skysight-inc/HackerNews huggingface dataset:
AKA "The end justifies the means". It wasn't ideal, but it achieved and end result that others have been asking for for years to no avail. That justifies the means in my book, and then some. I hope Egor will be given sufficient indemnity for his actions, as, even if misguided, they were clearly well intentioned.
Dear Github, please reinstate Egor
Edit Github has reinstated Egor https://github.com/blog/1069-responsible-disclosure-policy

Going to leave this submission here anyway.
/Edit

I think it would be a good public move for Github to reinstate Egor Homakov's account, @homakov.

Its fairly clear from the discussion here https://github.com/rails/rails/issues/5228 that Egor identified an issue and was making the argument that some kind of fix is needed. His intentions seem to be entirely good, and one of his mistakes was identifying himself while raising the issue at hand.

The other mistake, if you want to call it that, was to demonstrate the exploit to the Rails community with this commit, https://github.com/rails/rails/issues/5239.

The problem here is that since Rails is hosted on Github, many people are assuming this was an attack on Github.

It wasn't. If Rails was hosted somewhere else that was vulnerable in the same way, where that is a separate company or a privately-hosted git repo somewhere, the same commit from the future would have been possible. Whether or not those hypothetical hosting services would react in the same way is, of course, hypothetical.

But speaking about the real world, right now, its clear that Github is one of the most important companies in the world to programmers of all sorts. Even if a programmer doesn't host their projects on Github directly, there are all kinds of libraries and technologies that do host on Github that the programmer uses.

So simply banning Egor's account does absolutely nothing to make Github more secure. Instead, it tarnishes your otherwise excellent reputation and makes you more insecure by discouraging people from discussing security vulnerabilities that may affect your company via the technologies you use. Especially if those core technologies are hosted on your service.

And honestly, the public apology thing is getting a bit old. This is all well and good for letting the public know what you're doing to rectify a vulnerability, https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation. Just do the right thing as best you can. Stop saying you're sorry for every little thing that goes wrong (I'm speaking generally here.)

In the startup my partner and I are working on, we had a discussion about how we're going to setup our culture internally. I can wrap it up in a three word summary, "Don't be assholes."

That means treat our customers right, do the best we can for all parties involved, and generally don't do scummy things that so many other companies do.

So I love Github. So do thousands of other developers, organizations, and companies that use your service. So does Egor. Don't be assholes about this.
This is not a white hat hacker does. A white hat would have contacted Github in private with a PoC done with a dummy account and a test repo. There is a reason responsible disclosure guidelines exist.
> I always felt that "it's up to the developer to do the right thing" violates the normal Rails convention over configuration principles, but I also weigh breaking a large % of existing Rails apps in a way that is not easy to quickly fix heavily.

It can be argued that those apps were already broken. Nobody should complain against a security fix.
Though I will say that mass assignment is about as rookie a rails mistake as you can make, I won't be leaving github.

They've delivered so much value over the past four years for me that I can forgive them this and I'd still have (a little) goodwill towards them left over.
I do believe there are conspiracies out there to influence media. Many corporations and organisations try. There are even professions that exist in order to try.

For instance, in my native Sweden, it isn't so hard. Keep a large enough ad budget and media criticism will be trivial. Then, integrate a bit with the political parties.

But this is for quite specific areas (in Sweden, e.g. food shop chains and home/road building, etc) in a small country with a tradition of consensus solutions.

I have a hard time believing this is easy in a thirty times larger society (USA) than Sweden for larger questions, like political solutions. I don't doubt it is tried, but have a hard time seeing how it could work.

So are there any non-activist sources on this subject? With lots of examples?

I'm a bit allergic to Chomsky. Whenever someone tells me Chomsky is the second coming of Jesus, I ask for sources. And come away unimpressed, with questions like:

"Chomsky argued in your own reference that he criticises Israel a thousand times more than e.g. the horrors of Sudan (which is probably a thousand times worse, compared to a Palestinian description of Israel) -- because he can influence Israel more. But that is bullshit! If Chomsky -- the leading academic critic of USA/Israel -- wrote an article/book and said that 'Sudan's president makes Hitler/Stalin look good' it will have a very, very heavy impact."

I never get a good answer to those questions.

Edit: Quotation. Also, I have to go sleep in a short time, so I won't be able to answer any comments. If you want e.g. discussions about my Swedish examples, check 12+ hours after I wrote this.
Graublau Sans.
I still don't see a correlation (we certainly agree on whether a particular slip of paper is useful), so let's turn it around: what is it about computer science (in the realm of Big-O, lambda calculus, Turing machines, discrete mathematics, and such [obviously I've left a bunch out and intentionally started on the more theoretical. Feel free to ground me in somewhat more useful CS.]) that you think makes for better developers?

