 16y ago
    It wasn't my reply, I just thought it was an interesting one. The original post lists a lot of samples, the reply adds some more information to those, the "reply" moves this into almost to an argumentum ad hominem. I'm just saying that it would be nice if the OP would at least delete the stuff that is just plain wrong.