3 ms·
All they needed was someone with the intelligence necessary to type: gem 'devise' into a textfile.
by fleitz 14y ago
All they needed was someone with the intelligence necessary to type:
gem 'devise'
into a textfile.
- pjscott 14y agoLinkedIn is written almost entirely in Java, so Devise would not have worked out that well. Using something like jBCrypt would have been almost as easy, though -- if they'd thought of it from the beginning. The failure here is just that whoever wrote the auth code didn't know that it was a problem, or thought (incorrectly) that using something like bcrypt would be significantly more effort.
- JshWright 14y agoI'm not sure Rails would be the go-to platform is security is a primary concern...
- lawrencepit 14y agoSure thing: Security announcement: Devise v2.2.3, v2.1.3, v2.0.5 and v1.5.4 released http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/ http://blog.plataformatec.com.br/2013/01/security-announceme...
- fleitz 14y agoUpgrade immediately unless you are using PostgreSQL or SQLite3. So using a real database mitigated the entire issue. Secondly, this security issue doesn't allow you to retrieve every user's password in 8 hours.