Sign in / up

back to article GitHub reinstates Russian who hacked site to expose flaw

GitHub has reinstated the account of a Russian software developer who discovered a series of security flaws involving the code repository that he eventually shamed the site into fixing over the weekend. Egor Homakov discovered a cryptographically-related security bug on GitHub that allowed attackers to gain administrator …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. David Perry 2
    Stop

    Differences of opinion

    Their statement says they worked with him to fix it BEFORE he proved their was a flaw. Your story says he was ignored (or received no human response), and felt compelled to prove he shouldn't have been ignored. Which version is correct?

    2 0
  2. Antony Riley
    Thumb Up

    Common practice for severe security bugs to 'vanish' to a developer only section of the bug tracker, though not notifying the poster privately is stupid and far too common. Happened to me before.

    Unlikely they just deleted the ticket, more likely to languish at the bottom of the bug queue for years if they didn't see it, so both versions of events are perfectly plausible.

    Banning the account was over the top when he did something innocuous for a bug which could be used for many nefarious purposes, irrespective of EULA crap.

    1 0
  3. James Le Cuirot
    Boffin

    Not a Rails vulnerability

    It is important to clarify that this was not a vulnerability in Rails itself but in the way it was being used. They forgot to use attr_protected or attr_accessible or didn't use them correctly. It is also worth noting that as of a recent Rails release, attempting to perform this kind of attack when the application has been secured properly will raise an exception (by default) instead of merely logging a warning.

    0 0
This topic is closed for new posts.

Other stories you might like