3 ms·
The author cites reporting the issue to the rails community but why didn't he report it to security@github.com? As some of the GH people have already said (on o
by tomschlick 15y ago
The author cites reporting the issue to the rails community but why didn't he report it to security@github.com? As some of the GH people have already said (on other articles), they would have taken him very seriously and not banned his account if he would have reported it the correct way instead of hacking into high profile accounts.
- blatherard 15y agoReporting it to github wouldn't have demonstrated the problem he was trying to flag. His problem wasn't "gitub is insecure" but instead "rails by default is insecure." When told by the rails team that fixing this problem was the responsibility of rails users, he demonstrated that even the most sophisticated users (presumably, github devs) were exposed. If he had submitted a bug report to github, they would have probably just fixed it. And the problem he was flagging in rails wouldn't have been any closer to fixed.
- maratd 15y agoApparently he did. However, GH only fixed that specific exploit he provided. The general vulnerability was apparently spread throughout their entire code-base. After realizing this, he filed a report with the framework GH uses (which would fix the problem for everyone - not just GH). They told him to fuck off (politely). So he proved his point. Childish? Yes. But then again, he is a child. The kid is a teenager. That's how they're supposed to behave. Also, I have a strange feeling things will actually be fixed now? So the kid gets results.