52 ms·

Rookie coding mistake prior to Gab hack came from site’s CTO

280 points by minimaxir 6y ago

deleted 6y ago
[deleted]
forgotmypw17 6y ago
I've been pretty sure for a while that Parler and Gab were both honeypots. This makes it seem even more likely.
- McGlockenshire 6y ago
  Never attribute to malice that which can equally be explained by incompetence, or something like that.
  - forgotmypw17 6y ago
    .
    - firebaze 6y ago
      Maybe they are spinoffs of reddit/facebook/twitter etc. to contain moderation cost :)
    - hddu 6y ago
      I do like your theory that it was a honeypot from the left created to produce people to attack. I would be surprised if our intelligence agencies and law enforcement didn't have a role in creating/running extremist sites. Seeing as the FBI likes to run child porn sites and infiltrate political groups that could cause instability, they are the most obvious perpetrators.
      - orblivion 6y ago
        FWIW Gab very proudly proclaims that they report things to law enforcement if they cross a legal line. I could be wrong but I would think that if the FBI was trying to entrap people they would not want to give such a warning.
        neltnerb 6y ago
        I think you are wrong, stating it prominently and repeatedly makes the warning disappear into noise for users so there's little downside and a lot of upside if it were in fact being operated by the FBI. I doubt it is though, I don't think the FBI has the capability to be frank, but even more if the FBI were operating it as a honeypot somehow I doubt that the websites would have been banned from AWS and such. I'm sure that if it were true the FBI could have easily just told AWS that the presence of extremist content was being allowed by law enforcement specifically to identify terrorists. I think the idea that it's a honeypot is a very poor fit to the available information.
      - endymi0n 6y ago
        Occam‘s razor would disagree. While it‘s certainly thinkable that it‘s a honeypot of the FBI, set up from the left (just like it‘s possible that it was Antifa who stormed the capitol posing as Trump supporters), it‘s far more likely this was a job done by nutjobs, for nutjobs. If you also think the earth is flat or the election was stolen despite literal mountains of evidence, how are you supposed to properly weigh any other rational evidence like the existence of SQL injections?
      - wrycoder 6y ago
        The leader of the supposedly white supremecist Proud Boys, Enrique Tarrio, is an Afro-Cuban who turned out to be an FBI informer. Wheels within wheels. https://www.theguardian.com/us-news/2021/jan/27/proud-boys-leader-enrique-tarrio-fbi-informant https://www.theguardian.com/us-news/2021/jan/27/proud-boys-l...
    - cmeacham98 6y ago
      > My opinion is that it's more likely than not that these sites are little more than honeypots to troll the gullible into making asses of themselves so that we have another subject for our Two Minutes of Hate. Or maybe, instead, some people really do hold extremist views and post them on the internet? I don't understand your theory here - the majority of Gab content is public already (well, behind an authwall, but otherwise public). The hack achieves nothing for these masterminds that just want to make fun of people being bigoted on the internet because they already could. > Now that data can be used against the most ferverent Republican supporters and there's no one to blame, officially, because they were "hacked". Oops! Maybe you should think twice before publicly supporting Republicans online, I guess! Do you seriously think the problem people had with some of the content on Gab is that users were "supporting Republicans"???? GP has edited their comment like 10 times so here's the version I'm replying to: > I'm one of the world's biggest fans of Hanlon's razor, and I've done so much damage to it with Gab and Parler that it looks like a hairbrush now. > My opinion is that it's more likely than not that these sites are little more than honeypots to troll the gullible into making asses of themselves so that we have another subject for our Two Minutes of Hate. > I do a lot of research on social media mechanics, and I've used both of them. I can't quite put my finger on it, but they performed and felt differently from any other sites I've used over the past 20+ years. For one thing, you could not read or see ANY comments without registering first. > I could just as easily be imagining it, of course. And they did paint a huge target on themselves. But they also made it easy to steal the data. > Now that data can be used against the most ferverent Republican supporters and there's no one to blame, officially, because they were "hacked". Oops! Maybe you should think twice before publicly supporting Republicans online, I guess! > (Not affiliated with any political party, apolitical, have friends and family who are into all different flavors. Just think it's fucked up to throw thousands of people under the bus like that, if it's true.)
    - McGlockenshire 6y ago
      I think you're encountering Poe's Law here - at some point it becomes difficult to tell the difference between a troll and someone genuinely expressing an extremist point of view. Are there trolls on Gab and Parler? For sure. Are there purestrain rabid culture warriors on Gab and Parler? Yup. Are Gab and Parler honeypots? I don't think so, but that also depends how you define "honeypot." Both exist because other social networks cracked down on distasteful content. Gab erupted during the era of cracking down on ethnonationalists and is full of wannabe nazis and 4chan-grown edgelords. Parler erupted during the era of cracking down on dangerous misinformation (QAnon, COVID denialism, the things that we now know lead to election denialism, etc etc) and if full of people that choose to believe that nonsense rather than reality. Parler was also signal boosted by political voices that intentionally framed crackdowns on distasteful content as an aspect of the ongoing culture war. Both naturally courted their respective audiences. The guy running Gab is a True Believer. Check out Gab's Twitter (heh) for some pretty questionable recent posts that blame the hack on "mentally ill trans hackers," only with a slur instead of trans, because of course there's a slur. The Mercer family bankrolls Parler. They have a long history of throwing money at causes that follow their political viewpoints. We don't have a reason to doubt that their board and and management are True Believers in their own cause as well. So, is it really a honeypot if it's honest by design?
      - new_guy 6y ago
        >The guy running Gab is a True Believer He's definitely not but he knows how to play to his audience. Instead of owning it and saying 'we messed up' it's easier to blame the 'mentally ill trans hackers'! But the 'hack' was almost certainly intentional, it's the exact same play Parler did a few weeks ago. They're both honeypots, this is the easiest way to get the data out there.
  - adolph 6y ago
    Never assume xor among different interpretations.
- GVIrish 6y ago
  Or maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. There are numerous examples of start ups and even mature companies making basic mistakes. This is easily explainable without resorting to conspiracy theories.
  - btmcnellis 6y ago
    "solarwinds123" comes to mind.
    - ratsmack 6y ago
      This comment is highly underrated.
  - eternalban 6y ago
    > maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. "Free Speech platform Gab has announced Fosco Marotto as the company’s new Chief Technical Officer (CTO). According to a blog post from the company, Marotto was formerly a software engineer, production engineer, and developer advocate during a seven-year career at Facebook. Marotto reportedly brings 23 years of industry experience to the platform along with extensive knowledge in backend infrastructure and insight that will help Gab scale as it becomes increasingly popular." CTO: https://github.com/gfosco https://github.com/gfosco Parse Server: https://github.com/parse-community/parse-server https://github.com/parse-community/parse-server Parse Server API doc snippet: "If your app is compromised, it’s not only you as the developer who suffers, but potentially the users of your app as well. Continue reading for our suggestions for sensible defaults and precautions to take before releasing your app into the wild." https://docs.parseplatform.org/rest/guide/#security https://docs.parseplatform.org/rest/guide/#security Per Ars, he removed security code.
