3 ms·
It's worth mentioning that Github has forked Rails and is working off their own private branch of Rails 2.3. Not saying that was relevant to this exploit, mind
by jim-greer 13y ago
It's worth mentioning that Github has forked Rails and is working off their own private branch of Rails 2.3. Not saying that was relevant to this exploit, mind you.
https://github.com/github/rails https://github.com/github/rails
http://www.kalzumeus.com/2013/06/17/if-your-business-uses-rails-2-3-you-need-to-move-to-a-supported-option-asap/ http://www.kalzumeus.com/2013/06/17/if-your-business-uses-ra...
- pjungwir 13y agoIt is relevant to this: > I . . . decoded _gist_session cookie (which is regular Rails Base64 encoded cookie) In Rails 4 the session cookie is encrypted with a server-side secret, so the end user can't decipher it.
- steveklabnik 13y agoIsn't gist an entirely separate application from dotcom? My impression was gist is a Sinatra app, not Rails.
- kneath 13y agoGist is indeed running Rails 4.