5 ms·

I'm curious, did you submit a bug report for this patch? I can't find it on http://rails.lighthouseapp.com http://rails.lighthouseapp.com. It seems odd to me t

by kneath 17y ago

I'm curious, did you submit a bug report for this patch? I can't find it on http://rails.lighthouseapp.com http://rails.lighthouseapp.com. It seems odd to me that you would use Tumblr and Hacker News as a sounding board for a security flaw rather than submitting a bug report or notifying the Rails team through existing mailing lists.

nate 17y ago
"Security vulnerabilities should be reported via an email to security@rubyonrails.org, do not use lighthouse for reporting security vulnerabilities. All content in lighthouse is publicly available as soon as it is posted." Yes, as I mention in the blog post, I've attempted to contact this security list and a couple members on the core team through their individual email accounts over a week ago. I've only received one response last Thursday that someone would look into it, but the issue seemed to die there. Now that enough time has been given for the security list to look into the problem (and hopefully not ignore it), the best practice I thought would be to tell as many people as possible about it so the fix can be applied and publicized. I felt I'd get a lot bigger audience here at Hacker news than the rails bug tracker. The bigger the audience the more people that can get their Rails 2.3 instances fixed if they are effected and avoid a problem. I was also planning on posting it there, but feel free to do it as well.
- nate 17y ago
  Here's a ticket now though. https://rails.lighthouseapp.com/projects/8994/tickets/2755-security-hole-found-in-rails-23s-http_authenticationrb https://rails.lighthouseapp.com/projects/8994/tickets/2755-s... And I've also put it up on rubyflow.
- tptacek 17y ago
  This is an absolutely classic indie/startup security fuckup. (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) respond promptly with a "security flaw ID". You literally don't have to do anything more than this --- mechanically --- to get good-faith people not to publish flaws publicly.
  - jf 17y ago
    Where should the security contact information be? If you found a flaw on site example.com, where would you look first for a security contact?
    - pmjordan 17y ago
      Probably "feedback", "contact us", and "support", roughly in that order.
    - tptacek 17y ago
      /security, security@, the "security" tab on the front page.
    - petercooper 17y ago
      Depends on the protocol the security flaw is with, but RFC 2142 would indicate that if it's a Web issue, then webmaster@example.com - sadly people don't pay attention to many standards like this anymore, though, because they'd rather the Internet be broken.
      - tptacek 17y ago
        A weird comment, since this isn't a web issue, it's an issue with a software library.
- nzkoz 17y ago
  Nate, I'm sorry that you weren't told that we were working on this as part of a point release that was due out in the next 24 hours. Clearly there's been a failure in communications somewhere along the line. For what its worth your emails to the security list never arrived in my inbox. There's something wrong with one of our mail servers, but other messages to that list arrive frequently. However I remain incredibly disappointed that you posted this so publically without so much as following up one more time with pratik, or emailing the rails core list or anything. The wheels were in motion with this one, and drama like this will merely distract people from the issues at hand. Michael Koziarski Rails Core Team Member and 'Dude who gets the security emails'
  - tptacek 17y ago
    The onus is on you to be responsive. If that's not going to work, then, respectfully, think about getting someone else to answer that email address? We ship Rails code; if it helps, we'll answer the mails. The problem isn't just that the mails didn't go through; it's also that you apparently didn't tell the reporter where you were in the process. Before you express incredible disappointment, can you tell us that you asked him not to post? Another piece of advice, from crisis management: don't feed the story. I'm actually interested in what your response was now (so I can learn more about how Rails handles stuff like this), but I don't see how your team benefits from hashing this disagreement out in public. It seems so lose-lose for you. Just apologize for the confusion and say you're fixing it and let the story go away.
    - nzkoz 17y ago
      We'll do a full announcement, and in a week or so report on what changes we've made (moving the mail server being an obvious one). Nate was told that we were traveling and that we'd get back to him. I then went about fixing the issue, verifying there weren't similar issues in other areas of the framework etc. Ideally we would have told nate the release timetable, but that wasn't clear yet. Clearly we messed up here. However I'd hope in future people would send an email saying "any update" before posting to their blog and crying 'unresponsive'.