    - rsynnott 6y ago
      I mean, "worked at Facebook for a while" isn't a guarantee of competence. And some security boilerplate text isn't a guarantee of being good at security.
- JohnTHaller 6y ago
  Malice or incompetence? Why choose? They've got both!
orblivion 6y ago
No surprise to me. At one point when they had an API, I could follow and see posts from "locked" accounts that I couldn't see from the website. I reported it and they said something like "oh yeah we're making a lot of changes right now" and of course never fixed it (until they decommed their API which effectively fixes it). They're up against the world, and they're spreading themselves very thin, aiming to replace all of the "big tech" use cases, for better or for worse. They hate Silicon Valley but they "move fast and break things" more than anybody, arguably by necessity. I'll cut them some slack if their public platforms have some bugs, but they shouldn't do anything with sensitive user data.
- deleted 6y ago
  [deleted]
- federona 6y ago
  With cancel culture security of all personal and public communication is now a matter of making a living. Especially in this domain. This is a fact, if you wish it censored you are a liar.
  - orblivion 6y ago
    I can't quite parse exactly what your point is, but if people want to communicate securely they should use Signal or something.
    - federona 6y ago
      My point is that if someone hacks and steals all the data on your social media site then they can expose random people by doing analysis on the site's data and make individuals lose their job. Whether that is something good or bad depends on your point of view. Should the consequences of having opinions against mainstream views and venting about them in public make you liable for those views to your employer? Sometimes the venting is honestly stating your feeling about the subject which causes gasps, the firing of the recent Mandalorian star comes to mind.
NotPavlovsDog 6y ago
This leaves a bad taste as to what the "forensics" could uncover just due to the open development model. It's nice to be the prophet of evident mistakes when the trail is easy to follow, even if you can't exactly master the lingo. From the article: >The change, which in the parlance of software development is known as a “git commit,” It was a change. Parlance commit. Parlance, per tool used, "git commit" (and then check as to tool standard parlance). My point being, what do we routinely hide thanks to not coding in public? What do engineers routinely hide, when possible? I would rather, as an engineer, discuss core issues we can fundamentally address: compromising on inadequate workflows (including core architecture and paradigms), commitment to over-delivery, and the ever-dooming deadlines. What victories of the CTO went ignored, as part of "the job"? It's nice to be smart when you have regular 8 hours of sleep. I've had enough stress to remember just how idiotic many of my decisions were, as a "leader". Most of them went ignored just because we were covered by being invisible, by design. Morally, I can't judge this CTO. If you look at your coding history, can you?
- minimaxir 6y ago
  There's a difference between commiting hacky-but-working code during an Agile sprint and commiting code that allows unsanitized input to a SQL query.
  - NotPavlovsDog 6y ago
    Yes, but then, really, the fundamental popular software paradigm is not just unsanitized but unsanitary. The models for sanitary-by-design are there. It's just math. The core leadership behind inadequate decisions, often above the CTO, are frequently of the "don't care about the math, just the numbers" type. Perhaps the CTO raised concerns. Maybe, not. But if we want an open engineering culture in software, unlike "applied engineering" in other industries, we should actively oppose punishing those that embrace open-to-peer-review models, even when the openness backfires and the history gets removed by the open workflow participants. We may still have a fragile and unique culture in software, that perhaps contradicts past history such as engineering in construction (look up "corruption construction") or the unique corruption of medicine ("sugar lobby", "food pyramid"). Despite bad decisions and the fumbled cover-up, the attempt to perform in public on their part is valuable to me. We don't have easy access to which of the doctors took money to publish "research" that "calories are the same", pushing for more carbohydrates in diets. This may translate to multiple people, people you might personally know, dying of diabetes. With open software, we get the names. This should not reward click-bait media witch-hunting.
nicoffeine 6y ago
> Gab had long provided commits at https://code.gab.com/ https://code.gab.com/. Then, on Monday, the site suddenly removed all commits—including the ones that created and then fixed the critical SQL injection vulnerability. In their place, Gab provided source code in the form of a Zip archive file that was protected by the password “JesusChristIsKingTrumpWonTheElection” (minus the quotation marks). Hopefully this eliminates any doubt on Gab's real mission. It isn't free speech.
- eznzt 6y ago
  I don't understand how someone removing the contents they themselves posted goes against free speech?
  - Malp 6y ago
    I believe the parent is commenting on the archive's password and where the company leans ideologically
- kevingadd 6y ago
  It is always interesting when people complaining about having their speech suppressed turn out to hold (in the former case) extremely orthodox, standard views or (in the latter case) fairly common views, instead of obscure or actively unpopular points of view. (I'd certainly appreciate it if the latter weren't common, but it polls shockingly well in the US right now)
  - im3w1l 6y ago
    That just makes it worse doesn't it? When the suppression has increased in scope to include "standard" views?
    - kevingadd 6y ago
      How would you functionally suppress the majority? What would that look like? What would the actual negative effect of it be? If 40% of the population believes something, keeping them from posting on Twitter isn't going to magically cause their belief system to evaporate. They'll at most feel persecuted and go somewhere else. These mainstream views are represented all over broadcast TV and in the US house and senate, even if someone gets their account shadowbanned on Twitter for saying it using some expletives. Naturally, most of these majority belief systems and viewpoints aren't functionally being suppressed, because many employees at these companies hold the same views. It's usually just the extremist stuff, and some of the people who bail from Twitter to head to Gab or Parler end up causing trouble there too by being so extreme they run afoul of those sites' incredibly lax and generous policies. I could understand this complaint if the government was applying force or other punishments (financial penalties, etc) to suppress a majority viewpoint, but in this case it's private corporations exercising their rights to exclude majority speech from their platform. This is an important right for them to have regardless of how popular a view is. It wasn't that long ago that polling numbers showed the average American supported the Kent State massacre, and it wasn't that long ago that interracial marriage was illegal in parts of the US. The nature of "majority views" and the impact of reducing their visibility is difficult to grapple with.
hn_throwaway_99 6y ago
