10 ms·
"Egor, stop hacking Github"
- gaius 15y ago'Bout time someone took the Rails "rockstar ninjas" down a peg or two.
- nchuhoai 15y agoCan't decide whether to love or hate this guy. For his young age, he seems to have an impressive skill set, but you can totally tell the douche growing inside
- Bootvis 15y agoOTOH he didn't cause any real harm and disclosed the bug almost immediately. Don't be too harsh on the guy.
- deleted 15y ago[deleted]
- homakov 15y agoI 'm not that douche you want to show me. But it seems so, sorry.
- manmal 15y agoNo, a douche would have sold this exploit to an underground group. You just drew attention by show-hacking a big player, preventing other people finding the exploit while this goes unwatched - that's honorable in my opinion.
- marshray 15y agoDude, you're a hero. Others just don't realize it yet because they're going through the stages of grief (Denial, Anger, Bargaining, Depression, Acceptance). https://en.wikipedia.org/wiki/K%C3%BCbler-Ross_model https://en.wikipedia.org/wiki/K%C3%BCbler-Ross_model If no one else says it, I will: Thank You!
- vonkow 15y agoYou found a problem, tried to warn them. They didn't listen, so you showed it to them, without harming anything (aside from a few egos). That's doing the right thing.
- naetl 15y ago+1 for a hero. Чувак. Ты крут.
- igor_a 15y ago-1 For Hero. Чувак извини, ты крут, но ведешь себя как долбоеб
- mvasilkov 15y agoEgor, keep up with the good work. Not your fault Rails guys are overly self-confident.
- jpeterson 15y agoYou're good by me. There are so many ways that you could've gone in a truly evil direction with this exploit, and you chose not to.
- 16s 15y agoIn some areas, what he did is illegal and he could be prosecuted for it. I hope that does not happen, but if I were him I would be cautious.
- etcet 15y agoYou must not have been your average 18 year old. This guy had read/write to GitHub and potentially many more sites, imagine what damage he could have caused. He may not have done it perfectly but he Did the Right Thing(tm).
- nchuhoai 15y agoI'm not saying he is a douche for breaking into github. its more like how he acts and what he says: "Then, I could make a post pretending i am DHH. That was funny too." "GH sorry, I was bored." Im sure everyone has different definitions, for me its just someone that I wouldn't wanna hangout with on a personal level, that's all.
- lwat 15y ago'It's called being a cynical asshole and there's no known cure'
- nunb 15y agoA lot of context is lost in text/email/IM also remember that English is not his native language, and he's likely from a very different cultural background. Give the guy a break. On balance I think he's just a well-meaning kid who's achieved notoriety the wrong way, but his deepest intentions are good. Rather like Robert Tappan Morris, come to think of it!
- joelhaasnoot 15y agoDont quite think this is what I'd call "responsible disclosure", and not exactly sure this is "disclosure" either.
- mrsteveman1 15y agoThe linked post says "Why I do this? Since guys in rails issues ingored me". Sounds like this was already a known problem that has led developers to shoot themselves in the foot.
- angelbob 15y agoThis is a long-known problem.
- oconnore 15y agoHe made an attempt to patch upstream, was shot down, and then proved his point without hurting anyone. Maybe not the best way to get the issue out, but we are talking about it and it wasn't especially harmful. Mission accomplished? I don't know how else he could have done this. He was being ingored!
- marshray 15y agoNo kidding. He probably could have sold this kind of bug for big $.
- heimidal 15y agoHe didn't try to "patch" anything -- there was no code attached to the issue he filed -- and he wasn't ignored. What _really_ happened is that he was told, "no, we think that this is the application developer's responsibility." He became frustrated that the response wasn't what he had anticipated, so instead of acting like a mature software developer he started acting like a petulant child. The point is, this Github exploit could still exist even if some protections were set by the framework. Developers should take their app's security into their own hands (and I'm sure Github does) by employing a solution similar to attr_accessible.
- 15y ago
- deleted 15y ago[deleted]
- wycats 15y agoFor what it's worth, we'd like it if security vulnerabilities in Rails were disclosed to http://rubyonrails.org/security http://rubyonrails.org/security. Obviously this situation is a bit more complicated, as a ticket was opened up, and a lot of community discussion occurred. In general, emails to the security list are taken extremely seriously.
