Hacker News Reader

Comment by xpaulbettsx | Hacker News Reader

In the future, if folks find vulnerabilities in GitHub, please report them via an Email to security@github.com or support@github.com.

View on HN

Or if you want to keep your account, don't tell GitHub, but sell the vulnerability on black market and make some profit off of it.

We will never, ever suspend or ban accounts that follow responsible disclosure. Ever.

Please update your TOS to explicitly define what 'reasonable disclosure' is. I'm a paying customer and this comes off as arbitrary.

Can you not see that to many people, suspending Egor's account looks churlish and petty.

It's bad PR with your core demographic.

If the only activity he's done is what he's mentioned in those issue comments - he really needs his account reinstating soon.

There was no malicious intent from those comments - and he's done you a favour.

If his account doesn't get reinstated - Github has become something I didn't think it would whilst the founders were still in the business.

I think from a PR point of view with respect to the rest of the developer community you might have lost this one. You didn't eliminate the threat posed by him as an individual because he can create a new account.

(Note: as far as your enterprise or big-corp clients, you probably did the right thing, because that is what they would have done and that is what they expected. So if they are the clients who put bread on your table, then you have acted correctly)

What I think you could have done better (and I speak as a developer not a corporate client): issue a public note saying something to the effect of "Thanks for finding this out, maybe you'd like to interview with us. But please, everyone, do not do it this way, this is against TOS and most likely illegal. Here is is the email where to report these things and we will make sure to give you full credit after we fix the problem".

A lot of the fire could have been cooled with the suspension notice being accompanied with (ideally preceded by) a personal note to Egor. The absence of that is what makes this seem more like a GoDaddy firing-from-the-hip move than a rationally thought out one.

He didn't delete or break anything, yet got the issue raised and fixed near-instantly. That strikes me as responsible. Stop parroting buzzwords - nobody likes a pedant.

As someone who uses Github quite a bit: Closing his account was a shitty move.

The hacker reported the vulnerbility responsibly but was ignored. Now you've suspended his account even though he did no harm. It looks from the outside like you suspended his account because he embarrassed you and doesn't have the public clout of someone like Zed Shaw, who also demonstrated a vulnerability (and, unlike this case, caused some downtime) yet faced no similar reprisal.

The parent shouldn't be getting downvoted. Let's not downvote important comments in the conversation just because we disagree with them.

This is bad advice.

Did github run over your dog or something?

To be honest, rather than taking it out on a 18-year-old messing around for bragging rights, you really should have ripped a new one into the Rails people. They knew of this problem (two bug reports were filed and closed) and completely dropped the ball. Now, this kid was noisy but harmless, and it did report the bug; someone else might have found the same hole (or read the same bugs) and exploited it silently for weeks.

This was really the worst option: you've taught a kid to keep his mouth shut next time he finds a hole. It will be much safer for him to sell it on the black market for a quick buck.

It's poor design in Rails, but not a security hole as such. The security hole was on GitHub's side.

I'm no Rails expert, but I tend to like the OpenBSD philosophy: if you ship with default options that are known to be insecure, you have a security bug.

I know security is always a trade-off, but when your largest and most famous testimonials, with all their mad skillz and street cred, still manage to get it so spectacularly wrong, it's clear that the core engine is as guilty as any other component.

I like the part where the Rails developer says:

The user has a flag to secure by default, I personally think that is enough. https://github.com/rails/rails/issues/5228#issuecomment-4300...

In other words, Rails actually does have a flag to make the mass assignment feature secure by default. But this flag defaults to 'false'.

https://github.com/rails/rails/pull/4062/files#diff-1

That's what PHP programmers were saying for years regarding magic_quotes (which didn't actually make things less secure). That this is apparently the default behaviour of Rails... yeah, it's a security issue.

Are you planning to unban him later?

I see why you'd want to suspend his account while you are fixing the hole. And I can see that it sucks that you got caught in the crossfire. And that reporting the bug quietly instead of announcing it to the whole world would cause much less headache.

OTOH after reading the rails bug report I think that homakov's only option was to make a high profile demonstration and basically shame the Rails devs into fixing it. I realize that it's incredibly shitty for you, but I'm afraid they'd just write it off if he kept it quiet.

Reply on news.ycombinator.com