Code for open-source Facebook riddled with landmines

http://www.theregister.co.uk/2010/09/16/diaspora_pre_alpha_landmines/

by tptacek • 16 years ago

57 86 16 years ago

theregister.co.uk

steveklabnik13• 16 years ago

+1 from me. The more I check out the code, the more screwed up stuff I find.

I went to go try and fix the XSS bugs and found no view testing, or integration testing. Just model and controller unit tests. I managed to get a general patch in [1] to help a bit, but there are other, deep seated problems. This needs a lot of work. I'm no security expert by far, so like he says in TFA, I fear for what tptacek or someone that knows what they're doing could do.

1: http://github.com/diaspora/diaspora/commit/22edec57766356cdc...

anthonyb2• 16 years ago

Thanks, I was wondering why they had XSS bugs. Surely the point of using a framework is so that you don't have to think (too hard) about that sort of low level security issue?

steveklabnik13• 16 years ago

You'd think. Rails 3 is supposed to handle this, Haml has that setting I enabled...

tptacek9• 16 years ago

The problem with stuff like this is, I'm not going to look at it. This story came about in part because Coda Hale (another security pro) posted a message to Twitter, linking to the crypto code in Diaspora with an abstract "uh oh". It was warranted, I posted a message to that effect, and got an inquiry, which was more properly addressed by Patrick, who has just provided Diaspora with several thousand dollars of free consulting.

What was the problem I was getting at? Oh, yeah: Diaspora has no apparent access to the software security expertise they need to pull this off. I looked at it for 17 seconds, rolled my eyes, and stopped reading. Maybe someone at iSec Partners will take this project under their wings. But why? Most software security professionals are up to their ears in interesting projects that aren't attempts by college kids to take on Facebook.

More than a few of those professionals are now busy working for Facebook.

This is a dumb idea for a project.

steveklabnik13• 16 years ago

Yep. And I don't want to help too much, because what happens if I only fix some problems? I can prevent against basic stuff, if their crypto is bad, that's above me. And if I fix some of it, and then somebody gets burned by something I didn't catch, I'd feel partially responsible.

jameskilton• 16 years ago

This isn't "software security expertise" this is a team of people not communicating at all with each other. For example, the Photo controller

edit (show edit form) checks that it's your photo to edit

update (make changes to photo) does not, you can update anyone's photo to anything

destroy (delete the photo) does not, you can delete anyone's photo w/ the id.

This is stuff you just DON'T DO in a web app. It's something any self respecting web developer, especially Rails developer, will look at and shudder. And those are the simple things that immediately stand out. Who knows what kind of security failures are built into this system due to ignorance or just plain lack of care.

statictype3• 16 years ago

This is a dumb idea for a project.

Diaspora? Or doing a security audit of Diaspora's code?

joe_the_user5• 16 years ago

Uh,

Reasons to work on this?

Visibility, visibility, visibility, visibility, visibility, and visibility.

Did I mention visibility?

patio115• 16 years ago

To be flippant but accurate, the landmines are riddled with Diaspora code.

carbocation• 16 years ago

Congrats on being quoted, by the way!

patio115• 16 years ago

Thanks, but it sort of tastes like ash. Locally we have a engineering tradition of Big Red Buttons. If you know a process is out of control, you have to hit the Big Red Button. All work stops, the company starts losing huge amounts of money instantly, etc. The reason we're taught to hit the Big Red Button is that quality issues quickly propagate past the point where you can stop them.

On the Internet, with a highly anticipated release getting mainstream media attention and a dedicated community, quality issues propagate quickly indeed.

But nobody ever wants to hit the Big Red Button. I would greatly have preferred getting a solid eight hours of sleep rather than spending several hours checking if errors were exploitable (yes), sending four emails to try to find someone on the inside, and getting quoted in a piece which is sure to ruin several someones' day. But there are people putting data into Diaspora instances as we speak, so Big Red Button it is.

anthonyb2• 16 years ago

Although HN was described as an "online hacker discussion" (6th paragraph)

seancron• 16 years ago

I find it funny that the related stories for this article are all about security problems that Facebook has had.

barkingcat5• 16 years ago

What I think people should do is fork the open source php version of Facebook that they released about 2 years ago, call it something else, and basically beat them at their own game using their own software.

