2 ms·

I love how everyone here on HN shits on Gab's mishap just because they happen to host a lot of nonsense alt-right garbage and their CEO is a weirdo, but everyon

by dvt 6y ago

I love how everyone here on HN shits on Gab's mishap just because they happen to host a lot of nonsense alt-right garbage and their CEO is a weirdo, but everyone's totally cool with GitHub knowingly having inconsistencies across threads: > We initially thought this to be an internal reporting problem only and that we would see some data logged for an otherwise unrelated request from the background thread. Though inconsistent, we considered this safe since each request has its own request data and Rails creates a new controller object instance for each request. I mean this is like an SNL skit: "though inconsistent, we considered this safe" -- inconsistency, no matter where it's happening, literally means your code isn't safe. Like, jeez... this is GITHUB we're talking about. I mean, I give money to GitHub -- this is pretty serious and we should really stop with the "omg I love these detailed post-mortems!" stuff. A billion-dollar company knowingly having code that's not thread safe in their flagship product and going "eh, it's probably fine" is bonkers to me.

reissbaker 6y ago
I think there's a pretty big difference between an engineer writing thread-unsafe code, testing and seeing inconsistencies that (incorrectly) appear to not affect any external users, shipping it, and then the security team finding the problem and developing new processes to prevent this in the future — vs the CTO of Gab writing raw SQL using string concatenation, shipping it without code review, and then trying to cover it up afterwards. No software maintained by a large team will be bug-free forever, and that includes security bugs. The response to bugs is what matters. In this case Github's response was quite mature; in Gab's case, it wasn't.
- colesantiago 6y ago
  > In this case Github's response was quite mature; in Gab's case, it wasn't. This is irrelevant. There is no excuse for this, especially if you are a billion dollar company.
  - djmips 6y ago
    The billions doesn't automatically scale development. You know that. Every development is still done at the human level. But you still might be right that there is no excuse.

by dvt 6y ago

reissbaker 6y ago

I think there's a pretty big difference between an engineer writing thread-unsafe code, testing and seeing inconsistencies that (incorrectly) appear to not affect any external users, shipping it, and then the security team finding the problem and developing new processes to prevent this in the future — vs the CTO of Gab writing raw SQL using string concatenation, shipping it without code review, and then trying to cover it up afterwards. No software maintained by a large team will be bug-free forever, and that includes security bugs. The response to bugs is what matters. In this case Github's response was quite mature; in Gab's case, it wasn't.

colesantiago 6y ago
> In this case Github's response was quite mature; in Gab's case, it wasn't. This is irrelevant. There is no excuse for this, especially if you are a billion dollar company.
- djmips 6y ago
  The billions doesn't automatically scale development. You know that. Every development is still done at the human level. But you still might be right that there is no excuse.