8 ms·

I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!

fromonesrc 14y ago
love++
- djbender 14y ago
  love += 1
diminish 14y ago
3 links on HN frontpage for this same vulnerability proves the love of the community to warn each other tenderly.
- danso 14y ago
  There's actually two vulnerability announcements: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/t1WFuuQyavI https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... This one deals with problematic JSON parsing and affects only 3.x. It is dealt with in the release that fixes the other vulnerability
13k 14y ago
<3++
tyre 14y ago
Thanks for your awesome work and continued vigilance Aaron!
joevandyk 14y ago
These are the commits that need to be pulled in, right? https://github.com/rails/rails/commit/d5cd97baa44fa66dc681041a213092b45c57c32f https://github.com/rails/rails/commit/d5cd97baa44fa66dc68104... https://github.com/rails/rails/commit/43109ecb986470ef023a7e91beb9812718f000fe https://github.com/rails/rails/commit/43109ecb986470ef023a7e... Are there others?
- deleted 14y ago
  [deleted]
aeden 14y ago
All kinds of love.
coreyhaines 14y ago
LOVE FOR TENDERLOVE! <3 Thanks for the prompt action.
ghayes 14y ago
As there have been many exploits / issues recently realized in parameters parsing, why isn't there more of a focus on security here? Specifically, this is where users/hackers can put ANY DARN THING THEY WANT and your server has to deal with it. As a simple solution, one could pass a signed auth-hash of the fields generated by form_for, and the server could re-hash the fields submitted to ensure the form data you asked for is what you get (this solves the primary issue with attr_accessible). I feel getting this right is crucial to Rails' future.
- steveklabnik 14y ago
  > why isn't there more of a focus on security here? More compared to what, exactly? This vulnerability was responded to pretty damn quickly after it was reported, given that almost nobody is even paid to work on Rails. If you saw Aaron tweeting about "working over the weekend" a few days ago, well, now you know. That said, you mention attr_accessible in your post: that's gone as of the next release of Rails. Basically everyone agrees that strong_parameters is a better approach, which is why a gem was released that works with 3.2: you can use that better approach now. As was mentioned below, security is a process, not a result. Nobody wants these kinds of issues to happen, but they will happen, and do to every single framework that's used by lots of people.
  - mikeycgto 14y ago
    If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
    - steveklabnik 14y ago
      Agreed! That is what I teach when I do training.
    - pekk 14y ago
      Why is strong_parameters not the only way? Rails is pretty opinionated in many other respects...
tubbo 14y ago
turning rails up to 11..
depa 14y ago
MUCHO LOVE, ALSO GORBY!
deadbadger 14y ago
Getting continuous errors on deploy during the bundle stage like so: /usr/lib/ruby/1.9.1/rubygems/remote_fetcher.rb:215:in `fetch_http': bad response Not Found 404 (http://bb-m.rubygems.org/quick/Marshal.4.8/activesupport-3.2.11.gemspec.rz) Is this because rubygems.org is being nailed?
- outside1234 14y ago
  seems to be - mine is stuck at getting metadata from rubygems.org for 45 minutes. is there an alternative server to fetch this from?
  - steveklabnik 14y ago
    It's been an hour, but you could also fetch straight from github with this in your Gemfile: gem "rails", :github => "rails/rails", :tag => 'v3.2.11'
  - amalag 14y ago
    For a less hammered server, can use http://bundler-api.herokuapp.com http://bundler-api.herokuapp.com I usually just use that one for my apps, much faster than rubygems.org
- spatten 14y ago
  I'm getting exactly the same thing. Glad to know it's not just me.
  - deadbadger 14y ago
    For the time being I've rolled back the gem changes and applied the suggested hotfix (removing XML from the default params parsers). I've been trying for a solid hour to get a deploy out with the updated rails version, and it's just not having any of it. Edit: finally got it out. This deploy model is completely screwed, though. It just shouldn't be normal to have a service like rubygems.org in the daily deploy loop. This is absolutely not a knock on the fantastic volunteers that run it - they simply shouldn't be dealing with this sort of load spike.
techscruggs 14y ago
Aaron, thank you for all your hard work and making the Rails community fun to be a part of. ... upgrading now!
- davesims 14y ago
  Agreed. Watching this develop from behind the scenes (at a distance), I'm not sure any core team could have done better managing the deployment and announcement in a more timely and careful fashion. Well played.
outside1234 14y ago
Thank you for your fast hard work on this - this is what makes the Rails community so great and why I love it over the other options out there. I know this has to have been a stressful weekend. Is there a tip jar anywhere for beer money for the team that worked on this?
- tenderlove 14y ago
  You'll have to ask @bitsweat. I only accept hugs. <3
  - djbender 14y ago
    hugs += 1
  - zende 14y ago
    I'll throw in on Gittip: https://www.gittip.com/tenderlove/ https://www.gittip.com/tenderlove/ Would also be happy to give you a hug ;-)
  - obiefernandez 14y ago
    And you can give him hugs here: http://www.hugboard.com/e5f69b274a http://www.hugboard.com/e5f69b274a
  - lgleason 14y ago
    hugs += 1
tamersalama 14y ago
Thank you for all your work!
jasim 14y ago
The Rails security core team and the awesome collaborators deserve a raise. Thanks for your continued vigilance and effort.
glanotte 14y ago
Thank you Aaron and the rest of the Rails core team. We really appreciate the speed with which you addressed this!
pjungwir 14y ago
Could you confirm that upgrading to the fixed Rails versions means I don't have to add the line changing `ActionDispatch::ParamsParser::DEFAULT_PARSERS`? Or do I have to do both? Thanks!
- zwily 14y ago
  Just one or the other.
coreyhaines 14y ago
Hey, Everyone! Leave a note (and, if you want, a hug picture) to say thank to Aaron for his hard work. This isn't any easy responsibility. http://www.hugboard.com/e5f69b274a/contribute http://www.hugboard.com/e5f69b274a/contribute
rafaelferreira 14y ago
Are there any reports of attacks using this vulnerability?