Facebook operates on a lot of open source software.

The best thing diaspora can do is to take a look at that open source facebook release - and just run it on a server - add some federation functions, and voila, a prototype primitive facebook and twitter killer with a lot of potential

In fact, maybe I should do such a thing..

jlgbecom4• 16 years ago

When did Facebook release an open source version? And where is it, if they did?

barkingcat5• 16 years ago

http://github.com/facebook/platform

Facebook Open Platform is a snapshot of the infrastructure that runs Facebook Platform. It includes the API infrastructure, the FBML parser, the FQL parser, and FBJS, as well as implementations of many common methods and tags. http://developers.facebook.com/fbopen/

Design work will need to be done from scratch. But I think there's some good basic structures in there.

mgunes2• 16 years ago

> The best thing diaspora can do is to take a look at that open source facebook release - and just run it on a server - add some federation functions, and voila

I want to live in your world.

barkingcat5• 16 years ago

Me too. Why is there a lot of doubt about this project? I mean what stops me from forking FB open, add my own designs, my own glue code, and run it?

bisceglie• 16 years ago

how would this method remove the slew of security vulnerabilities and other development issues?

there's nothing wrong with green field dev. especially in this case. fairly sure slapping on some 'federation functions' would result in a hell of a mess.

barkingcat5• 16 years ago

not so sure about that. If you, for example, build a google buzz interface to the facebook backend, you can take advantage of the federated open stack that's being backed big time by google itself, as well as the Mozilla project (ie Salmon protocol, etc)

sjtgraham• 16 years ago

Diaspora will be fine, now it's on Github it has so many skilled eyes on it. All they need to do is deal with the flood of pull requests effectively. A lot of people want this to win. A lot of hackers will commit code to it because it's a project with the world's eyes on. I wouldn't be surprised if Facebook picked up a few people who commit really good code to it either.

steveklabnik13• 16 years ago

In theory, this is great, but it's really hard to do actual work while wading through 6 separate reports of "It says the db can't connect to this host and port, what do? Derp!" The mailing list is even worse.

It's really hard to separate real, actual issues from a few hundred people who don't know how to run a ruby-based website.

thinkalone• 16 years ago

> a few hundred people who don't know how to run a ruby-based website.

Point them towards Hackety Hack :)

Grantmd• 16 years ago

Even the people that seem to know enough to help fix bugs are stuck arguing about whitespace and license choice. That's a waste of time both for them and the diaspora time when there are clearly bigger issues to solve.

jlgbecom4• 16 years ago

If anyone thinks that, they would be best served talking to the Joomla or Drupal (or any other popular, large-scale, user-facing, and general purpose open source project out there) and get their perspective on how that actually works out in reality.

I know we have this sense that open source software development is one big happy stone soup where everybody pitches in, but at some point, people have to make architectural and system design decisions and map out a direction in order to make any sense of those changes.

In other words, "many eyeballs" don't make all bugs shallow, they make them more noticeable. Which in Diaspora's case, is more of a problem than a benefit.

jlgbecom4• 16 years ago

No matter how many programmers this attracts or momentum the project has, if the underlying software design is bad, people need to either do a rewrite with a better design, or make a patchwork mess of it all until it becomes unmanageable, in which case you do the rewrite you should have done in the first place.

The problem is, there's a lot of eyeballs that are looking at the code right now, and that does help to identify bugs, but if the bugs we're seeing are deep seated architectural issues, then it's not very easy for someone to just go in and fix them. Then Diaspora has to determine if the fixes are worth including, and whether they fit into their system design (assuming they have one). Basically, in order to actually utilize the community interest in any practical way, they need to be solid managers. At 20 years old, with no real world software development experience.

This is something open source doesn't seem to understand, and why even the biggest projects end up being a small-ish team of dedicated professionals, instead of the "bazaar" we imagine.

patio115• 16 years ago

I totally agree with this comment. I don't know whether Diaspora is architecturally secure or not. I strongly suspect that it isn't, but am unqualified (and insufficiently interested) to constructively prove that.

