rails/rails — comment on commit b83965785db1eec019edf1fc272b1aa393e6dc57
File:  line 0
By DouweM:

@Tie-fighter How is deleting posts, posting as other people and commiting into repos you're not allowed in not exploiting vulnerabilities? Sure, he didn't do any real harm (except to the deleted post), but IMO the right course of action would have been to report this stuff to GitHub before acting on it in public. I can't think of a single way in which what he did was a "better" thing to do.

And you're asking if/how I know how he did it? Read through his last couple of posts, it's pretty clear he's exploiting models where GitHub forgot to protect attributes for mass-assignment by defining `attr_accessible`.