On a related note, I've become a gigantic fan of Slonik, https://github.com/gajus/slonik https://github.com/gajus/slonik, which simultaneously (a) makes it extremely difficult to expose SQL injection attacks while (b) still letting you write SQL in a very "natural" way using template literals. It takes advantage of a somewhat-not-well-known feature of Javascript template literals in that you can apply functions to them, e.g. sql`SELECT foo FROM bar WHERE id = ${userEnteredValue}`. No need to manually escape userEnteredValue, the sql template literal function does it for you.
- WrtCdEvrydy 6y ago
  honestly, use prepared statements... You get the same benefit of "template literals" but the data and query are separated at the DB level. The DB knows what is data and what is query therefore any attempt at escaping from SQL will be quashed there.
  - byhemechi 6y ago
    That's what the library does. It just uses tagged template literals[1] so that it "feels" like you're writing a template string, while really it's a prepared statement. [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
wwww4all 6y ago
Look up gell-mann amnesia effect. The article doesn’t know much about OWASP practices. SQL injection bugs are not rookie mistakes, it’s prevalent in many current and future applications. Look into Vtech sql injection hack, a large company with lots of resources had similar bug. Look at previous hacks, solar winds hack, Sony hack, were all preventable common hacks.
- outworlder 6y ago
  > a large company with lots of resources had similar bug. Large companies are even more likely to run into this sort of issue. It's still a rookie mistake. Any given well established company will contain a large number of 'rookies'. It's up to the company and everyone involved to make sure these are caught before going into production.
- jahabrewer 6y ago
  A mistake can be both "rookie" and widely prevalent. That's exactly how I'd describe SQL injection.
  - wwww4all 6y ago
    Go ahead and try to implement a fix to sql injection bug in any of your systems. I can guarantee there’s a sql injection issue somewhere. The reason it’s so prevalent is because it’s not a rookie issue and very difficult to fix properly, without impacting significant changes. That’s why OWASP has it as huge part of security analysis and resolution.
    - rsynnott 6y ago
      > I can guarantee there’s a sql injection issue somewhere. This class of sql injection issues can be eliminated by simply enforcing that all queries are string literals.
      - tehjoker 6y ago
        Concur. Adding parameters to a query is what a "bind" is for.
GongOfFour 6y ago
All of this query is safely accomplishable via composable query building in AREL going back to Rails 4.2 (though it's much nice in 5+). Silly stuff.
yrgulation 6y ago
Ok so if in 2021 a “cto” or developer, let alone former facebook developer, doesn't use bound and escaped parameters as a minimum then that developer needs to take a break and catch up on things.
mmastrac 6y ago
Is their source tree under AGPL3? From a mirrored copy of what purports to be a clone from before it was pulled down. https://git.rip/gab/gab-social/-/blob/develop/LICENSE https://git.rip/gab/gab-social/-/blob/develop/LICENSE This will make things interesting for them going forward.
- kstrauser 6y ago
  Yes. It was forked from https://github.com/tootsuite/mastodon https://github.com/tootsuite/mastodon .
stickfigure 6y ago
> Developers: Sanitize user input No, don't sanitize user input. Don't trust it, which is a big difference. Use bound parameters and this problem goes away.
- acdha 6y ago
  A better answer is both not trusting it and validating it: parameters prevent data from being interpreted as code but validation is also important because allowing unexpected inputs could lead to other vulnerabilities (e.g. XSS in an error message or a partially-generated page) or complications when making changes in the future if you learn that common clients have come to rely on your sanitization logic cleaning up their requests.
  - deleted 6y ago
    [deleted]
  - bcrosby95 6y ago
    Please no. Trying to validate your input for any format that currently exists or may exist in the future is really wrong. You need to handle this at the edges - for SQL this is using prepared statements, for XSS its about using a framework that makes the correct choice (default escape HTML entities). Anything else is madness. Of course, if you're dealing with legacy systems you might have to do something tragic like not allow people to put quotes in passwords.
    - acdha 6y ago
      I think you might have misunderstood my comment even on the second reply after the ruder version you deleted: validation at edge is exactly what I was suggesting. If you're writing your code assuming a numeric ID, using placeholders means that it won't be exploitable if someone submits a non-numeric value but you're still at risk as described and likely other problems. If you validate it immediately and send an HTTP 400 for anything which isn't a valid number in whatever range you support, you don't have to worry about later finding out that someone came up with a clever way to do XSS, log splitting, etc. attacks even if they couldn't get at the database directly.
tomc1985 6y ago
> “Sadly Rails documentation doesn't warn you about this pitfall, [...]" said Dmitry Borodaenko, a former production engineer at Facebook who brought the commit to my attention wrote in an email. This is completely and utterly untrue. https://guides.rubyonrails.org/security.html#sql-injection https://guides.rubyonrails.org/security.html#sql-injection shows examples that are exactly like the code in question in that commit Bound parameters were a new thing like 15 years ago.
- kstrauser 6y ago
  Maybe they were new 15 years ago in Rails, but I was using them in Perl in the mid-90s. There is no excuse for writing an SQL injection in 2021. Zero. None. And if you're in the position to write code that'll be deployed to production, you darn well better have it reviewed by peers before it's merged. If the CTO did this and worked around the developers, he's a freaking idiot. If the engineers saw this and signed off because he's the CTO, they're freaking idiots. I wouldn't ordinarily be this harsh about it, but come on. SQL injections in 2021? That's astoundingly bad.
  - rsynnott 6y ago
    > Maybe they were new 15 years ago in Rails That's when Rails came out :) I'm fairly sure ActiveRecord has always supported them.
  - dragonwriter 6y ago
    > Maybe they were new 15 years ago in Rails, Well, Rails was < 2 years old then, so everything was new in Rails.
  - ratsmack 6y ago
    I would think a Ruby code fuzzer would have caught something like that... if they have used one.
    - kstrauser 6y ago
      Generally the teams who would be using a fuzzer are unlikely to have made that particular mistake in the first place.
Lukas_Skywalker 6y ago
> „ Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement a programming idiom that protects against SQL injection attacks.“ This is not correct. The mistake was to use ‚find_by_sql‘ without parametrizing the query. The mentioned reject and filter methods are merely skipping some of the data the query returns.
- Delk 6y ago
  The previous code that used those functions probably did prevent a SQL injection as a side effect, as using them avoided making a direct SQL query at all. But you're of course correct that it's not the replacement of an ORM call with SQL that's the problem.
abvdasker 6y ago
This is bad code and it's a little surprising to me that a former Facebook engineer wrote it (and subsequently became the CTO). It's been a while since I wrote any Rails but the offenses that jump out just from a cursory inspection: - large raw SQL query which could almost certainly be accomplished in a more idiomatic way with AREL or ActiveRecord - no user input sanitizing - using a regular string literal for a large text block instead of a Ruby here document - leaving a mess of commented-out code at the bottom of the method Apparently Gab isn't exactly hiring the best and brightest.
