8 ms·
Commit that changed my life
- redact207 14y agoHow interesting he ended up in Mui Ne in Vietnam - it's one of the places I've been considering for a quit-your-job-and-focus-on-launching spot. Mui Ne is a very small coastal town around 200KM East of Ho Chi Minh city. Although tiny, constant off-shore winds has increasingly made it the kite-surfing capital of SE Asia. Living expenses are cheap, and I've calculated a pretty comfortable lifestyle for USD1,200 pm (YMMV). His post is somewhat testament to a usable internet connection.
- homakov 14y agomui ne is not so cheap because of tons of russian tourists coming. I used to spend $2k/month here. but my apart is in the middle of it and it was winter (high season). Internet is pretty decent too!
- AYBABTME 14y agoConsider Nha Trang too.
- muloka 14y agoI've heard that Vietnam is starting to really "westernize" and is pretty good place to invest in right now.
- itafroma 14y agoThe Hacker News discussion from a year ago about the original incident: http://news.ycombinator.com/item?id=3663197 http://news.ycombinator.com/item?id=3663197
- warmwaffles 14y agoThis was a fun day of Github notifications being sent to me constantly because I made a comment pretty early
- glitchdout 14y agoAnd here are all of Homakov's achievements this year: http://homakov.blogspot.pt/2013/03/contributions-2012.html http://homakov.blogspot.pt/2013/03/contributions-2012.html Pretty impressive!
- vishaltelangre 14y ago<3 (y) Keep up such great job, Homakov.
- artursapek 14y agoThat consulting site is so MVP. I love it.
- homakov 14y agothat design costs $10k, appreciate it!
- charlieok 14y agoCan't blame you for adding a plug in there. It's your anniversary after all :)
- artursapek 14y agoTrust me - as a design student, seeing talented people not care about design can be very refreshing. Keep on keeping on my friend.
- codeulike 14y agoMost Valuable Player?
- djsipe 14y agoMinimum Viable Product ;)
- 14y ago
- purephase 14y agoThis guy keeps popping-up. Very impressive for a years worth of work. We should be lucky to have someone willing to do this so openly, even after the rebuff from the community. He could have easily gone black hat and we'd all be the worse for it.
- brokentone 14y agoI was never against Egor, I don't know that he had a lot to apologize for -- but others do. Either way it's very mature of him to offer apologies. Shows personal growth while learning and demonstrating very succinct security POCs. This kid is one to keep your eyes on. Egor, if you make it to NYC, let me buy you a drink.
- homakov 14y agothanks! i'm already choosing a flight for June :)
- carterschonwald 14y agoAwesome. Feel free to hit me up at well when you're in NYC! Stumbling into doing what you really love is .... magical. Consulting is a lot of work, make sure you have your work pipelined far ahead of time yet avoid overloading yourself! Sounds like you've had a benignly interesting year and learned a lot. What more could someone want?
- misiti3780 14y agoIll drink some beers in NYC also
- dguido 14y agoCome for SummerCon http://www.summercon.org http://www.summercon.org
- pragone 14y agoLikewise Egor - I'd be very excited to meet. I was extremely impressed with the issues you had raised last year, and would love to buy you a beer
- borski 14y agoLikewise, if you make it to the Bay Area, beers are on me. I'll even make you some homemade borscht - one web security Russian to another. :)
- niggler 14y agoI'm waiting for Egor to spend some time with nodejs ... would like to see what he finds
- NuZZ 14y agoHeh, been thinking myself of open sourcing an ecommerce site I'm building from scratch in node. Not sure if it would be good or bad. The benifits of course being; a learning resource for newbs, a good transparent portfolio piece, easy collaboration with strangers on what is best etc. Downsides being; exposing potential security holes, embarrassment due to facepalm worthy pieces of logic in code (really, a plus) etc.
- yuchi 14y agodo you have any economic reasons to keep it closed? If the answer is no, then push it open source. Full stop. It's a gain for everyone.
- no_more_death 14y agoNodeJS is written from a MUCH different approach than Rails. An example quotation from Isaac Schlueter (and he says this OVER AND OVER): We like dull models. They're easier to reason about. Programs should be boring dull things that solve problems in predictable ways. [1] [1] The whole discussion is most instructive. https://groups.google.com/forum/?fromgroups=#!msg/nodejs/kxw_rSqu3AY/sydRbXlUgaoJ https://groups.google.com/forum/?fromgroups=#!msg/nodejs/kxw... Of course, you may easily download a framework that makes foolish choices as a number of Rails developers have migrated to javascript :-p. Actually, I don't have a "thing" about Ruby or Rails developers, but some aspects of their mindset are very dangerous. The first time I heard that YAML could initialize objects from the serialization structure, I was absolutely shocked. How could that NOT be a disaster? Take care. You're responsible for your code and its security. You're not playing a game. Your business is not a hackathon. Don't claim to offer "services" unless you are plan to be a servant of others. Servants don't code recklessly. You are the custodian of your clients' digital life and wellbeing. Choose projects run by grownups -- like izs and ry (the people who have run nodejs). Again, getting hacked is NOT okay. By the way, if you want to learn how to run a project, subscribe to the nodejs-dev thread. That's a first-rate education in how to manage a large project with a lot of hype and growing pains. Watch and take notes.
