9 ms·

From 3 days ago: "What I want you to see in that thread I mentioned is the way the core team perceives this. You are not discovering anything unknown, we alrea

From 3 days ago: "What I want you to see in that thread I mentioned is the way the core team perceives this. You are not discovering anything unknown, we already know this stuff and we like attr protection to work the way it is." (https://github.com/rails/rails/issues/5228#issuecomment-4292532 https://github.com/rails/rails/issues/5228#issuecomment-4292...) After reading for how long he tried to bring attention to this and only got a top guy to say that kind of stuff. The guy who hacked is not right in any way but I don't even have words to describe the person who wrote the above line.

generalk 15y ago
This, to me, is the craziest part. I'm not condemning anyone, but it seems that when someone points out that your framework ships Insecure By Default code with absolutely no warning in the generated code, you'd take that seriously. Instead, the thread is full of "We've discussed this before, we like it the way it is" and "Rails is not responsible here."
- kamjam 15y ago
  Man, I've just read through this whole incident and this is the exact same conclusion I got. Fair enough, he got his account suspended, they investigated and they reinstated his account. But the comments from the devs and admin is just disgusting, acting like this is a non-issue and calling the guy a troll. This is not the kind of attitude to have. I understand the homakov probably could have acted a bit more "professional", but not surprised he acted this way after the way he was belittled. He honestly comes across very shocked he was able to do what he did, and from the comments its obvious this was made a bigger deal by the users than it was by him. I am not a rails developer, but I am pretty sure this would have woken up a lot of people for a lot of similar issues, there will be a mad flurry of devs rechecking a whole bunch of code. Had he reported this disacreetly what are the chances of this much publicity have been generated?!?

generalk 15y ago

This, to me, is the craziest part. I'm not condemning anyone, but it seems that when someone points out that your framework ships Insecure By Default code with absolutely no warning in the generated code, you'd take that seriously. Instead, the thread is full of "We've discussed this before, we like it the way it is" and "Rails is not responsible here."

kamjam 15y ago
Man, I've just read through this whole incident and this is the exact same conclusion I got. Fair enough, he got his account suspended, they investigated and they reinstated his account. But the comments from the devs and admin is just disgusting, acting like this is a non-issue and calling the guy a troll. This is not the kind of attitude to have. I understand the homakov probably could have acted a bit more "professional", but not surprised he acted this way after the way he was belittled. He honestly comes across very shocked he was able to do what he did, and from the comments its obvious this was made a bigger deal by the users than it was by him. I am not a rails developer, but I am pretty sure this would have woken up a lot of people for a lot of similar issues, there will be a mad flurry of devs rechecking a whole bunch of code. Had he reported this disacreetly what are the chances of this much publicity have been generated?!?