The things I found were mostly tactical insecurities, springing from a combination of Rails Security 101 errors and "web application programming is hard." They're pervasive tactical insecurities. Maybe they'll all get fixed if a lot of people pick over every line of that codebase for the remaining one month before release. But that won't help address the part of the iceberg below the waterline. (I can't see it, but the amount of ice above the waterline strongly suggests it is there.)

tptacek9• 16 years ago

I haven't read the code or the design, but I'll say:

* To the extent that Diaspora's security depends on Rails, their problem is tenable; Rails (when properly configured, which this project isn't) does a really nice job of making CRUD secure.

* To the extent that Diaspora's security depends on cryptography, we needn't worry about the security of their current design at all, because they have no current design; what they have instead is a "hello world" of cryptography; someone professional (or in academia) will need to design something for them, and then write a paper on it.

mattmaroon• 16 years ago

"They are going to get burned in a very serious manner very, very quickly if they actually succeed in doing what they're trying to do." And by "burned in a very serious manner" he means someone is going to see their vacation photos and change their username to "Ima Douche."

If someone totally took over my Facebook account I'd be minorly annoyed and that's about it. Unless you're putting your social security number into your Diaspora account, who cares?

tptacek9• 16 years ago

You are, as usual, a voice of uncut pragmatism. But if nobody cared about what was in Diaspora, there wouldn't be much point to Diaspora. I agree that this is mostly a logic puzzle and not a practical issue.

simonw• 16 years ago

I think it's easy to underestimate how valuable something like a Facebook account actually is.

If I meant someone real harm and had access to their Facebook account, I could cause them a lot of trouble. I could send messages to their friends asking for unreasonable favours, starting arguments or causing other offence, I could embarrass them in front of their family. I could stalk them in real life. Look what happened when 4chan got hold of the passwords to a bunch of Christian student Facebook accounts:

http://thenextweb.com/2009/08/22/4chan-launches-attack-chris...

Your online reputation is valuable.

elbrodeur• 16 years ago

It's pre-alpha. I've yet to take a look at the repo, but any software that isn't full of security holes, bugs and flaws at the pre-alpha stage is probably ready for an alpha release. In other words: No duh.

It would actually be surprising to read the headline: "4 students develop bug free, totally secure social networking platform in 3 months"

That being said, I'm excited to see how the project develops -- it's the kind of project that I wish I had the time to contribute to.

kingkilr2• 16 years ago

> any software that isn't full of security holes

Bugs sure. But not security holes. Sure no one plans for security holes, but I can say with decent confidence that the websites I write don't have any obvious security holes.

blackguardx• 16 years ago

Wouldn't some security holes count as bugs?

steveklabnik13• 16 years ago

That isn't stopping tons of people from creating hosting services, and tons of other people from signing up.

joe_the_user5• 16 years ago

And people were breaking skulls when roller blades got hip back in the day.

If the roller manufacturer put a big warning on their packing, whose fault is the accident?

samstokes• 16 years ago

Since the sentiment here and in the article seems to be overwhelmingly negative, I'm curious what people think the Diaspora team could have done better. (Not rhetorically, actually curious.)

I guess "be experienced web developers" (or hiring some) would have helped them to avoid writing insecure code. Retaining a security consultant would seem extreme given that this is an early code-only release.

Is their real mistake simply not doing more to counter the hype? I mean, if you take some code you hacked together over the summer, put it on Github, and non-developers start clamouring to use it, that's a vanishingly improbable best-case scenario for some software developers (at least you think it is until you get the bug reports :)). I guess they should have gone out of their way to say "please don't host this without big scary BETA warnings"?

It seems like the most irresponsible parties here are whoever is hosting these services that uninformed members of the public are signing up to.

patio115• 16 years ago

What is the difference between a pre-alpha release, an alpha release, a beta release, and a public release, from the perspective of a 20 year old college co-ed who is looking at an IM window saying "Hey, Facebook doesn't respect our privacy. Come sign up for Diaspora (linky), it is like Facebook except they won't send your photos to your mom."

statictype3• 16 years ago

You're trying to say that early adopters don't know the difference between an alpha/beta release and a production release? Don't buy that.

heyrhett2• 16 years ago

Sure, the names don't mean anything. Gmail was in beta with millions of users for years.