- rubyrescue 14y agoIronically, people said he should have handled the commit differently, and perhaps he should have. But here we are talking about him 1 year later. I think he probably shouldn't have done it, but on which side of the pg/YC line of creative subversion did his stunt actually fall?
- mpyne 14y agoWell let's be fair, we're talking about him because he didn't rest on his laurels, he's been out there doing more and more. Personally I thought it was hilarious, you can hardly be more gentle in the process of 0wning a system like that and as I recall he did try to warn them beforehand.
- mikek 14y agoWhat's the backstory on this?
- InclinedPlane 14y agoHe discovered a major vulnerability in github and pointed it out by making a commit to the rails master repository (which has rather obvious serious repercussions from a security standpoint).
- asveikau 14y agoMy recollection (though I don't know much about rails and this is just going from memory) is that he attempted to make an argument to the rails team for more secure defaults in parameter parsing and for the framework to steer apps towards more secure use. When they brushed him off and said it was ultimately the caller's responsibility to use it right, he exploited github to make his point.
- InclinedPlane 14y agoIn my impetuous 20s I did something similar. I was rather ... well, rude, really in pointing out a major security flaw on the forums of one of the more famous tech sites. Things devolved from there and I ended up being banned, though they did fix the problem rapidly even so. Since then I've learned the value of tact.
- homakov 14y agoI agree about responsible disclosure but that problem had many facets, and I was rather trying to point out rails problem, sadly, using github hole.
- InclinedPlane 14y agoIt's a fine line sometimes. I think your commit is mostly defensible. It's really an open question. What do you do when you point out a serious security issue and it doesn't get the attention it deserves? I think your commit definitely proved that the issue was being downplayed far too much. Is there some better middle ground? If proving a vulnerability results in it getting fixed overnight and merely describing it results in it getting fixed never then what's the right course of action?
- jmathai 14y agoI imagine the Internet will be kind and you'll go on to do great things. We've all done things we regret and deserve apologies. It's not the mistake that defines you but how you respond afterwards.
- MojoJolo 14y agoI read almost all the notes in the Github page and it lasted for months. There are different sides shown. BTW, I think travelling cost and need so much money. I wonder what are Egor's source of income. Don't know him that much so I just assumed consulting (Sakurity) is just his source of income. Also, if Egor is in South East Asia at the moment, he should visit the Philippines!
- shadowsun7 14y agoEgor, if you're ever in Singapore, please hit me up. I'll organize a meetup via NUS Hackers at the National University of Singapore. Would be interesting to let other university-level students hear about your experience. (My email address's on my personal site (which, in turn, may be found on my profile)).
- Lucadg 14y agoyou've got a Singha beer in Bangkok too :) I worked a lot of time with a great Russian developer until year. Took him to Mexico to work together (no visa requirements) for 3 months. He came from Siberia and I showed him the ocean for the first time then we travelled by car around the country. So far the russians are the best for me, seriously. Would love to meet you.
- homakov 14y agoi know Siberia guys. if you show him the ocean - he is happy for the rest of his life! see you in BKK
- adrianmsmith 14y ago"I left St Petersburg, Russia. I see no future for myself in my country", Could you elaborate?
- homakov 14y agougly weather + no prospectives for IT + unsafe streets I had a decent Rails job there but I have... "ambitions". Just wanna take over the world
- tantalor 14y agoSomebody just hire him, amiright?
- lhnz 14y agoWhy be hired when you can consult?
- throwawayG9 14y agoHow does that work? I never understood what a consultant does exactly. Offers advice?
- homakov 14y agoI have no idea what other consultants do. What I do: try to hack(penetration), propose ways to secure your app, explain risks and steps to be made..
- throwawayG9 14y agoGood to know, thanks Egor!
- nicholassmith 14y agoThe argument with security research is how do you responsibly deal with the knowledge when people aren't listening? Well, in this case starting a fire to prove there's smoke wasn't the best decision. It takes a lot to admit you were wrong publicly and offer a mea culpa, and a lot to not get disheartened and stop researching. Kudos Egor, I'm sure I'm not the only person watching your work with interest.
- jnazario 14y agoglad to see you growing, egor.
- bonzoesc 14y agoEgor, thanks for your writing about the OAuth 2 standard! I've implemented that a few times in the last year and would be in serious trouble (not immediately, but when somebody notices) without your writings.
- Aardwolf 14y agoThe post links to this: https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57 https://github.com/rails/rails/commit/b83965785db1eec019edf1... And I have a rant about that: I wanted to see the date when that commit was done. But all it says as "date" is: "a year ago". Why? Why can it not say the actual date? "A year ago", what does that mean? I want to know which month and day, even the time!
- vito 14y agoIf you hover over them the full time shows up as a tooltip at least.
- uxp 14y agoAdding different resource identifiers to the url can also retrieve different commit formats: Email Patch: https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57.patch https://github.com/rails/rails/commit/b83965785db1eec019edf1... Unified Diff: https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57.diff https://github.com/rails/rails/commit/b83965785db1eec019edf1...
- danso 14y agoI kept a list of the best things I read in 2012. This github commit was near the top of it...everything about it, from its technical insight to how spectacularly (in an attention-grabbig sense) it was executed, to how it spoke about the constant conflict between "read the documentation" and "save the developers from themselves"...fantastic. I loved the commit from the future :) https://github.com/rails/rails/issues/5239 https://github.com/rails/rails/issues/5239