- AmericanChopper 6y ago
  At a glance my first though was "there's probably SQLi here", but it's not obvious to me that attacker controlled parameters could actually be used to exploit this. The ID and pagination parameters all seem to be ints, and it's not obvious to me that an attacker could turn them into arbitrary strings. Is custom_filters.phrase the attacker controlled string?
  - kemayo 6y ago
    There's nothing in that code that says that any of those parameters have to be ints. They're certainly expecting ints, but there's no casts in that code that would enforce that. Presumably somewhere upstream they're just passing directly from the POST/querystring into these API functions. Remember: Ruby is a dynamically typed language.
    - mannerheim 6y ago
      Sounds like a place where static types would have helped... Not that one should rely entirely on them for these sorts of situations.
      - 1_player 6y ago
        Static types don't help with string interpolation.
bsder 6y ago
People like to slag on other people's programming skills, but are you sure that all code you wrote doesn't have some absolutely boneheaded mistake in it? I like to think I'm pretty good, but I would never claim that and certainly wouldn't put money on it. I'm sure I've got boneheaded mistakes scattered through my code. Sometimes you're having a bad day. Sometimes the reviewers are a little pressed for time. It doesn't take much for really stupid code to slide through as long as it appears to work. Glass houses and all that ...
- TameAntelope 6y ago
  I've completely given up judging technical decisions as representations of the person who made them's skill or ability. I still judge the technical decision on how it's impacting the system today (specifically around whether or not it's sustainable), but trying to ascribe intent or brand something as "dumb" is almost always done without the relevant information that went into the decision being made.
  - bsder 6y ago
    This is the problem being in a field (programming) that doesn't actually value experience. I got this knocked into me by a very senior engineer when I complained about some really silly circuit on an older version of a microprocessor. His comment: "Okay, let's design that adder better. Oh, by the way, you only have two layers of metal in that technology. Let's walk through the options." My response: "Uh, no. We don't need to. There are exactly 3 options and only one that works." His response: "And now you know why the engineers prior to you made that decision. Don't assume your predecessors were untouchable geniuses, but don't assume they were moronic idiots, either. Just like you, they had a job to do, did it, and, most importantly, shipped it."
- danaliv 6y ago
  I am 100% sure that none of the code I’ve written in the past 20 years interpolates user input into SQL. There is absolutely no excuse for this, and there hasn’t been for a very long time. Prepared statements have been a thing for longer than half the users of this website have been alive. Remember Bobby Tables? That was 2007.
ulisesrmzroche 6y ago
The irony tastes like candy. More proof that we totally live in a simulation.
015a 6y ago
Fuck this story, and shame on ArsTechnica for publishing it. We shouldn't call out and shame individuals for making a mistake like this. Any company which even does something like this internally is toxic; the blame lies on the company and the process, not the individual. The flimsy excuse "oh, theys a bawd bawd company filled with icky people" doesn't hold water; we're talking about basic decency here. You want to write a story about the commit? Hold the company responsible? Encourage processes and procedures which would have caught this? That's fine. Blur out the names. Ars isn't a tabloid, but they're acting like one; there are real, serious consequences for shit like this. You didn't set out to create the perfect ammunition for someone within a company arguing against the open sourcing of some project, but here it is. I'm physically disgusted by this reporting.
- ratsmack 6y ago
  Remember that ArsTechnica does reporting for money. The more sensational, the more clicks. I think National Inquirer and The Sun uses the same tact.
  - uniqueid 6y ago
    If I were a journalist who wanted to rake in money it wouldn't occur to me to include dull screenshots of diffs and commit messages. For that matter, it wouldn't occur to me to work for a niche outfit like Ars Technica either. My dentist probably earns more than a tech columnist.
- smt88 6y ago
  What about when people went after the security head of Equifax following their massive breach that ruined a few lives? Was that unfair?
  - spydum 6y ago
    Incredibly unfair, the character assassinations are totally uncalled for. The infosec community has a real problem with tearing each other apart. So much so, that journalists now also think it's okay. * Just a reminder, they were tearing into the CISO for having a liberal arts degree (as if college degrees actually prepared you for anything..). Totally agree here: blame the company and the leadership for not investing in the right processes and tools. People will always make mistakes.
fock 6y ago
well, even if it's rightwing idiots it seems you can go relatively far. We just deleted all our labs data because a colleague didn't get that you had to unmount and destroy the existing (benchmark) zpool to create a new one when finally setting up some new drives. Didn't ask for help or anything but went straight to "fix" it with `nvme format` on the raw devices. Hope the backup works at this point (that's the other colleague who accused me of paranoia when I mentioned 2FA with yubikeys for admins and then silently removed his smart outlet from the network once I ran a powercycle on it...).
__abc 6y ago
Oooooof. Rails (which I think they may be using) makes sanitization fairly easy.
naebother 6y ago
> Besides the commit raising questions about Gab’s process for developing secure code, the social media site is also facing criticism for removing the commits from its website. Critics say the move violates terms of the Affero General Public License, which governs Gab’s reuse of Mastodon, an open source software package for hosting social networking platforms. Lmao, that's not how AGPL works. Although, it would be pretty funny if a license explicitly required you to post all your Ls for public ridicule.
- dragonwriter 6y ago
  > Lmao, that's not how AGPL works. The GPL family, including the AGPL, defines source code that must be provided as “the preferred form for making changes”; if the form the distributor uses is a VCS repository with full history, publishing either static snapshots or a repository with an expurgated history could arguably be a violation of both the letter and the spirit of the licenses. The language of the licenses makes the requirement dependent on actual development practices, not fixed, and that's not an accident.
  - naebother 6y ago
    I'm guessing you're referring to the first sentence in section 1: > The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. I don't think that's referring to the method by which I make changes or manage those changes. It's simply trying to make it clear that source-code is something that should be in a form you can actually change, and not something obfuscated. e.g. minified, transpiled, object-code, etc. The second sentence gives the first more context. The spirit of all GNU licenses is that the end-user should have the freedom and ability to understand or modify software that's *distributed* to them for themselves. It has nothing to do with having a full history of the source-code available. What does full history even mean? I'd like every auto-save to every LGPL licensed file, please.
trhway 6y ago
Looking at that mess of a code (even without the cherry top of injection) I kind of wonder why ruby is hip and php isn't.
deleted 6y ago
[deleted]
heyitsjlac 6y ago
The dude who got a tummy ache from this was even funnier than the story itself. This is a great site.

