GitHub has reinstated the account of a Russian software developer who discovered a series of security flaws involving the code repository that he eventually shamed the site into fixing over the weekend. Egor Homakov discovered a cryptographically-related security bug on GitHub that allowed attackers to gain administrator access …
Differences of opinion
Their statement says they worked with him to fix it BEFORE he proved their was a flaw. Your story says he was ignored (or received no human response), and felt compelled to prove he shouldn't have been ignored. Which version is correct?
Common practice for severe security bugs to 'vanish' to a developer only section of the bug tracker, though not notifying the poster privately is stupid and far too common. Happened to me before.
Unlikely they just deleted the ticket, more likely to languish at the bottom of the bug queue for years if they didn't see it, so both versions of events are perfectly plausible.
Banning the account was over the top when he did something innocuous for a bug which could be used for many nefarious purposes, irrespective of EULA crap.
Not a Rails vulnerability
It is important to clarify that this was not a vulnerability in Rails itself but in the way it was being used. They forgot to use attr_protected or attr_accessible or didn't use them correctly. It is also worth noting that as of a recent Rails release, attempting to perform this kind of attack when the application has been secured properly will raise an exception (by default) instead of merely logging a warning.
- Xmas Round-up Ghosts of Christmas Past: Ten tech treats from yesteryear
- Analysis Microsoft's licence riddles give Linux and pals a free ride to virtual domination
- Review Hey Linux newbie: If you've never had a taste, try perfect Petra ... mmm, smells like Mint 16
- I KNOW how to SAVE Microsoft. Give Windows 8 away for FREE – analyst
- Special Report How Britain could have invented the iPhone: And how the Quangocracy cocked it up