3 ms·
This is NOT a vulnerability in Rails. If you've ever used Rails, you'll probably be aware that it has several features for preventing things like this from happ
by cmelbye 15y ago
This is NOT a vulnerability in Rails. If you've ever used Rails, you'll probably be aware that it has several features for preventing things like this from happening (attr_accessible, attr_protected, etc). GitHub failed to use those methods, so it's a vulnerability in GitHub. All sites powered by Rails are not necessarily vulnerable to this, only ones that have not been properly coded using the aforementioned security features.
- angersock 15y ago"Buffer overflows are not a vulnerability in C. If you've ever used C, you'll probably be aware that has several features for preventing things like this from happening (strlen_s, memmove, etc.). Microsoft failed to use those methods, so it's a vulnerability in Microsoft. All apps powered by C are not necessarily vulnerable to this, only ones that have not been properly coded using the aforementioned security features." And yet, people have stopped using C for a lot of things because of the security implications... Look, when Rails is pushed as an out-of-the-box magic web stack--and it is--, and the out-of-the-box config has these problems available--which seems to be the case--maybe there is something to be said for the framework needing fixing. Just because I can write code that prevents various exploits does not mean I expect the rest of the world to--and I sure as hell don't do so while brandishing about how even beginners can use my tools.