280 points by minimaxir 6y ago

deleted 6y ago

[deleted]

forgotmypw17 6y ago

I've been pretty sure for a while that Parler and Gab were both honeypots. This makes it seem even more likely.

McGlockenshire 6y ago
Never attribute to malice that which can equally be explained by incompetence, or something like that.
- forgotmypw17 6y ago
  .
  - firebaze 6y ago
    Maybe they are spinoffs of reddit/facebook/twitter etc. to contain moderation cost :)
  - hddu 6y ago
    I do like your theory that it was a honeypot from the left created to produce people to attack. I would be surprised if our intelligence agencies and law enforcement didn't have a role in creating/running extremist sites. Seeing as the FBI likes to run child porn sites and infiltrate political groups that could cause instability, they are the most obvious perpetrators.
    - orblivion 6y ago
      FWIW Gab very proudly proclaims that they report things to law enforcement if they cross a legal line. I could be wrong but I would think that if the FBI was trying to entrap people they would not want to give such a warning.
      - neltnerb 6y ago
        I think you are wrong, stating it prominently and repeatedly makes the warning disappear into noise for users so there's little downside and a lot of upside if it were in fact being operated by the FBI. I doubt it is though, I don't think the FBI has the capability to be frank, but even more if the FBI were operating it as a honeypot somehow I doubt that the websites would have been banned from AWS and such. I'm sure that if it were true the FBI could have easily just told AWS that the presence of extremist content was being allowed by law enforcement specifically to identify terrorists. I think the idea that it's a honeypot is a very poor fit to the available information.
    - endymi0n 6y ago
      Occam‘s razor would disagree. While it‘s certainly thinkable that it‘s a honeypot of the FBI, set up from the left (just like it‘s possible that it was Antifa who stormed the capitol posing as Trump supporters), it‘s far more likely this was a job done by nutjobs, for nutjobs. If you also think the earth is flat or the election was stolen despite literal mountains of evidence, how are you supposed to properly weigh any other rational evidence like the existence of SQL injections?
    - wrycoder 6y ago
      The leader of the supposedly white supremecist Proud Boys, Enrique Tarrio, is an Afro-Cuban who turned out to be an FBI informer. Wheels within wheels. https://www.theguardian.com/us-news/2021/jan/27/proud-boys-leader-enrique-tarrio-fbi-informant https://www.theguardian.com/us-news/2021/jan/27/proud-boys-l...
  - cmeacham98 6y ago
    > My opinion is that it's more likely than not that these sites are little more than honeypots to troll the gullible into making asses of themselves so that we have another subject for our Two Minutes of Hate. Or maybe, instead, some people really do hold extremist views and post them on the internet? I don't understand your theory here - the majority of Gab content is public already (well, behind an authwall, but otherwise public). The hack achieves nothing for these masterminds that just want to make fun of people being bigoted on the internet because they already could. > Now that data can be used against the most ferverent Republican supporters and there's no one to blame, officially, because they were "hacked". Oops! Maybe you should think twice before publicly supporting Republicans online, I guess! Do you seriously think the problem people had with some of the content on Gab is that users were "supporting Republicans"???? GP has edited their comment like 10 times so here's the version I'm replying to: > I'm one of the world's biggest fans of Hanlon's razor, and I've done so much damage to it with Gab and Parler that it looks like a hairbrush now. > My opinion is that it's more likely than not that these sites are little more than honeypots to troll the gullible into making asses of themselves so that we have another subject for our Two Minutes of Hate. > I do a lot of research on social media mechanics, and I've used both of them. I can't quite put my finger on it, but they performed and felt differently from any other sites I've used over the past 20+ years. For one thing, you could not read or see ANY comments without registering first. > I could just as easily be imagining it, of course. And they did paint a huge target on themselves. But they also made it easy to steal the data. > Now that data can be used against the most ferverent Republican supporters and there's no one to blame, officially, because they were "hacked". Oops! Maybe you should think twice before publicly supporting Republicans online, I guess! > (Not affiliated with any political party, apolitical, have friends and family who are into all different flavors. Just think it's fucked up to throw thousands of people under the bus like that, if it's true.)
  - McGlockenshire 6y ago
    I think you're encountering Poe's Law here - at some point it becomes difficult to tell the difference between a troll and someone genuinely expressing an extremist point of view. Are there trolls on Gab and Parler? For sure. Are there purestrain rabid culture warriors on Gab and Parler? Yup. Are Gab and Parler honeypots? I don't think so, but that also depends how you define "honeypot." Both exist because other social networks cracked down on distasteful content. Gab erupted during the era of cracking down on ethnonationalists and is full of wannabe nazis and 4chan-grown edgelords. Parler erupted during the era of cracking down on dangerous misinformation (QAnon, COVID denialism, the things that we now know lead to election denialism, etc etc) and if full of people that choose to believe that nonsense rather than reality. Parler was also signal boosted by political voices that intentionally framed crackdowns on distasteful content as an aspect of the ongoing culture war. Both naturally courted their respective audiences. The guy running Gab is a True Believer. Check out Gab's Twitter (heh) for some pretty questionable recent posts that blame the hack on "mentally ill trans hackers," only with a slur instead of trans, because of course there's a slur. The Mercer family bankrolls Parler. They have a long history of throwing money at causes that follow their political viewpoints. We don't have a reason to doubt that their board and and management are True Believers in their own cause as well. So, is it really a honeypot if it's honest by design?
    - new_guy 6y ago
      >The guy running Gab is a True Believer He's definitely not but he knows how to play to his audience. Instead of owning it and saying 'we messed up' it's easier to blame the 'mentally ill trans hackers'! But the 'hack' was almost certainly intentional, it's the exact same play Parler did a few weeks ago. They're both honeypots, this is the easiest way to get the data out there.
- adolph 6y ago
  Never assume xor among different interpretations.
GVIrish 6y ago
Or maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. There are numerous examples of start ups and even mature companies making basic mistakes. This is easily explainable without resorting to conspiracy theories.
- btmcnellis 6y ago
  "solarwinds123" comes to mind.
  - ratsmack 6y ago
    This comment is highly underrated.
- eternalban 6y ago
  > maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. "Free Speech platform Gab has announced Fosco Marotto as the company’s new Chief Technical Officer (CTO). According to a blog post from the company, Marotto was formerly a software engineer, production engineer, and developer advocate during a seven-year career at Facebook. Marotto reportedly brings 23 years of industry experience to the platform along with extensive knowledge in backend infrastructure and insight that will help Gab scale as it becomes increasingly popular." CTO: https://github.com/gfosco https://github.com/gfosco Parse Server: https://github.com/parse-community/parse-server https://github.com/parse-community/parse-server Parse Server API doc snippet: "If your app is compromised, it’s not only you as the developer who suffers, but potentially the users of your app as well. Continue reading for our suggestions for sensible defaults and precautions to take before releasing your app into the wild." https://docs.parseplatform.org/rest/guide/#security https://docs.parseplatform.org/rest/guide/#security Per Ars, he removed security code.
  - rsynnott 6y ago
    I mean, "worked at Facebook for a while" isn't a guarantee of competence. And some security boilerplate text isn't a guarantee of being good at security.
JohnTHaller 6y ago
Malice or incompetence? Why choose? They've got both!

