4 ms·
He took ownership and made it highly visible. That might be unprofessional but it was also audacious - and easily the best way to get the word out quickly abou
by polemic 15y ago
He took ownership and made it highly visible.
That might be unprofessional but it was also audacious - and easily the best way to get the word out quickly about an 'in the wild' exploit that will impact a huge number of apps.
Additionally: GitHub is a critical piece of infrastructure for a huge number of companies, contractors and start-ups. On balance, protecting GitHub from public embarrassment is far outweighed by the potentional impact of this sort of flaw. If a good old public "git@github ~ $ rake over coals" is what is needed to ensure that our IP is sufficiently protected, so be it.
- acqq 15y agoFor anybody who needs to get context, see: https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228 Egor discovered that a lot of big sites which use Rails suffer from very serious security issues because the common Rails practices and defaults don't produce secure sites. It's so non-obvious that he was able to impersonate others, avoid most of the checks... He was aware of consequences, but he got mostly ignored. So he decided he had to get enough attention and publicity. There are too many sites too vulnerable to just wait.