fromonesrc 14y ago

love++

djbender 14y ago
love += 1

diminish 14y ago

3 links on HN frontpage for this same vulnerability proves the love of the community to warn each other tenderly.

danso 14y ago
There's actually two vulnerability announcements: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/t1WFuuQyavI https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... This one deals with problematic JSON parsing and affects only 3.x. It is dealt with in the release that fixes the other vulnerability

13k 14y ago

<3++

tyre 14y ago

Thanks for your awesome work and continued vigilance Aaron!

joevandyk 14y ago

These are the commits that need to be pulled in, right? https://github.com/rails/rails/commit/d5cd97baa44fa66dc681041a213092b45c57c32f https://github.com/rails/rails/commit/d5cd97baa44fa66dc68104... https://github.com/rails/rails/commit/43109ecb986470ef023a7e91beb9812718f000fe https://github.com/rails/rails/commit/43109ecb986470ef023a7e... Are there others?

deleted 14y ago
[deleted]

aeden 14y ago

All kinds of love.

coreyhaines 14y ago

LOVE FOR TENDERLOVE! <3 Thanks for the prompt action.

ghayes 14y ago

As there have been many exploits / issues recently realized in parameters parsing, why isn't there more of a focus on security here? Specifically, this is where users/hackers can put ANY DARN THING THEY WANT and your server has to deal with it. As a simple solution, one could pass a signed auth-hash of the fields generated by form_for, and the server could re-hash the fields submitted to ensure the form data you asked for is what you get (this solves the primary issue with attr_accessible). I feel getting this right is crucial to Rails' future.

