Comment by maratd | Hacker News Reader

Comment by maratd | Hacker News Reader

Parent Full thread

> and how they should never have had such a vulnerable bug in the first place is even worse.

Bugs happen. Even stupid oh-my-god-i-can't-believe-i-did-that bugs happen. And they happen to the best of us.

However, when someone reports a vulnerability about my code to me or I discover a problem myself, the very first thing I do is break out the grep. I grep the shit out of my code. Because I am a human being. I am a creature of habit. And if I screwed up in one place, I promise you, I did it in other places too.

The problem? Github didn't do that. At least, that's the impression from the information coming out. The guy reported the issue on Friday, they fixed that specific instance of the issue ... and it remained a problem in other places. That is unacceptable and unprofessional. They should have burned the midnight oil and made sure the same problem wasn't prevalent in other parts of the code.

Having said that, I am a loyal Github client and will remain so. Every service provider I use gets a once-a-year-screw-up credit. Github just used theirs. Switching because of one incident is premature and will be sure to cause regrets.

They should have burned the midnight oil and made sure the same problem wasn't prevalent in other parts of the code.

I understand that's the feeling here, but it's unrealistic. I've reported dozens of bugs to shops that ranged in size from 1 to borg. You simply never see a whole set of bugs fixed and pushed live over a weekend. Not even close. Exactly what company have you seen set this standard for professional? The smallest amount of time between notification and public disclosure I've seen get called responsible disclosure is a month. Many, many, many enterprises take six months or longer to push fixes (which is far too long but that's another whole discussion)

I agree to a point.

However, if such a problem was reported to LedgerSMB here is how we handle it:

1) Scope out the problem. What's affected? Are other related open source projects affected? How bad is it? This itself can take a bit of time. We do not rush this because we don't want a full disclosure when it happens to bring other problems into the fore.

2) Within a few days we let the reporter know what we have found and give them a chance to offer feedback.

3) Then we get everyone on the core team together and talk solutions. Once we implement it, we test and release a patch. Two weeks after the patch is released, we release a full disclosure along with a hat tip to the one who discovered it.

The whole process takes time. But the fact is that it's generally better to get a full fix out in two weeks than a partial fix out tomorrow.

So no, don't burn the midnight oil. More speed, less haste.

And this whole thing really doesn't look good for Github.

We didn't have the luxury of time. We were going back and forth with him over the weekend, and he pushed the commit 2 days after the original report. I admit, I was having some issues understanding his vague reports and went down a different rabbit hole early Sunday morning.

I definitely wanted to do a more careful audit and investigation, but my hands were tied.

I don't think anything will happen to Github or even Rails users. There user base will not likely decrease.It will increase infact.

More importantly people reading this forum are very scanty in the larger picture of people writing software around the world. Software and tools get used in 99% of cases for average programmers because of jobs,popularity and usability reasons.

I bet of all the Rails programmers, and Git hub users very few would have heard the news. And of those few who have heard it very few would understand the seriousness of the issue.

The only benefit that has come out of this, is a serious problem has been averted. If this vulnerability had been discovered by some body who makes his bread and butter cracking systems. He could have done a great deal of damage to a lot of systems.

Lets hope that Rails finds and fixes these sort of vulnerabilities. To avoid bigger problems in the future.

"The guy reported the issue on Friday, they fixed that specific instance of the issue ... and it remained a problem in other places."

If I have correctly understood the issue, Igor at first informed Rails, and this was the right thing to do. He was ignored by Rails and then he wanted to proof his view point by applying it to GitHub. How could GitHub inform other places? By contacting Rails, but they already downplayed the issue...

Reply on news.ycombinator.com