by kneath 17y ago

nate 17y ago

"Security vulnerabilities should be reported via an email to security@rubyonrails.org, do not use lighthouse for reporting security vulnerabilities. All content in lighthouse is publicly available as soon as it is posted." Yes, as I mention in the blog post, I've attempted to contact this security list and a couple members on the core team through their individual email accounts over a week ago. I've only received one response last Thursday that someone would look into it, but the issue seemed to die there. Now that enough time has been given for the security list to look into the problem (and hopefully not ignore it), the best practice I thought would be to tell as many people as possible about it so the fix can be applied and publicized. I felt I'd get a lot bigger audience here at Hacker news than the rails bug tracker. The bigger the audience the more people that can get their Rails 2.3 instances fixed if they are effected and avoid a problem. I was also planning on posting it there, but feel free to do it as well.

nate 17y ago
Here's a ticket now though. https://rails.lighthouseapp.com/projects/8994/tickets/2755-security-hole-found-in-rails-23s-http_authenticationrb https://rails.lighthouseapp.com/projects/8994/tickets/2755-s... And I've also put it up on rubyflow.
tptacek 17y ago
This is an absolutely classic indie/startup security fuckup. (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) respond promptly with a "security flaw ID". You literally don't have to do anything more than this --- mechanically --- to get good-faith people not to publish flaws publicly.
- jf 17y ago
  Where should the security contact information be? If you found a flaw on site example.com, where would you look first for a security contact?
  - pmjordan 17y ago
    Probably "feedback", "contact us", and "support", roughly in that order.
  - tptacek 17y ago
    /security, security@, the "security" tab on the front page.
  - petercooper 17y ago
    Depends on the protocol the security flaw is with, but RFC 2142 would indicate that if it's a Web issue, then webmaster@example.com - sadly people don't pay attention to many standards like this anymore, though, because they'd rather the Internet be broken.
    - tptacek 17y ago
      A weird comment, since this isn't a web issue, it's an issue with a software library.
nzkoz 17y ago
Nate, I'm sorry that you weren't told that we were working on this as part of a point release that was due out in the next 24 hours. Clearly there's been a failure in communications somewhere along the line. For what its worth your emails to the security list never arrived in my inbox. There's something wrong with one of our mail servers, but other messages to that list arrive frequently. However I remain incredibly disappointed that you posted this so publically without so much as following up one more time with pratik, or emailing the rails core list or anything. The wheels were in motion with this one, and drama like this will merely distract people from the issues at hand. Michael Koziarski Rails Core Team Member and 'Dude who gets the security emails'
- tptacek 17y ago
  The onus is on you to be responsive. If that's not going to work, then, respectfully, think about getting someone else to answer that email address? We ship Rails code; if it helps, we'll answer the mails. The problem isn't just that the mails didn't go through; it's also that you apparently didn't tell the reporter where you were in the process. Before you express incredible disappointment, can you tell us that you asked him not to post? Another piece of advice, from crisis management: don't feed the story. I'm actually interested in what your response was now (so I can learn more about how Rails handles stuff like this), but I don't see how your team benefits from hashing this disagreement out in public. It seems so lose-lose for you. Just apologize for the confusion and say you're fixing it and let the story go away.
  - nzkoz 17y ago
    We'll do a full announcement, and in a week or so report on what changes we've made (moving the mail server being an obvious one). Nate was told that we were traveling and that we'd get back to him. I then went about fixing the issue, verifying there weren't similar issues in other areas of the framework etc. Ideally we would have told nate the release timetable, but that wasn't clear yet. Clearly we messed up here. However I'd hope in future people would send an email saying "any update" before posting to their blog and crying 'unresponsive'.