I totally agree that an attitude of self-teaching makes better developers. There is a lot in the application of CS, but I would call that Software Engineering.
I've always plugged the here on HN before, and will do it again: http://www.assembla.com

Unlimited private Git, SVN and Mercurial repos for free.

We've been using them for years for all our projects with no issues.
The author cites reporting the issue to the rails community but why didn't he report it to security@github.com? As some of the GH people have already said (on other articles), they would have taken him very seriously and not banned his account if he would have reported it the correct way instead of hacking into high profile accounts.
Show HN: A way for entrepreneurs to connect with business problems to work on
http://repp.herokuapp.com

Originally, my partner and I built this app internally (just in the past few days) to find trends and commonalities in our customer development process in the commercial real estate industry. However, as we kept getting responses about pain points in these professionals' lives, we decided that this information would be really useful to any entrepreneur looking for problems to solve.

Right now the web app is super basic with no login or authentication. It's like a basic notepad.

Ultimately the question is, do you find this sort of information useful? If not, what would be useful?
homokov could have handled this much better than he did, and I don't think anyone is arguing against that. He did break the terms of the service, and he did it by committing to an active project rather than just creating a dummy account for a proof of concept. That proof of concept would have made the front page of this site in no time, so it's not a matter of exposure. Github is completely "in the right" for their decision, yet it was still a bad one.

The simple fact that this discussion is occurring shows that they didn't deal with it "appropriately". They are completely in the moral right- he violated terms, and even if he didn't it's still their website. However, they completely failed from a business and public relations perspective- if your actions result in a bunch of people being pissed off at you (particularly when those people are your active and vocal users) then you messed up. They had a huge opportunity here educate people about how to report these things, and lay the ground work to suspend people in the future, but they chose to lash out instead.
Dear God, I'm shocked at how juvenile and simplistic this post is. Blaming the media for "imposing" things without even considering the probability that the things he finds objectionable are largely a result of the audience responding to that kind of content. Framing it all in conspiracy of the elites. He also doesn't mind preaching on what is "essential knowledge" that "the public" should be interested, but hey that's the norm with any politically opinionated person these days, and especially with academics. But this is just weak - I've read a few things from him before, he didn't seem to know much about the subject and it was mostly demagogy. It does beg the question - why is he held in such high regard by some people ?
I think another issue is that as much as we adults want every white hat hacker to discreetly file a vulnerability report to a designated email address, teenagers, just won't ever do this! That is just the way things are. When you are young, you want to brag about things publicly without really thinking about your actions. I also think a vast majority of teenage pen testers have illusions that their exploits will lead to job offers.

In my opinion: an appropriate response is that, once a talented teenager pen tester is identified, to pay some attention to him/her and guide their abilities. Maybe you can create a private bounty program for them and provide some rules to abide by or even teach them how to do things correctly in an adult world.

Suspending their account immediately might actually be a good initial slap on the wrist for a teenager. Going forward, I would reinstate their account after some guidance has been provided. Especially for someone who is such a fan of GH.

I think that Western countries have a culture of villainizing teenagers who have some technical ability in pen testing. This needs to change in a way that those talents are guided in a more positive direction. Rather than tasking FBI to send teenagers to jail, why not put these talents to work disrupting China's extensive cyber offensive? Maybe this is why China is kicking our collective butts in cyber security.
Oh wait, but it doesn't matter! :D Because, you know, the whole point of the article being that whether or not what he did was "right" is irrelevant because banning him and then presenting a twisted truth to customers is not a productive solution to the problem.
> as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue.

BitBucket is owned by Atlassian for 2 years now and they don't look like they're about to go out of business ($60mil revenue in 2011, 400employees, worldwide offices). When they bought it, it was them who set private repos to unlimited (when @jespern was running it alone, it was set to 5), so I believe they know what they're doing and that it fits their business model. Over 5 collaborators need a paid plan and that's just how they set up the pricing scheme.

As far as I can see as an active user and lurking through their blog and bugtracker, BB is actively developped, so I assume you don't have to worry about them running out of business, looks like it's a valuable asset in Atlassian's software portfolio (at least valuable enough to work on it).
The users who trust Github don't care if it was a "rails issue" or a "github issue"

It's a Github issue no matter what the cause or responsible party.

If Github was run on unpatched windows XP boxes with all IPs public, you wouldn't argue that it was Microsoft's fault because "everyone knows" what a bad idea that would be. The base assumption should not to be completely reliant on your environment and frameworks to be secure, because they very likely have un-patched bugs and exploits. You do what you can to harden yourself up, but when something goes wrong - it's your problem.
that were my first toughs too... but sometimes a little hack hasn't to be complex ;)
I'm not sure why the rails core team was so against this in the first place.

