6 ms·
Can somebody explain why this is a Rails bug? Meaning using mass assignment is very similar to SQL injection: you pass variables from user input directly to mo
by tlogan 15y ago
Can somebody explain why this is a Rails bug?
Meaning using mass assignment is very similar to SQL injection: you pass variables from user input directly to model without even verifying them. Duh?
Now regarding GitHub: yes there is a security hole and they fixed it.
However, hacking a site after finding its vulnerability is definitely illegal and hope there will be consequences. And he did not even report a problem to GitHub.
- teyc 15y agoCan somebody explain why this is a Rails bug? Insecure by default. Microsoft used to be the laughing stock because the default install was vulnerable to exploits. While one might argue that Github devs should have known better, the counterargument is that if Github devs couldn't get it right, think about the thousands of people trying out rails for the first time, building their little web app.