3 ms·
His relatively harmless change demonstrated a Major Security Vulnerability in the site that hosts thousands of companies secure code.
by arohner 15y ago
His relatively harmless change demonstrated a Major Security Vulnerability in the site that hosts thousands of companies secure code.
- jbri 15y agoAnd got it fixed. Security vulnerabilities aren't the sort of things that go away just because you don't know they're there.
- tptacek 15y agoFrom experience: had he simply told Github about it, they would have fixed it quickly, and there would have been no window of public exposure. That's the point being made here.
- sounds 15y agoFair enough, that's basically what was said in the bug he filed with Ruby on Rails. I won't try to impute motives but I think he did it this way because he felt like he was being treated poorly.
- arohner 15y agoThere are two different issues here. 1) A bad security vulnerability at GitHub. 2) Poor design in Rails that makes it easy to produce security vulnerabilities. Igor found 2, and got ignored by the Rails team. His frustration led him to publicly demonstrating 1, which caused a whole lot of people a whole lot of trouble. The people that are irritated at him are irritated at him because of 1, not 2.
- deleted 15y ago[deleted]
- mhurron 15y agoWhat kind of serious company puts important or 'secure' code on github?