4 ms·

Everyone here that is thinking of giving this company the benefit of the doubt needs to go read their (smeagle) responses to RKearney from the original thread.

Everyone here that is thinking of giving this company the benefit of the doubt needs to go read their (smeagle) responses to RKearney from the original thread. Here are some samples of the careless attitude behind this: ---- "if anyone's concerned about your AWS key, just destroy your IAM user and create a new one. that's what it was designed for." ---- In response to advice saying they should notify users by email: "good idea. actually, we'll just wipe them and force new ones." ---- In response to RKearney warning people about just what exactly is exposed: "in case you have issues with your AWS keys. RKearny's email: ryan@ryankearney.com https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286.. https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286....

ainsleyb 14y ago
This is a severe lack of customer service. The least that can be done is a quick shutdown of the site until there's a good fix, an email to all customers (since legally they have to disclose the breach: http://en.wikipedia.org/wiki/Security_breach_notification_laws http://en.wikipedia.org/wiki/Security_breach_notification_la...), and a thanks out to whomever reported the issue. If you make a mistake, own up to it. Honesty is the best key to building a business, and I'm sure they've at least lost the HN trust for any product in the future.
enoch_r 14y ago
I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somewhat understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the problem, and should be personally attacked. They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to only use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.
- oelmekki 14y ago
  > it's somewhat understandable in the context of a site that unintentionally goes public before it's ready Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions. Actually, I may argue that's the very first thing you do once the controller skeleton is set up.
  - alinajaf 14y ago
    Agreed. You don't even need to add any gems or do any rails magic for this to work. In your controller: def edit @aws_credentials = current_user.aws_credentials end def update current_user.aws_credentials.update_attributes( params[:aws_credentials].slice(:a, :b, :c) ) end
    - bhousel 14y ago
      Don't forget `destroy`.
danielweber 14y ago
I'm a big fan of responsible disclosure, and I think that the HN crowd has far too much of a one-track mind about "always disclose security problems everywhere!", especially with something that may not have been ready for release. But that "contact Ryan if anything goes wrong" is grade A asshole.
zunky 14y ago
@smeagol. First of all you fucked up. So stop acting so high and mighty and apologize to rkearney and everyone else who even thought about signing up for your product. Secondly, if this was just meant for you and your friends, don't go public with it and post it on HN. I highly recommend another hobby in a different field because clearly this one doesn't agree with you. Lastly, please stop calling yourself a nerd.

ainsleyb 14y ago

This is a severe lack of customer service. The least that can be done is a quick shutdown of the site until there's a good fix, an email to all customers (since legally they have to disclose the breach: http://en.wikipedia.org/wiki/Security_breach_notification_laws http://en.wikipedia.org/wiki/Security_breach_notification_la...), and a thanks out to whomever reported the issue. If you make a mistake, own up to it. Honesty is the best key to building a business, and I'm sure they've at least lost the HN trust for any product in the future.

enoch_r 14y ago

I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somewhat understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the problem, and should be personally attacked. They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to only use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.

oelmekki 14y ago
> it's somewhat understandable in the context of a site that unintentionally goes public before it's ready Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions. Actually, I may argue that's the very first thing you do once the controller skeleton is set up.
- alinajaf 14y ago
  Agreed. You don't even need to add any gems or do any rails magic for this to work. In your controller: def edit @aws_credentials = current_user.aws_credentials end def update current_user.aws_credentials.update_attributes( params[:aws_credentials].slice(:a, :b, :c) ) end
  - bhousel 14y ago
    Don't forget `destroy`.

danielweber 14y ago

I'm a big fan of responsible disclosure, and I think that the HN crowd has far too much of a one-track mind about "always disclose security problems everywhere!", especially with something that may not have been ready for release. But that "contact Ryan if anything goes wrong" is grade A asshole.

zunky 14y ago

@smeagol. First of all you fucked up. So stop acting so high and mighty and apologize to rkearney and everyone else who even thought about signing up for your product. Secondly, if this was just meant for you and your friends, don't go public with it and post it on HN. I highly recommend another hobby in a different field because clearly this one doesn't agree with you. Lastly, please stop calling yourself a nerd.