3 ms·

It's a pretty insane leap of logic to maliciously attack the Github website to prove your point regarding a framework hosted on that website. Politely contactin

It's a pretty insane leap of logic to maliciously attack the Github website to prove your point regarding a framework hosted on that website. Politely contacting people about the vulnerability, rather than pulling that crap in an extremely public venue seems like the more mature, and less incredibly illegal way to go about things.

jsnell 15y ago
The "attack" clearly wasn't malicious, though probably immature. A malicious attacker would have been doing things like gaining access to users' private repos and stealing the code, or trying to sneak in harmful commits to a repo under a false name. This was at most a prank or a demonstration. So why this instead of responsible disclosure? The problem is that it was not really a GitHub issue, it's Rails having a grossly insecure default setting. According to one of the comments in the bug tracker a lot of other high-profile sites also have the same problem. And presumably new ones would keep popping up for as long as Rails is the new hotness. So disclosing the problem to GitHub would not solve anything. They'd deploy the fix, but a lot of other sites remain vulnerable. That's probably the case even if GitHub were willing to take a PR hit and admit they'd been insecure for a long time in order to spur other Rails users to fix their code. After all, they hadn't fixed their code after the previous widely published security problems caused by the same underlying issue. Clearly the Rails core team were not willing to consider any kind of changes to improve the situation. As such, you can argue that making as big a scene as possible is the best way to improve security globally. It's of course unfortunate for GitHub that he chose to use that site as the example due to the obvious reasons. And certainly the timing is about as unfriendly as possible from the point of view of a west coast person.
- BenjaminCoe 15y ago
  This clearly was malicious: * it provides a how to for other individuals to repeat the attack, in a public forum. * it was made against an innocent third-party. * I doubt steps were taken to contact the third-party. * it was made on a Sunday morning. making it difficult to scramble and get a fix out the door. "Clearly the Rails core team were not willing to consider any kind of changes to improve the situation" The ticket was opened three days ago. Are you advocating that if an issue isn't resolved in an open-source project, in under a week, the individual raising the issue should be able to publicly attack anyone using the project? Also, I'll put this gem of a quote out there: "not only github is vulnerable this way - I found a lots of rails apps that are waiting for my hack! Yeah, it is only start" (mwahahahaha).
  - jsnell 15y ago
    Whether it was malicious depends on the motives, and it's very hard for me to see where the malice is. To me it looks more like he just wanted to bring attention to the issue in order to get it fixed. I already agreed that GitHub were innocent bystanders and that the timing was unfortunate. But if getting publicity to the issue was the main point, it's also easy to see why GitHub was the perfect target. I also already explained why it could make perfect sense to demonstrate the vulnerability in a public manner rather than just disclose it to one of the many sites suffering from the problem. None of that is a sign of malice, it's at most bad judgement. The ticket having been opened only three days ago would be a good point if it hadn't also been closed and declared to be working as intended with a pointer to a previously closed bug about the same issue.
    - BenjaminCoe 15y ago
      I think you're winning me over to Egor's actions being more irresponsible and misguided than malicious -- chalk it up to him being 18. I'm finding it pretty hard to stay mad at someone with this tattoo: http://homakov.blogspot.com/2011/07/octocat-tattoo.html http://homakov.blogspot.com/2011/07/octocat-tattoo.html
      - alexbell 15y ago
        Agreed. Immature - certainly. I don't think his actions were done with malicious intent. Maybe insolent, but that only counts in the military. If he wanted to he could have made his point in a far more malicious manner. And the octocat tattoo... How can you not like a guy with an octocat tattoo!
  - momoro 15y ago
    He could probably have made a lot of money from this if he hadn't disclosed it. A lot of people store various secret keys along with their apps on github. Many people even have entire repositories of secret keys. By taking access to these repos (if he could get access to private repots) he could likely have gotten access to apps from which he could have taken money.

jsnell 15y ago

The "attack" clearly wasn't malicious, though probably immature. A malicious attacker would have been doing things like gaining access to users' private repos and stealing the code, or trying to sneak in harmful commits to a repo under a false name. This was at most a prank or a demonstration. So why this instead of responsible disclosure? The problem is that it was not really a GitHub issue, it's Rails having a grossly insecure default setting. According to one of the comments in the bug tracker a lot of other high-profile sites also have the same problem. And presumably new ones would keep popping up for as long as Rails is the new hotness. So disclosing the problem to GitHub would not solve anything. They'd deploy the fix, but a lot of other sites remain vulnerable. That's probably the case even if GitHub were willing to take a PR hit and admit they'd been insecure for a long time in order to spur other Rails users to fix their code. After all, they hadn't fixed their code after the previous widely published security problems caused by the same underlying issue. Clearly the Rails core team were not willing to consider any kind of changes to improve the situation. As such, you can argue that making as big a scene as possible is the best way to improve security globally. It's of course unfortunate for GitHub that he chose to use that site as the example due to the obvious reasons. And certainly the timing is about as unfriendly as possible from the point of view of a west coast person.

BenjaminCoe 15y ago
This clearly was malicious: * it provides a how to for other individuals to repeat the attack, in a public forum. * it was made against an innocent third-party. * I doubt steps were taken to contact the third-party. * it was made on a Sunday morning. making it difficult to scramble and get a fix out the door. "Clearly the Rails core team were not willing to consider any kind of changes to improve the situation" The ticket was opened three days ago. Are you advocating that if an issue isn't resolved in an open-source project, in under a week, the individual raising the issue should be able to publicly attack anyone using the project? Also, I'll put this gem of a quote out there: "not only github is vulnerable this way - I found a lots of rails apps that are waiting for my hack! Yeah, it is only start" (mwahahahaha).
- jsnell 15y ago
  Whether it was malicious depends on the motives, and it's very hard for me to see where the malice is. To me it looks more like he just wanted to bring attention to the issue in order to get it fixed. I already agreed that GitHub were innocent bystanders and that the timing was unfortunate. But if getting publicity to the issue was the main point, it's also easy to see why GitHub was the perfect target. I also already explained why it could make perfect sense to demonstrate the vulnerability in a public manner rather than just disclose it to one of the many sites suffering from the problem. None of that is a sign of malice, it's at most bad judgement. The ticket having been opened only three days ago would be a good point if it hadn't also been closed and declared to be working as intended with a pointer to a previously closed bug about the same issue.
  - BenjaminCoe 15y ago
    I think you're winning me over to Egor's actions being more irresponsible and misguided than malicious -- chalk it up to him being 18. I'm finding it pretty hard to stay mad at someone with this tattoo: http://homakov.blogspot.com/2011/07/octocat-tattoo.html http://homakov.blogspot.com/2011/07/octocat-tattoo.html
    - alexbell 15y ago
      Agreed. Immature - certainly. I don't think his actions were done with malicious intent. Maybe insolent, but that only counts in the military. If he wanted to he could have made his point in a far more malicious manner. And the octocat tattoo... How can you not like a guy with an octocat tattoo!
- momoro 15y ago
  He could probably have made a lot of money from this if he hadn't disclosed it. A lot of people store various secret keys along with their apps on github. Many people even have entire repositories of secret keys. By taking access to these repos (if he could get access to private repots) he could likely have gotten access to apps from which he could have taken money.