Lack of humility.
I bookmarked this comment since it more or less answers that question: http://news.ycombinator.com/item?id=3452869

In short, when you're dealing with a performance sensitive application they can be helpful to make it blazing fast. When you have a piece of code being executed many times they can be helpful since micro-optimizations start mattering then, too. For the same reason most of us don't write in assembly, most of us probably don't need it for our applications, we're free to waste, but besides being fun/interesting the practical applications where bit hacks can be beneficial do indeed go beyond your short-list. (Game engines (physics, graphics, AI, networking) and databases are two more general topics I can think of off the top of my head, compression is another but could just be a special case of databases.)
I've been pondering a probably similar concept since the fb graph became accessible. These are my thoughts on this matter:

Yes, it is potentially worth a lot to businesses. But not by itself. Think of all the cool things a company could do with this information - those are the things you should be providing to the company. Otherwise you're limiting yourselves to businesses that both have the vision to see the potential AND have the available resources to implement it into their workflow.

If you aim for the marketing potential in identifying connectors/mavens, you should add a layer of services that help businesses to communicate effectively with those individuals, and track how the message spreads through the network.

If you aim for the customer service aspect, you should add a layer that helps connect your information with their CRM systems.

Or you could find strategic partners in those fields, and enable them to integrate your services in their existing product portfolio.
I just threw together a quick gem that will ensure active_record model attributes are protected from mass-assignment unless explicitly declared as mass-assignable.

Granted, this as default will break an app that does not have the correct attributes declared as mass-assignable, but the alternative is a vulnerable app.

https://github.com/stevegraham/default_whitelist
Same exploit, different endpoint. Github agree they "should have...immediately looked for related issues":

https://twitter.com/#!/technoweenie/status/17645071550868684...

...though as they've now unbanned his account (good on them), it's somewhat moot.
I'm sorry but I have to defend Egor here. Here's how you actually report a vulnerability, demonstrated by dfranke here on HN -> http://news.ycombinator.com/item?id=639976

What Egor did was to violate sensible disclosure rules. He should have contacted GitHub in private, created a test repo and demonstrated his exploit there, rather than impersonate users and compromise multiple accounts.

If I was in Github's shoes and I was trying to figure out what damage was done, the first step would be to suspend the account doing the damage to make sure no further surprises were headed my way.
When you hack something, even with good intents, you always end exposing yourself to some form of retorsion.

You can point your fingers to vulnerabilities every day full time just to make the web a better place and many will thank you for this but much more will just threaten you or file a complaint.

This is one of the main motivation behind the no more free bugs movement: http://blog.trailofbits.com/2009/03/22/no-more-free-bugs/
+1 for the usage of "github-gate."
github has commented on the issue, and only suspended his account until they had gotten to the bottom of the issue, the hack, and his intent. This seems totally reasonable (as in he says this wasn't malicious, but let's make sure just in case). His account has been reinstated.

https://github.com/blog/1069-responsible-disclosure-policy

Knee-jerk reaction from people within this community seems baffling to me.
Copied, not stolen.
Should your web application be rich-client from day one?
The parent shouldn't be getting downvoted. Let's not downvote important comments in the conversation just because we disagree with them.
I strongly disagree both in general and as regards web vulnerabilities. For one, Github is in no way responsible for the decisions of the Rails project, and this stunt will cost Github five to six figures. (Anyone who thinks this is in any way exaggerated has not been on an Incident Response team or read what has to happen in industry. Heck, there are individual customers of Github who may have to push the Big Red Button right now.)

For another, there exist many, many applications against which one could demonstrate a bug in Rails or Ubuntu or SSL or just the finding "Lol, P=NP." Pragmatically, would you like that to be your application? I would very, very much not like someone to do one of these to my sites. It would cause an instant nightmare for me. The happy outcome is I lose thousands of dollars and don't sleep for most of a week. The unhappy outcomes are not upper-bounded by death of my business.

n.b. Busting into Basecamp to make a point about Rails would also be morally irresponsible.
That's a shame. Sincerely, a .NET developer.
That is why I don't really believe in 'white hat hacker' label. Organization when humiliated by their vulnerability strike back and treat the white hacker as a criminal.

Supposedly, a white hat hacker is someone hired (or at least, legally authorized) by the company itself to test their security by trying to break in.
Yeah, I think we'll migrate all our private stuff to http://gitlabhq.com/

The way GitHub reacted (blocking @homakov) is just wrong and destroyed all my confidence in them. Even more so when it was pointed out that @zedshaw crashed GitHub and didn't get blocked. http://sheddingbikes.com/posts/1306816425.html

Edit: Given that they have now stated that suspending @homakov was only temporary I no longer bear any ill will towards them.

