3 ms·
Let's be fair to homakov: He used the exploit publicly and loudly (full disclosure to almost all affected parties) by doing a relatively harmless change to _ra
by sounds 15y ago
Let's be fair to homakov:
He used the exploit publicly and loudly (full disclosure to almost all affected parties) by doing a relatively harmless change to _rails_ _master_ on github.
If his actions should be called an attack, then it was highly targeted - at the people who could fix it - to get their attention.
- arohner 15y agoHis relatively harmless change demonstrated a Major Security Vulnerability in the site that hosts thousands of companies secure code.
- jbri 15y agoAnd got it fixed. Security vulnerabilities aren't the sort of things that go away just because you don't know they're there.
- tptacek 15y agoFrom experience: had he simply told Github about it, they would have fixed it quickly, and there would have been no window of public exposure. That's the point being made here.
- sounds 15y agoFair enough, that's basically what was said in the bug he filed with Ruby on Rails. I won't try to impute motives but I think he did it this way because he felt like he was being treated poorly.
- arohner 15y agoThere are two different issues here. 1) A bad security vulnerability at GitHub. 2) Poor design in Rails that makes it easy to produce security vulnerabilities. Igor found 2, and got ignored by the Rails team. His frustration led him to publicly demonstrating 1, which caused a whole lot of people a whole lot of trouble. The people that are irritated at him are irritated at him because of 1, not 2.
- deleted 15y ago[deleted]
- mhurron 15y agoWhat kind of serious company puts important or 'secure' code on github?