3 ms·
It was a 0-day in github allowing malicious code being committed to any project. Egor never (seemingly) took the appropriate steps to inform anyone of this vuln
by cdcarter 15y ago
It was a 0-day in github allowing malicious code being committed to any project. Egor never (seemingly) took the appropriate steps to inform anyone of this vulnerability in github.
Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties.
- angersock 15y agoHe'd already been ignored by the rails devs. For a normal project, sure, whatever, but when the security hole is in a framework--especially one as widely deployed as rails--you eventually must cede that, yeah, the fastest way to get something serious fixed is to do a public exploit. What if he'd submitted the fix to github and they'd quietly patched it and said nothing? What if they'd said something but nobody cared because hey, it's fixed now? What if they'd flat-out ignored it as the rails devs did (perhaps even citing that as their reason)? No, security only reliably gets addressed when it hurts and hurts publicly. The combination of hitting the exploit on perhaps the most visible site for the target audience and doing so in a way that didn't harm anything is impressive.
- elithrar 15y ago> Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties. 100% agree here. The Rails devs may have ignored his issue, but GitHub are the victims here. Why not email GitHub and inform them, on the provision they communicate the fix they just made? Doing this and saying "P.S. GH sorry, I was bored" is not acceptable.