- boundlessdreamz 15y agoPeople are reading this as a vulnerability in rails when it is actually a vulnerability in GH's code. Your comment unfortunately is going to add to it :(. What should he have reported to rails security team? Shouldn't he have been contacting GH security team instead? Edit: Rails guides discusses the root cause and counter measures against these type of vulnerabilities http://guides.rubyonrails.org/security.html#mass-assignment http://guides.rubyonrails.org/security.html#mass-assignment
- nirvdrum 15y agoSerious question: how is that any different than leaving SQL injection points in place and then just documenting it?
- vijaydev 15y agoIf an app makes it possible to do SQL injections, whose fault is it? What Rails have done is to have a particular default (whose correctness can be debated) and document how it can be exploited and how to safeguard from it.
- nirvdrum 15y agoYou didn't really answer my question. Rails has all the helpers in place to sanitize input for SQL injection. Why in that case do they apply the defaults and not do so in this case? They both amount to making unwanted DB modifications.
- bnegreve 15y ago
- rmoriz 15y agosometimes it's better to do bold moves when some nastiy thing needs attention and noone is really hurt.
- lnanek 15y agoThis reminds me of how PHP used to turn HTTP request variables directly into global programming variables by default. Now it only happens when you enable the register_globals option. I don't think I've ever met anyone who didn't consider it a huge security issue. This rails behavior is actually even more powerful than the old PHP one for hackers because with this you get directly into the model and then the DB when everything is still left as generated, not just the temporary variables. It's actually pretty surprising how much resistance there is to fixing the issue. It could be that the proposed whitelisting isn't the only solution. It does require annoying configuration. With PHP, nowadays, most people just access a particular array when they want their request variables. Similarly, maybe Rails could have a request model object and a DB model object with simple methods for copying state between the two. Maybe combine it into some sort of validation logic with user friendly error messages being specified. I guess it is still more work that default overwriting of the DB with request variables, though.
- Jach 15y agoI was also thinking of PHP's register_globals. I was tempted to make a snide remark, so I'll make it now. The difference here is that the PHP group realized register_globals was a bad idea, deprecated it in 5.3 and removed it in 5.4. Furthermore the default has been OFF since 4.2.0. The resistance to fixing the Rails problem just makes me ever less likely to give Rails a shot, it should be really bad PR when you ignore security issues.
- kijin 15y agoWelcome to the new decade, where PHP has secure defaults and Rails apps get pwn'd left right and center. But seriously, PHP still has lots of problems to fix.
- blasterford 15y agoThe lesson here is if you care about security, performance, reliability etc, use old 'uncool' battle worn languages/platforms.
- 15y ago
- deleted 15y ago[deleted]
- jclem 15y agoAre people misunderstanding this? It is not a bug. It's an acknowledged part of the framework (http://guides.rubyonrails.org/security.html#mass-assignment http://guides.rubyonrails.org/security.html#mass-assignment), although one that could get a developer into trouble without knowing to protect attributes where necessary. If he'd known that there was something the GH team missed, he should have just brought the issue to them directly. If I realize my neighbor's house is in danger of collapsing because the contractor used the wrong type of wood, I don't bring the issue up with a lumber yard and then knock over my neighbor's house to prove a point when they ignore me. I agree that it's a problem that many developers aren't aware that they need to protect against mass assignment, but it seems like this dude is totally misunderstanding the entire ecosystem here, and now people are calling him a "hero" because he took advantage of something that everyone already knows. Big whoop.
- maratd 15y ago> If I realize my neighbor's house is in danger of collapsing because the contractor used the wrong type of wood, I don't bring the issue up with a lumber yard Yes, you do. Because the lumber yard sold your neighbor the wrong wood. If you're going to make a framework for a language, do so in a manner that discourages stupidity. PHP learned this the hard way quite a few years back. You never make things easier for the end-user at the expense of security. It's time for Rails to learn the same lesson.
- Drbble 15y agoYou can't chop off half of someone's sentence and then debate the leftover part. Not at an "and", at least.
- ben0x539 15y agoA harmless, spurious commit is hardly comparable to the insane property damage of destroying someone's house, likely to bankrupt a private person.