orblivion 6y ago

No surprise to me. At one point when they had an API, I could follow and see posts from "locked" accounts that I couldn't see from the website. I reported it and they said something like "oh yeah we're making a lot of changes right now" and of course never fixed it (until they decommed their API which effectively fixes it). They're up against the world, and they're spreading themselves very thin, aiming to replace all of the "big tech" use cases, for better or for worse. They hate Silicon Valley but they "move fast and break things" more than anybody, arguably by necessity. I'll cut them some slack if their public platforms have some bugs, but they shouldn't do anything with sensitive user data.

deleted 6y ago
[deleted]
federona 6y ago
With cancel culture security of all personal and public communication is now a matter of making a living. Especially in this domain. This is a fact, if you wish it censored you are a liar.
- orblivion 6y ago
  I can't quite parse exactly what your point is, but if people want to communicate securely they should use Signal or something.
  - federona 6y ago
    My point is that if someone hacks and steals all the data on your social media site then they can expose random people by doing analysis on the site's data and make individuals lose their job. Whether that is something good or bad depends on your point of view. Should the consequences of having opinions against mainstream views and venting about them in public make you liable for those views to your employer? Sometimes the venting is honestly stating your feeling about the subject which causes gasps, the firing of the recent Mandalorian star comes to mind.

NotPavlovsDog 6y ago

This leaves a bad taste as to what the "forensics" could uncover just due to the open development model. It's nice to be the prophet of evident mistakes when the trail is easy to follow, even if you can't exactly master the lingo. From the article: >The change, which in the parlance of software development is known as a “git commit,” It was a change. Parlance commit. Parlance, per tool used, "git commit" (and then check as to tool standard parlance). My point being, what do we routinely hide thanks to not coding in public? What do engineers routinely hide, when possible? I would rather, as an engineer, discuss core issues we can fundamentally address: compromising on inadequate workflows (including core architecture and paradigms), commitment to over-delivery, and the ever-dooming deadlines. What victories of the CTO went ignored, as part of "the job"? It's nice to be smart when you have regular 8 hours of sleep. I've had enough stress to remember just how idiotic many of my decisions were, as a "leader". Most of them went ignored just because we were covered by being invisible, by design. Morally, I can't judge this CTO. If you look at your coding history, can you?

minimaxir 6y ago
There's a difference between commiting hacky-but-working code during an Agile sprint and commiting code that allows unsanitized input to a SQL query.
- NotPavlovsDog 6y ago
  Yes, but then, really, the fundamental popular software paradigm is not just unsanitized but unsanitary. The models for sanitary-by-design are there. It's just math. The core leadership behind inadequate decisions, often above the CTO, are frequently of the "don't care about the math, just the numbers" type. Perhaps the CTO raised concerns. Maybe, not. But if we want an open engineering culture in software, unlike "applied engineering" in other industries, we should actively oppose punishing those that embrace open-to-peer-review models, even when the openness backfires and the history gets removed by the open workflow participants. We may still have a fragile and unique culture in software, that perhaps contradicts past history such as engineering in construction (look up "corruption construction") or the unique corruption of medicine ("sugar lobby", "food pyramid"). Despite bad decisions and the fumbled cover-up, the attempt to perform in public on their part is valuable to me. We don't have easy access to which of the doctors took money to publish "research" that "calories are the same", pushing for more carbohydrates in diets. This may translate to multiple people, people you might personally know, dying of diabetes. With open software, we get the names. This should not reward click-bait media witch-hunting.

nicoffeine 6y ago

> Gab had long provided commits at https://code.gab.com/ https://code.gab.com/. Then, on Monday, the site suddenly removed all commits—including the ones that created and then fixed the critical SQL injection vulnerability. In their place, Gab provided source code in the form of a Zip archive file that was protected by the password “JesusChristIsKingTrumpWonTheElection” (minus the quotation marks). Hopefully this eliminates any doubt on Gab's real mission. It isn't free speech.

eznzt 6y ago
I don't understand how someone removing the contents they themselves posted goes against free speech?
- Malp 6y ago
  I believe the parent is commenting on the archive's password and where the company leans ideologically
kevingadd 6y ago
It is always interesting when people complaining about having their speech suppressed turn out to hold (in the former case) extremely orthodox, standard views or (in the latter case) fairly common views, instead of obscure or actively unpopular points of view. (I'd certainly appreciate it if the latter weren't common, but it polls shockingly well in the US right now)
- im3w1l 6y ago
  That just makes it worse doesn't it? When the suppression has increased in scope to include "standard" views?
  - kevingadd 6y ago
    How would you functionally suppress the majority? What would that look like? What would the actual negative effect of it be? If 40% of the population believes something, keeping them from posting on Twitter isn't going to magically cause their belief system to evaporate. They'll at most feel persecuted and go somewhere else. These mainstream views are represented all over broadcast TV and in the US house and senate, even if someone gets their account shadowbanned on Twitter for saying it using some expletives. Naturally, most of these majority belief systems and viewpoints aren't functionally being suppressed, because many employees at these companies hold the same views. It's usually just the extremist stuff, and some of the people who bail from Twitter to head to Gab or Parler end up causing trouble there too by being so extreme they run afoul of those sites' incredibly lax and generous policies. I could understand this complaint if the government was applying force or other punishments (financial penalties, etc) to suppress a majority viewpoint, but in this case it's private corporations exercising their rights to exclude majority speech from their platform. This is an important right for them to have regardless of how popular a view is. It wasn't that long ago that polling numbers showed the average American supported the Kent State massacre, and it wasn't that long ago that interracial marriage was illegal in parts of the US. The nature of "majority views" and the impact of reducing their visibility is difficult to grapple with.

hn_throwaway_99 6y ago

On a related note, I've become a gigantic fan of Slonik, https://github.com/gajus/slonik https://github.com/gajus/slonik, which simultaneously (a) makes it extremely difficult to expose SQL injection attacks while (b) still letting you write SQL in a very "natural" way using template literals. It takes advantage of a somewhat-not-well-known feature of Javascript template literals in that you can apply functions to them, e.g. sql`SELECT foo FROM bar WHERE id = ${userEnteredValue}`. No need to manually escape userEnteredValue, the sql template literal function does it for you.