steveklabnik 14y ago
> why isn't there more of a focus on security here? More compared to what, exactly? This vulnerability was responded to pretty damn quickly after it was reported, given that almost nobody is even paid to work on Rails. If you saw Aaron tweeting about "working over the weekend" a few days ago, well, now you know. That said, you mention attr_accessible in your post: that's gone as of the next release of Rails. Basically everyone agrees that strong_parameters is a better approach, which is why a gem was released that works with 3.2: you can use that better approach now. As was mentioned below, security is a process, not a result. Nobody wants these kinds of issues to happen, but they will happen, and do to every single framework that's used by lots of people.
- mikeycgto 14y ago
  If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
  - steveklabnik 14y ago
    Agreed! That is what I teach when I do training.
  - pekk 14y ago
    Why is strong_parameters not the only way? Rails is pretty opinionated in many other respects...

tubbo 14y ago

turning rails up to 11..

depa 14y ago

MUCHO LOVE, ALSO GORBY!

deadbadger 14y ago

Getting continuous errors on deploy during the bundle stage like so: /usr/lib/ruby/1.9.1/rubygems/remote_fetcher.rb:215:in `fetch_http': bad response Not Found 404 (http://bb-m.rubygems.org/quick/Marshal.4.8/activesupport-3.2.11.gemspec.rz) Is this because rubygems.org is being nailed?

outside1234 14y ago
seems to be - mine is stuck at getting metadata from rubygems.org for 45 minutes. is there an alternative server to fetch this from?
- steveklabnik 14y ago
  It's been an hour, but you could also fetch straight from github with this in your Gemfile: gem "rails", :github => "rails/rails", :tag => 'v3.2.11'
- amalag 14y ago
  For a less hammered server, can use http://bundler-api.herokuapp.com http://bundler-api.herokuapp.com I usually just use that one for my apps, much faster than rubygems.org
spatten 14y ago
I'm getting exactly the same thing. Glad to know it's not just me.
- deadbadger 14y ago
  For the time being I've rolled back the gem changes and applied the suggested hotfix (removing XML from the default params parsers). I've been trying for a solid hour to get a deploy out with the updated rails version, and it's just not having any of it. Edit: finally got it out. This deploy model is completely screwed, though. It just shouldn't be normal to have a service like rubygems.org in the daily deploy loop. This is absolutely not a knock on the fantastic volunteers that run it - they simply shouldn't be dealing with this sort of load spike.

techscruggs 14y ago

Aaron, thank you for all your hard work and making the Rails community fun to be a part of. ... upgrading now!

davesims 14y ago
Agreed. Watching this develop from behind the scenes (at a distance), I'm not sure any core team could have done better managing the deployment and announcement in a more timely and careful fashion. Well played.

outside1234 14y ago

Thank you for your fast hard work on this - this is what makes the Rails community so great and why I love it over the other options out there. I know this has to have been a stressful weekend. Is there a tip jar anywhere for beer money for the team that worked on this?

tenderlove 14y ago
You'll have to ask @bitsweat. I only accept hugs. <3
- djbender 14y ago
  hugs += 1
- zende 14y ago
  I'll throw in on Gittip: https://www.gittip.com/tenderlove/ https://www.gittip.com/tenderlove/ Would also be happy to give you a hug ;-)
- obiefernandez 14y ago
  And you can give him hugs here: http://www.hugboard.com/e5f69b274a http://www.hugboard.com/e5f69b274a
- lgleason 14y ago
  hugs += 1

tamersalama 14y ago

Thank you for all your work!

jasim 14y ago

The Rails security core team and the awesome collaborators deserve a raise. Thanks for your continued vigilance and effort.

glanotte 14y ago

Thank you Aaron and the rest of the Rails core team. We really appreciate the speed with which you addressed this!

pjungwir 14y ago

Could you confirm that upgrading to the fixed Rails versions means I don't have to add the line changing `ActionDispatch::ParamsParser::DEFAULT_PARSERS`? Or do I have to do both? Thanks!

zwily 14y ago
Just one or the other.

coreyhaines 14y ago

Hey, Everyone! Leave a note (and, if you want, a hug picture) to say thank to Aaron for his hard work. This isn't any easy responsibility. http://www.hugboard.com/e5f69b274a/contribute http://www.hugboard.com/e5f69b274a/contribute

rafaelferreira 14y ago

Are there any reports of attacks using this vulnerability?