- JangoSteve 15y agoGiven the recent story on HN about how former YouSendIt founder had taken their servers down to prove their vulnerability [1] [2], I'm surprised how little reverence these "lol-hackers" (that's going to be my term for them) give to showcasing these vulnerabilities by exploiting them in the real-world and messing with people's real things. I know as hackers, we feel a duty to show people how serious these things are and that we get impatient and annoyed when ignored. And I also know that it's hard for us to reconcile the idea that when we show the owners rather than tell, it's suddenly considered a crime. But it is. Let's try an analogy. Door locks on houses are ineffective. Think about it. Your house is covered with windows, which are made of glass. Glass is really easy to break. I mean really easy. If you found out your neighbor didn't have a house alarm, you might talk to them and tell them they should get one. If they didn't get one, would you then break into their house one night and walk into their bedroom to show them how dangerous it is? OK, who knows, maybe you have a weird relationship with your neighbor. Furthermore, this is an imperfect analogy, because here, Rails and Github are both responsible for other people's property. But now imagine it's a business across town and that you don't actually know the business owner. If you broke into their business to show them their building's security vulnerabilities, you bet your ass they would press charges and I don't think anyone would blame them. Even if you're doing it with the best intentions, it's still vandalism at best. All of that being said, this is a very effective way of making your point and getting people to fix the problem. That doesn't make it right. But if you're willing to put yourself in harm's way and essentially become a martyr to get these security vulnerabilities fixed, more power to you. [1] http://news.ycombinator.com/item?id=3643102 http://news.ycombinator.com/item?id=3643102 [2] http://www.inc.com/magazine/201203/burt-helm/a-silicon-valley-tale-of-humiliation-and-revenge.html http://www.inc.com/magazine/201203/burt-helm/a-silicon-valle...
- marshray 15y agoDoor locks on physical houses are just a small part of a much greater security picture involving your community, observant neighbors, other monitoring systems, the police, even dogs. And yes, houses do get broken into causing a massive amount of aggregate economic loss every year. But on the internet everyone's front door is accessible from even the most remote and hostile places in the world and you're pretty much on your own for securing it. Internet-facing systems also tend hold far more valuable things than your typical home. For these reasons, I don't think the household lock analogy works very well.
- BenjaminCoe 15y agoAlright, this did a pretty good job of winning me over to Egor: http://homakov.blogspot.com/2011/07/octocat-tattoo.html http://homakov.blogspot.com/2011/07/octocat-tattoo.html That tattoo is legit.
- skeletonjelly 15y agoMaybe not? https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57#commitcomment-1041295 https://github.com/rails/rails/commit/b83965785db1eec019edf1...
- waffle_ss 15y agoIf this vulnerability is really due to attr_accessible, then that's got to sting for GitHub as this is a well-known "insecure by default" issue in Rails, and GitHub is probably the most (or one of the most) public Rails app out there. Would be kind of scary if he had injected some nastiness into the rvm repo master branch, for instance, because I know some people do ride on the master version (`rvm get head`). Or, some gems that are built from Gemfile's pointing at the git repo on GitHub. Luckily, git itself is quite resilient to attacks on the repo integrity so I don't think there could be much long-term harm done (no rewriting repo history would go unnoticed, for example).
- javajosh 15y agoThis is not a rails bug, but a github bug. The discoverer reported it in the wrong place, the rails people (correctly) told him to report it to github, he ignored them, and this hilarity ensued. While this is a legit bug on github, and Egor deserves credit for finding it, he also deserves a scolding for the classic noob mistake of not reporting it to the right place.
- abalone 15y agoThat's a matter of opinion. He intentionally reported it against rails because he thinks it is rails' fault for making it so easy to have this security problem. Given that the #1 rails app out there written by professionals suffers from it, and reportedly others do too, he has a point. You can disagree if you want but it's definitely not a "classic noob mistake".
- javascriptlol 15y agoThere is no reason to be introducing "fail open" design flaws at any level above the bare metal.
- Volpe 15y agotl;dr; - Learn about: attr_protected[1] [1] http://guides.rubyonrails.org/security.html#mass-assignment http://guides.rubyonrails.org/security.html#mass-assignment