WrtCdEvrydy 6y ago
honestly, use prepared statements... You get the same benefit of "template literals" but the data and query are separated at the DB level. The DB knows what is data and what is query therefore any attempt at escaping from SQL will be quashed there.
- byhemechi 6y ago
  That's what the library does. It just uses tagged template literals[1] so that it "feels" like you're writing a template string, while really it's a prepared statement. [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

wwww4all 6y ago

Look up gell-mann amnesia effect. The article doesn’t know much about OWASP practices. SQL injection bugs are not rookie mistakes, it’s prevalent in many current and future applications. Look into Vtech sql injection hack, a large company with lots of resources had similar bug. Look at previous hacks, solar winds hack, Sony hack, were all preventable common hacks.

outworlder 6y ago
> a large company with lots of resources had similar bug. Large companies are even more likely to run into this sort of issue. It's still a rookie mistake. Any given well established company will contain a large number of 'rookies'. It's up to the company and everyone involved to make sure these are caught before going into production.
jahabrewer 6y ago
A mistake can be both "rookie" and widely prevalent. That's exactly how I'd describe SQL injection.
- wwww4all 6y ago
  Go ahead and try to implement a fix to sql injection bug in any of your systems. I can guarantee there’s a sql injection issue somewhere. The reason it’s so prevalent is because it’s not a rookie issue and very difficult to fix properly, without impacting significant changes. That’s why OWASP has it as huge part of security analysis and resolution.
  - rsynnott 6y ago
    > I can guarantee there’s a sql injection issue somewhere. This class of sql injection issues can be eliminated by simply enforcing that all queries are string literals.
    - tehjoker 6y ago
      Concur. Adding parameters to a query is what a "bind" is for.

GongOfFour 6y ago

All of this query is safely accomplishable via composable query building in AREL going back to Rails 4.2 (though it's much nice in 5+). Silly stuff.

yrgulation 6y ago

Ok so if in 2021 a “cto” or developer, let alone former facebook developer, doesn't use bound and escaped parameters as a minimum then that developer needs to take a break and catch up on things.

mmastrac 6y ago

Is their source tree under AGPL3? From a mirrored copy of what purports to be a clone from before it was pulled down. https://git.rip/gab/gab-social/-/blob/develop/LICENSE https://git.rip/gab/gab-social/-/blob/develop/LICENSE This will make things interesting for them going forward.

kstrauser 6y ago
Yes. It was forked from https://github.com/tootsuite/mastodon https://github.com/tootsuite/mastodon .

stickfigure 6y ago

> Developers: Sanitize user input No, don't sanitize user input. Don't trust it, which is a big difference. Use bound parameters and this problem goes away.

acdha 6y ago
A better answer is both not trusting it and validating it: parameters prevent data from being interpreted as code but validation is also important because allowing unexpected inputs could lead to other vulnerabilities (e.g. XSS in an error message or a partially-generated page) or complications when making changes in the future if you learn that common clients have come to rely on your sanitization logic cleaning up their requests.
- deleted 6y ago
  [deleted]
- bcrosby95 6y ago
  Please no. Trying to validate your input for any format that currently exists or may exist in the future is really wrong. You need to handle this at the edges - for SQL this is using prepared statements, for XSS its about using a framework that makes the correct choice (default escape HTML entities). Anything else is madness. Of course, if you're dealing with legacy systems you might have to do something tragic like not allow people to put quotes in passwords.
  - acdha 6y ago
    I think you might have misunderstood my comment even on the second reply after the ruder version you deleted: validation at edge is exactly what I was suggesting. If you're writing your code assuming a numeric ID, using placeholders means that it won't be exploitable if someone submits a non-numeric value but you're still at risk as described and likely other problems. If you validate it immediately and send an HTTP 400 for anything which isn't a valid number in whatever range you support, you don't have to worry about later finding out that someone came up with a clever way to do XSS, log splitting, etc. attacks even if they couldn't get at the database directly.

tomc1985 6y ago

> “Sadly Rails documentation doesn't warn you about this pitfall, [...]" said Dmitry Borodaenko, a former production engineer at Facebook who brought the commit to my attention wrote in an email. This is completely and utterly untrue. https://guides.rubyonrails.org/security.html#sql-injection https://guides.rubyonrails.org/security.html#sql-injection shows examples that are exactly like the code in question in that commit Bound parameters were a new thing like 15 years ago.

kstrauser 6y ago
Maybe they were new 15 years ago in Rails, but I was using them in Perl in the mid-90s. There is no excuse for writing an SQL injection in 2021. Zero. None. And if you're in the position to write code that'll be deployed to production, you darn well better have it reviewed by peers before it's merged. If the CTO did this and worked around the developers, he's a freaking idiot. If the engineers saw this and signed off because he's the CTO, they're freaking idiots. I wouldn't ordinarily be this harsh about it, but come on. SQL injections in 2021? That's astoundingly bad.
- rsynnott 6y ago
  > Maybe they were new 15 years ago in Rails That's when Rails came out :) I'm fairly sure ActiveRecord has always supported them.
- dragonwriter 6y ago
  > Maybe they were new 15 years ago in Rails, Well, Rails was < 2 years old then, so everything was new in Rails.
- ratsmack 6y ago
  I would think a Ruby code fuzzer would have caught something like that... if they have used one.
  - kstrauser 6y ago
    Generally the teams who would be using a fuzzer are unlikely to have made that particular mistake in the first place.

Lukas_Skywalker 6y ago

> „ Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement a programming idiom that protects against SQL injection attacks.“ This is not correct. The mistake was to use ‚find_by_sql‘ without parametrizing the query. The mentioned reject and filter methods are merely skipping some of the data the query returns.

Delk 6y ago
The previous code that used those functions probably did prevent a SQL injection as a side effect, as using them avoided making a direct SQL query at all. But you're of course correct that it's not the replacement of an ORM call with SQL that's the problem.

abvdasker 6y ago

This is bad code and it's a little surprising to me that a former Facebook engineer wrote it (and subsequently became the CTO). It's been a while since I wrote any Rails but the offenses that jump out just from a cursory inspection: - large raw SQL query which could almost certainly be accomplished in a more idiomatic way with AREL or ActiveRecord - no user input sanitizing - using a regular string literal for a large text block instead of a Ruby here document - leaving a mess of commented-out code at the bottom of the method Apparently Gab isn't exactly hiring the best and brightest.

