3 ms·

Did he notify github directly, or did he notify the rails team in a github-issue in the rails project? If he didn't actually contact github directly and just a

Did he notify github directly, or did he notify the rails team in a github-issue in the rails project? If he didn't actually contact github directly and just assumed they would see the rails issue on a weekend, then I wouldn't exactly call it 'notice'. If he did submit it to github via the proper channels before taking action, and nothing was done within a reasonable timeframe (eg. not just an hour or two on a sunday), then what he did would make a bit more sense.

hythloday 15y ago
He notified Github "last Friday", according to them: https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation#comment-17297 https://github.com/blog/1068-public-key-security-vulnerabili...
- stock_toaster 15y ago
  > His previous report was fixed last friday Makes it sound like a separate issue. edit: looks like github clarified https://github.com/blog/1069-responsible-disclosure-policy https://github.com/blog/1069-responsible-disclosure-policy
  - hythloday 15y ago
    Same exploit, different endpoint. Github agree they "should have...immediately looked for related issues": https://twitter.com/#!/technoweenie/status/176450715508686848 https://twitter.com/#!/technoweenie/status/17645071550868684... ...though as they've now unbanned his account (good on them), it's somewhat moot.
    - stock_toaster 15y ago
      Aha. Thanks for the extra info.
mason55 15y ago
The reason for exploiting github was to get the rails issue noticed, not to notify github of a vuln. If he quietly notifies github then there are still thousands of github sites out there that remain vulnerable. By exploiting GitHub and getting this huge response he allows the news of the vulnerability to get tons more coverage than it would have otherwise.
nirvdrum 15y ago
It's sort of a sticky situation. My take on it wasn't that this was so much to screw with GitHub as it was to show the Rails team the true severity of an issue they downplayed. It gets a bit circuitous because Rails is hosted on GitHub and GitHub is a Rails app. Had he reported it to GitHub and they patched it, which is arguably the proper thing to have done, nothing would have happened on the Rails side of the equation. All told, I think he did the right thing.

hythloday 15y ago

He notified Github "last Friday", according to them: https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation#comment-17297 https://github.com/blog/1068-public-key-security-vulnerabili...

stock_toaster 15y ago
> His previous report was fixed last friday Makes it sound like a separate issue. edit: looks like github clarified https://github.com/blog/1069-responsible-disclosure-policy https://github.com/blog/1069-responsible-disclosure-policy
- hythloday 15y ago
  Same exploit, different endpoint. Github agree they "should have...immediately looked for related issues": https://twitter.com/#!/technoweenie/status/176450715508686848 https://twitter.com/#!/technoweenie/status/17645071550868684... ...though as they've now unbanned his account (good on them), it's somewhat moot.
  - stock_toaster 15y ago
    Aha. Thanks for the extra info.

mason55 15y ago

The reason for exploiting github was to get the rails issue noticed, not to notify github of a vuln. If he quietly notifies github then there are still thousands of github sites out there that remain vulnerable. By exploiting GitHub and getting this huge response he allows the news of the vulnerability to get tons more coverage than it would have otherwise.

nirvdrum 15y ago

It's sort of a sticky situation. My take on it wasn't that this was so much to screw with GitHub as it was to show the Rails team the true severity of an issue they downplayed. It gets a bit circuitous because Rails is hosted on GitHub and GitHub is a Rails app. Had he reported it to GitHub and they patched it, which is arguably the proper thing to have done, nothing would have happened on the Rails side of the equation. All told, I think he did the right thing.