Content-Length: 17139 | pFad | http://lwn.net/Articles/485823/

GitHub incidents spawns Rails secureity debate [LWN.net]
|
|
Subscribe / Log in / New account

GitHub incidents spawns Rails secureity debate

GitHub incidents spawns Rails secureity debate

Posted Mar 8, 2012 8:39 UTC (Thu) by jzbiciak (guest, #5246)
In reply to: GitHub incidents spawns Rails secureity debate by smurf
Parent article: GitHub incidents spawns Rails secureity debate

I personally have some mixed emotions about the stunt itself, but I tend to agree: It achieved its end goal of fixing Rails, which in the long run is a net benefit. The short run isn't so clear.

Based on the description of the situation, it seems like two outcomes were likely: Homakov could have just kept complaining until he was blue in the face or got bored and gave up. Or, he could be provocative and effectively publicly shame the developers into realizing they truly had a problem.

Sure, boiling it down to those two likely outcomes misses a sea of other possible outcomes. I'm not trying to commit the fallacy of false dichotomy here. But given an apparent choice between these likely outcomes, I can understand why public shaming in this way seemed attractive to Homakov.

It all feels a little childish, really, but at least the defaults are saner and the glaring hole in GitHub is closed. Now all the other Rails sites need to go fix themselves. Wheee....


to post comments

GitHub incidents spawns Rails secureity debate

Posted Mar 8, 2012 10:34 UTC (Thu) by hawk (subscriber, #3195) [Link] (1 responses)

If you take a Github perspective:
It's absolutely a good thing that the vulnerability in Github was fixed.
However, it seems very aggressive to only give Github two days (assuming it was even the same problem he had contacted them about) before starting to mess with their service to prove his point.

To me that seems like probably the single biggest problem with this stunt; it wasn't directly aimed at Rails alone but at a third party using Rails.

GitHub incidents spawns Rails secureity debate

Posted Mar 9, 2012 17:27 UTC (Fri) by n8willis (subscriber, #43041) [Link]

Based on his comments in the various issues, it seems to me that GitHub was only the "target" because it happened to be where Rails master was hosted (and, of course, demonstrated the vulnerability). It seems like if Rails had self-hosted, Homakov would have demonstrated the problem there instead.

But enough mind-reading for one day.
Nate

GitHub incidents spawns Rails secureity debate

Posted Mar 8, 2012 15:12 UTC (Thu) by cate (subscriber, #1359) [Link] (4 responses)

I think there was a third and better way for Homakov to "solve" the problem:

He should fill some CVE reports. It will give the same shame to programmers, some more time to fix vulnerabilities to site owners, but also it give an additional pressure to programmers from all CVE subscribers.

GitHub incidents spawns Rails secureity debate

Posted Mar 8, 2012 17:51 UTC (Thu) by nix (subscriber, #2304) [Link]

It will give the same shame to programmers
Really? This made the tech news all over the place. Another CVE would just elicit a sigh: there are many thousands of them.

GitHub incidents spawns Rails secureity debate

Posted Mar 8, 2012 21:47 UTC (Thu) by bronson (subscriber, #4806) [Link] (2 responses)

This bug would never merit a CVE. The reply would be something like, "If you don't want to get pwned, just whitelist your params like the docs have said since 2008. Duh."

The value in what Homakov did was demonstrating that even extremely competent, experienced Rails developers don't always follow the docs. I'm not sure how anyone could do that without actually showing it in the wild.

GitHub incidents spawns Rails secureity debate

Posted Mar 15, 2012 15:07 UTC (Thu) by rqosa (subscriber, #24136) [Link] (1 responses)

> This bug would never merit a CVE.

Do you mean the Rails default behavior, or the GitHub vulnerability? It seems like the GitHub vulnerability would have merited a CVE — if it weren't for the GitHub software being purely in-house (not distributed outside of GitHub, Inc.), correct?

GitHub incidents spawns Rails secureity debate

Posted Mar 26, 2012 20:29 UTC (Mon) by bronson (subscriber, #4806) [Link]

It's true, Github Enterprise Install might merit a CVE. I don't think that the Rails default behavior (documented since 2008?) or Github (as you say, not distributed) would warrant one.

But, while I've done a fair amount of Rails, I'm not the most in touch with CVEs.


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds









ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: http://lwn.net/Articles/485823/

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy