6 ms·

Dont quite think this is what I'd call "responsible disclosure", and not exactly sure this is "disclosure" either.

mrsteveman1 15y ago
The linked post says "Why I do this? Since guys in rails issues ingored me". Sounds like this was already a known problem that has led developers to shoot themselves in the foot.
- angelbob 15y ago
  This is a long-known problem.
oconnore 15y ago
He made an attempt to patch upstream, was shot down, and then proved his point without hurting anyone. Maybe not the best way to get the issue out, but we are talking about it and it wasn't especially harmful. Mission accomplished? I don't know how else he could have done this. He was being ingored!
- marshray 15y ago
  No kidding. He probably could have sold this kind of bug for big $.
- heimidal 15y ago
  He didn't try to "patch" anything -- there was no code attached to the issue he filed -- and he wasn't ignored. What _really_ happened is that he was told, "no, we think that this is the application developer's responsibility." He became frustrated that the response wasn't what he had anticipated, so instead of acting like a mature software developer he started acting like a petulant child. The point is, this Github exploit could still exist even if some protections were set by the framework. Developers should take their app's security into their own hands (and I'm sure Github does) by employing a solution similar to attr_accessible.
- stock_toaster 15y ago
  > He made an attempt to patch upstream, was shot down, and then proved his point without hurting anyone. Assuming no economic impact to github you mean. If paying users leave because they feel github is no longer safe for private repos because of this, that is harm. I imagine a bank would be far more grouchy if someone exploited a vulnerability and deposited one cent into someone's account "just to show there was a vulnerability" then publicized it, without talking to them about it first. <sarcasm>No harm done right?</sarcasm> Now, I am not saying that it is bad that this github vulnerability was found and fixed. I am very glad! But I think it could have been far more responsibly done.
  - Drbble 15y ago
    If github users quit because a hacker deletes their stuff, maybe that's harm the hacker did to github. But if github users quit because a hacker shows them github is insecure, that's harm github did to itself. Don't blame the messenger.
tylermenezes 15y ago
He tried to warn rails about it, and they closed the issue. Then he reopened it using the bug to show that it was an actual vulnerability, and they closed it again. https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228
- vijaydev 15y ago
  Just to be clear, he did not reopen the issue.
  - homakov 15y ago
    i sent state=open and that worked. technically i opened it without being detected in activity. Typical mass-as-ent bug behavior
    - vijaydev 15y ago
      You did that with https://github.com/rails/rails/issues/5239 https://github.com/rails/rails/issues/5239 and not https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228 as far as I can tell. I was responding to the comment that made it look like the Rails team closed your issue 5228 and you had to re-open it.
    - marshray 15y ago
      Should we consider this a 0-day on Rails?
- alain94040 15y ago
  Agreed. I read this thread, he nicely tries to draw attention to the issue several times, and gets the usual "big corporation pushback": Go away, if it was so important, we'd already know. Then he proves his point, without hurting anyone. In my book, that deserves an A.

The linked post says "Why I do this? Since guys in rails issues ingored me". Sounds like this was already a known problem that has led developers to shoot themselves in the foot.

angelbob 15y ago
This is a long-known problem.

oconnore 15y ago

He made an attempt to patch upstream, was shot down, and then proved his point without hurting anyone. Maybe not the best way to get the issue out, but we are talking about it and it wasn't especially harmful. Mission accomplished? I don't know how else he could have done this. He was being ingored!

marshray 15y ago
No kidding. He probably could have sold this kind of bug for big $.
heimidal 15y ago
He didn't try to "patch" anything -- there was no code attached to the issue he filed -- and he wasn't ignored. What _really_ happened is that he was told, "no, we think that this is the application developer's responsibility." He became frustrated that the response wasn't what he had anticipated, so instead of acting like a mature software developer he started acting like a petulant child. The point is, this Github exploit could still exist even if some protections were set by the framework. Developers should take their app's security into their own hands (and I'm sure Github does) by employing a solution similar to attr_accessible.
stock_toaster 15y ago
> He made an attempt to patch upstream, was shot down, and then proved his point without hurting anyone. Assuming no economic impact to github you mean. If paying users leave because they feel github is no longer safe for private repos because of this, that is harm. I imagine a bank would be far more grouchy if someone exploited a vulnerability and deposited one cent into someone's account "just to show there was a vulnerability" then publicized it, without talking to them about it first. <sarcasm>No harm done right?</sarcasm> Now, I am not saying that it is bad that this github vulnerability was found and fixed. I am very glad! But I think it could have been far more responsibly done.
- Drbble 15y ago
  If github users quit because a hacker deletes their stuff, maybe that's harm the hacker did to github. But if github users quit because a hacker shows them github is insecure, that's harm github did to itself. Don't blame the messenger.

tylermenezes 15y ago

He tried to warn rails about it, and they closed the issue. Then he reopened it using the bug to show that it was an actual vulnerability, and they closed it again. https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228

vijaydev 15y ago
Just to be clear, he did not reopen the issue.
- homakov 15y ago
  i sent state=open and that worked. technically i opened it without being detected in activity. Typical mass-as-ent bug behavior
  - vijaydev 15y ago
    You did that with https://github.com/rails/rails/issues/5239 https://github.com/rails/rails/issues/5239 and not https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228 as far as I can tell. I was responding to the comment that made it look like the Rails team closed your issue 5228 and you had to re-open it.
  - marshray 15y ago
    Should we consider this a 0-day on Rails?
alain94040 15y ago
Agreed. I read this thread, he nicely tries to draw attention to the issue several times, and gets the usual "big corporation pushback": Go away, if it was so important, we'd already know. Then he proves his point, without hurting anyone. In my book, that deserves an A.