4 ms·

> Staff member made a change to disallow usernames ending with `Mime::EXTENSION_LOOKUP.keys` This is a hell of a thing to commit and pass code review in 2021 o

by OskarS 5y ago

> Staff member made a change to disallow usernames ending with `Mime::EXTENSION_LOOKUP.keys` This is a hell of a thing to commit and pass code review in 2021 on a project like GitLab. I understand that the staff member was fixing a security issue and was probably not thinking deeply about the ramifications, but even so. How many "Falsehoods programmers believe about names" articles do we need?

Maxion 5y ago
Surely it would be easy to run the new rules against random-list-of-usernames-found-through-google before pushing to prod? Or perhaps the security issue was deemed so great that they needed a fix out yesterday?
- Aeolun 5y ago
  I mean, they’re still not telling us what it was and it’s been fixed for a month. Must’ve been pretty big.
mavhc 5y ago
That's usually the exact time you want to think deeply about the ramifications
- OskarS 5y ago
  I don't want to be too harsh on the programmer, everyone makes mistakes. It's easy to see how a person focused on a security issue with user names makes a quick fix without thinking through how this will affect account creation. As programmers, we have to make like 7,000 decisions every day, you're bound to fuck up some of them. This is a pretty big one, though. The bigger question is how this passed code review and testing.
  - ryandrake 5y ago
    That's a good question, but I think it's still more important to understand why a root cause analysis wasn't finished. They got the cause, but not the root cause. It's like seeing your car battery dead and just replacing the battery, without understanding whether the alternator works or whether the alternator belt is broken.
hinkley 5y ago
What's the security issue though? Not disambiguating filenames and user names in URLs for the site? That's a hard problem to fix after the fact, which is why we call it a Rookie Mistake. Use unique prefixes for users, groups, projects, assets in your webapp design, kids.

by OskarS 5y ago

Maxion 5y ago

Surely it would be easy to run the new rules against random-list-of-usernames-found-through-google before pushing to prod? Or perhaps the security issue was deemed so great that they needed a fix out yesterday?

Aeolun 5y ago
I mean, they’re still not telling us what it was and it’s been fixed for a month. Must’ve been pretty big.

mavhc 5y ago

That's usually the exact time you want to think deeply about the ramifications

OskarS 5y ago
I don't want to be too harsh on the programmer, everyone makes mistakes. It's easy to see how a person focused on a security issue with user names makes a quick fix without thinking through how this will affect account creation. As programmers, we have to make like 7,000 decisions every day, you're bound to fuck up some of them. This is a pretty big one, though. The bigger question is how this passed code review and testing.
- ryandrake 5y ago
  That's a good question, but I think it's still more important to understand why a root cause analysis wasn't finished. They got the cause, but not the root cause. It's like seeing your car battery dead and just replacing the battery, without understanding whether the alternator works or whether the alternator belt is broken.

hinkley 5y ago

What's the security issue though? Not disambiguating filenames and user names in URLs for the site? That's a hard problem to fix after the fact, which is why we call it a Rookie Mistake. Use unique prefixes for users, groups, projects, assets in your webapp design, kids.