Double Shot #831

A Fresh Cup:Double Shot #831

Monday, March 5, 2012 at 5:32AM Long weekend out with the Boy Scouts helping people clean up after tornadoes. Puts a lot of this software nonsense in perspective. wow how come I commit in master? O_o - Big kerfluffle over the weekend when this commit appeared in Rails master. The bottom line is that GitHub missed properly using Rails' tools to prevent mass-assignment bugs. Some of the fallout: How-To - The hacker involved explains what he did. Public Key Security Vulnerability and Mitigation - GitHub's explanation and response. Ruby on Rails Security Guide - Rails has publicized how to prevent this sort of thing basically forever. Responsible Disclosure - Where and how to responsibly report GitHug security issues. Ruby on Rails Security Policy - Where and how to responsibly report Rails security bugs. Not that I think this was a bug in Rails, but that's how some people are...

Full article: http://afreshcup.com/home/2012/3/5/double-shot-831.html