AmericanChopper 6y ago
At a glance my first though was "there's probably SQLi here", but it's not obvious to me that attacker controlled parameters could actually be used to exploit this. The ID and pagination parameters all seem to be ints, and it's not obvious to me that an attacker could turn them into arbitrary strings. Is custom_filters.phrase the attacker controlled string?
- kemayo 6y ago
  There's nothing in that code that says that any of those parameters have to be ints. They're certainly expecting ints, but there's no casts in that code that would enforce that. Presumably somewhere upstream they're just passing directly from the POST/querystring into these API functions. Remember: Ruby is a dynamically typed language.
  - mannerheim 6y ago
    Sounds like a place where static types would have helped... Not that one should rely entirely on them for these sorts of situations.
    - 1_player 6y ago
      Static types don't help with string interpolation.

bsder 6y ago

People like to slag on other people's programming skills, but are you sure that all code you wrote doesn't have some absolutely boneheaded mistake in it? I like to think I'm pretty good, but I would never claim that and certainly wouldn't put money on it. I'm sure I've got boneheaded mistakes scattered through my code. Sometimes you're having a bad day. Sometimes the reviewers are a little pressed for time. It doesn't take much for really stupid code to slide through as long as it appears to work. Glass houses and all that ...

TameAntelope 6y ago
I've completely given up judging technical decisions as representations of the person who made them's skill or ability. I still judge the technical decision on how it's impacting the system today (specifically around whether or not it's sustainable), but trying to ascribe intent or brand something as "dumb" is almost always done without the relevant information that went into the decision being made.
- bsder 6y ago
  This is the problem being in a field (programming) that doesn't actually value experience. I got this knocked into me by a very senior engineer when I complained about some really silly circuit on an older version of a microprocessor. His comment: "Okay, let's design that adder better. Oh, by the way, you only have two layers of metal in that technology. Let's walk through the options." My response: "Uh, no. We don't need to. There are exactly 3 options and only one that works." His response: "And now you know why the engineers prior to you made that decision. Don't assume your predecessors were untouchable geniuses, but don't assume they were moronic idiots, either. Just like you, they had a job to do, did it, and, most importantly, shipped it."
danaliv 6y ago
I am 100% sure that none of the code I’ve written in the past 20 years interpolates user input into SQL. There is absolutely no excuse for this, and there hasn’t been for a very long time. Prepared statements have been a thing for longer than half the users of this website have been alive. Remember Bobby Tables? That was 2007.

ulisesrmzroche 6y ago

The irony tastes like candy. More proof that we totally live in a simulation.

015a 6y ago

Fuck this story, and shame on ArsTechnica for publishing it. We shouldn't call out and shame individuals for making a mistake like this. Any company which even does something like this internally is toxic; the blame lies on the company and the process, not the individual. The flimsy excuse "oh, theys a bawd bawd company filled with icky people" doesn't hold water; we're talking about basic decency here. You want to write a story about the commit? Hold the company responsible? Encourage processes and procedures which would have caught this? That's fine. Blur out the names. Ars isn't a tabloid, but they're acting like one; there are real, serious consequences for shit like this. You didn't set out to create the perfect ammunition for someone within a company arguing against the open sourcing of some project, but here it is. I'm physically disgusted by this reporting.

ratsmack 6y ago
Remember that ArsTechnica does reporting for money. The more sensational, the more clicks. I think National Inquirer and The Sun uses the same tact.
- uniqueid 6y ago
  If I were a journalist who wanted to rake in money it wouldn't occur to me to include dull screenshots of diffs and commit messages. For that matter, it wouldn't occur to me to work for a niche outfit like Ars Technica either. My dentist probably earns more than a tech columnist.
smt88 6y ago
What about when people went after the security head of Equifax following their massive breach that ruined a few lives? Was that unfair?
- spydum 6y ago
  Incredibly unfair, the character assassinations are totally uncalled for. The infosec community has a real problem with tearing each other apart. So much so, that journalists now also think it's okay. * Just a reminder, they were tearing into the CISO for having a liberal arts degree (as if college degrees actually prepared you for anything..). Totally agree here: blame the company and the leadership for not investing in the right processes and tools. People will always make mistakes.

fock 6y ago

well, even if it's rightwing idiots it seems you can go relatively far. We just deleted all our labs data because a colleague didn't get that you had to unmount and destroy the existing (benchmark) zpool to create a new one when finally setting up some new drives. Didn't ask for help or anything but went straight to "fix" it with `nvme format` on the raw devices. Hope the backup works at this point (that's the other colleague who accused me of paranoia when I mentioned 2FA with yubikeys for admins and then silently removed his smart outlet from the network once I ran a powercycle on it...).

__abc 6y ago

Oooooof. Rails (which I think they may be using) makes sanitization fairly easy.

naebother 6y ago

> Besides the commit raising questions about Gab’s process for developing secure code, the social media site is also facing criticism for removing the commits from its website. Critics say the move violates terms of the Affero General Public License, which governs Gab’s reuse of Mastodon, an open source software package for hosting social networking platforms. Lmao, that's not how AGPL works. Although, it would be pretty funny if a license explicitly required you to post all your Ls for public ridicule.

dragonwriter 6y ago
> Lmao, that's not how AGPL works. The GPL family, including the AGPL, defines source code that must be provided as “the preferred form for making changes”; if the form the distributor uses is a VCS repository with full history, publishing either static snapshots or a repository with an expurgated history could arguably be a violation of both the letter and the spirit of the licenses. The language of the licenses makes the requirement dependent on actual development practices, not fixed, and that's not an accident.
- naebother 6y ago
  I'm guessing you're referring to the first sentence in section 1: > The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. I don't think that's referring to the method by which I make changes or manage those changes. It's simply trying to make it clear that source-code is something that should be in a form you can actually change, and not something obfuscated. e.g. minified, transpiled, object-code, etc. The second sentence gives the first more context. The spirit of all GNU licenses is that the end-user should have the freedom and ability to understand or modify software that's *distributed* to them for themselves. It has nothing to do with having a full history of the source-code available. What does full history even mean? I'd like every auto-save to every LGPL licensed file, please.

trhway 6y ago

Looking at that mess of a code (even without the cherry top of injection) I kind of wonder why ruby is hip and php isn't.

deleted 6y ago

[deleted]

heyitsjlac 6y ago

The dude who got a tummy ache from this was even funnier than the story itself. This is a great site.