6 ms·
I have written a blog post outlining the exploit and our mitigation procedure: https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation htt
by mojombo 15y ago
I have written a blog post outlining the exploit and our mitigation procedure: https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation https://github.com/blog/1068-public-key-security-vulnerabili...
- white_devil 15y agoSo you're actually proud of writing that sleazy piece of damage-control distraction bullshit? You're completely misrepresenting what happened. Someone pointed out that Rails makes all Rails applications astoundingly insecure by default since forever, and got condescendingly dismissed several times by the people in charge. He then proceeded to make a point by demonstrating the severity of the security flaw, and you made him look like some malicious hacker that got swiftly punished by the ever-vigilant GitHub team. Public Key Security Vulnerability, really? You detected the attack and expunged the unauthorized key? What a load of bullshit.
- teyc 15y agoUntil proven otherwise, all code hosted on GitHub must be assumed tainted, where potential 0-day has been inserted. You should consider revealing a history of all public key changes for each project (assuming you still retained apache logs) so that people can decide for themselves how much work they have ahead of them to re-audit their past commits.