I'm still disturbed by their security practices though. I expected better by the github guys and I don't like what this implies about the rest of their App.
(And yes I am using attr_accessible and not attr_protected since its inception)

Edit 2: See here http://news.ycombinator.com/item?id=3664839
My worst fear that GitHub is using unsafe mass assignment everywhere was NOT confirmed.
Can't you attach the images to the email, and reference them from the HTML? If that doesn't work, you can send a PDF or Word file.

Putting img tags that link to your server doesn't sound like a very good way to get attractive emails anyway. What if your server goes down? What if the user disconnects from the internet before reading their inbox? What if the user rereads your message after several years and it's suddenly not so attractive anymore?
Given that:

(1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor,

(2) noted in the blog post [1] describing how Github "detected the attack",

I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning.

It's healthy that they've reversed their suspension but the lack of transparency (not to mention potential dissembling) on the decision process regarding the revocation is still troubling.

[1] https://github.com/blog/1068-public-key-security-vulnerabili...
Impressed by how Github handled this. It's easy to get red-faced and smack down with a hammer, and it's hard to remain level-headed and come to the best decision. This seems like it was, in fact, the best decision.

For those of you who didn't see, they were quick to update people and be on the ball: https://github.com/blog/1068-public-key-security-vulnerabili...
Don't suspend him -- hire him.
Just a note: @homakov is no longer suspended, as of about 25 minutes ago: https://github.com/rails/rails/commit/b83965785db1eec019edf1...
I found the first report from 1828 to be excellent and hold the possible key to a cure overlooked by every other, "During each of her periods of confinement for childbearing, the fits were far less numerous and severe in character, but within a few months after she had given birth, they returned."

To bad the evolution of traditional medicine influencing "specialties" will lead to fewer and fewer "common sense" breakthroughs. Without the advent of new "specialties" that fill in the gaps and strengthen the bonds tying every brain surgeon with every podiatrist together, we would have no hope of ever getting as far as we have (which ain't much). There needs to be a reformation of medical school education, what we have now is CRAP.
Yeah, it seems to me that committing a fix with a commit message along the lines of "Oops, you left this open. Don't worry, though, I fixed it." would've been the best option.
His account has been unsuspended.

https://github.com/rails/rails/commit/b83965785db1eec019edf1...
I hate to be the one pointing out this but it's a shame that a company like GitHub will reward responsible disclosures just with a thank you and the promise to not pursue a legal action.

http://help.github.com/responsible-disclosure/

"white hat researchers are always appreciated"
I think the accounts mean organisations. For instance, he exploited this vulnerability to add his public key to the authorised rails user keys. He probably did this to two other "accounts". His exploit wasn't logging in or impersonating any other accounts AFAIK.
> (1) the temporary nature of the suspension was not communicated to Egor at the onset of the situation, nor,

Are suspensions not by definition temporary?
So you're actually proud of writing that sleazy piece of damage-control distraction bullshit?

You're completely misrepresenting what happened. Someone pointed out that Rails makes all Rails applications astoundingly insecure by default since forever, and got condescendingly dismissed several times by the people in charge.

He then proceeded to make a point by demonstrating the severity of the security flaw, and you made him look like some malicious hacker that got swiftly punished by the ever-vigilant GitHub team.

Public Key Security Vulnerability, really? You detected the attack and expunged the unauthorized key? What a load of bullshit.
Move on? There's no lessons we can take away from this?
It must have been updated recently as there are now <sarcasm> tags around the 'strange'
960 Grid System [Slides]
رسائل عيد الام 2012
عيد الام 2012
رسائل عيد الام 2012
http://www.mzgat.com/vb/t1412.html
عيد الام 2012
رسائل عيد الام 2012
عيد الام 2012
I used GitHub and I'm not moving my stuff off. If an app gets hacked, then not long after, that app will likely be the most secure place. GitHub at least keeps it up most of the time. Who you really should be mad at are the Rails maintainers and the RoR community. I switched from Java to Ruby a few years back, and since day one, everyone using Rails has been slack on security. The reason is that they make things too easy to leave wide open. Don't believe me? Read the Rails official documentation for starting off. It is all about ease of use, not security. If you are new, you have no idea what you've really left open even when you just generate a scaffold as they show you to do. The main thing that Rails security has going for it is that the adoption of Rails is still relatively low, and because a newbie isn't likely to scale their app well, odds are you won't have an extremely popular, extremely performant Rails app that is just asking to be hacked that easily.
> At our startup, we've developed an algorithm that analyzes your Facebook friends and the connections between them to determine your fraternity and sorority.

Great!

Then again, I don't belong to a fraternity or a sorority.
Nike Zoom Kobe VII 7 Duke Shoes for Sale