However, the Diaspora github readme says this in bold: "PLEASE, DO NOT RUN IN PRODUCTION. IT IS FUN TO GET RUNNING, BUT EXPECT THINGS TO BE BROKEN"

So, shame on the register for calling this news.

joe_the_user5• 16 years ago

Indeed, maybe, just maybe, a 1000 freshmen will install it on their machines tonight, it will wipe those thousand laptops tomorrow and destroy a thousand career the day after, in a similar fashion to how a 1000 freshmen destroyed their careers by dropping acid on Tim leary's suggestion in 1969.

Let's think about what Richard Feynman meant when he said "what do you care what other people think?"

It's been released as pre-alpha. That's responsible. If it has a greater magnetic attraction to naive early adopters than other software, whose problem is it? Ours or the Darwin Awards?

wslh• 16 years ago

QMail?

adnam• 16 years ago

Author of article is blatantly a HN reader. Dan Goodin: identify yourself! :-)

ucentric2• 16 years ago

Very disappointing especially with $200k behind them to do this properly and so many hopeful supporters.

As we predicted this is just another propitiatory system with open source code. Sort of like OpenID.Clever PR but not really what it claims to be.

How do you justify using the 'open' when it is based upon a propitiatory naming system? With Diaspora, whoever owns trydiaspora.com (anyone know who does?) owns your content and connections, meaning you are effectively trusting someone who is hiding their identity. Nice.

We try repeatedly to reach out to the Diaspora team when they kicked-off with an alternative that is 100% open and user-centric called NetID (see http://ucentric.org) but were ignored.

I guess that when you have $200,000 and no one to answer to, you can pretty much ignore your stated goals and anyone trying to help you achieve them.It also looks like that is basically what they are delivering for the $200k they raised as their blog suggests it is now an open project for the community to finish off...

As a side issue, is there any truth in the rumor that Zuckerberg gave them $100K?

tptacek9• 16 years ago

"Propitiatory" turns out to be kind of a cool word to know. Thanks!

ucentric2• 16 years ago

See the latest post on ucentric.org and you will see our reasoning for this opinion.

jcapote• 16 years ago

How do they have so many XSS bugs if they are using Rails 3 which does automatic html escaping?

c00p3r2• 16 years ago

What you're expecting from a tabloid?

The code of OpenSSH and OpenBSD are available for years, and that is why it is most secure. Just think how many people tried to find a hole in OpenSSH's code!

Opening the code is the most important step. If the idea is worth and code is useful it will be improved by community, just because it is useful for them. nginx is a classic example - people around the globe are improving it because they find it useful.

tptacek9• 16 years ago

Bullshit.

The code for OpenSSH and OpenBSD is secure because Theo Deraadt personally roped crazy smart people into the project to audit the entire BSD operating system line-by-line, and then set up a regime that treated all code as guilty until proven innocent. He was the first person ever to have done either of those two things.

(I had the privilege of being a semi-involved bystander while this happened; I have one or two findings from the audit and wrote their first several advisories).

Security does not just happen for open source projects. The notion that it does is one of the more harmful myths in software security. If you have any questions about this, or about the difference between a bug (blows up in your face and ruins your day, causing you to write a patch out of anger) and a security flaw (hides in the shadows waiting for an adversary to find and exploit it), just ask Wordpress, Sendmail, or BIND.

Open source makes a lot of software security problems easier, iff you care about security --- like nginx always has, and maybe Apache not so much until recently. But slapping a GPL on your codebase and pushing it to Github does not make magical unicorns poop security findings into your mailbox.

c00p3r2• 16 years ago

Nope. It is good that Theo is so paranoid^Wpassionate, but it isn't a whole reason. The whole reason is that so many people are involved, both on contributing and seeking design or coding flaws. Crowd-sourcing is the key.

I didn't say that opening the code makes it secure by a magic, what I said is that if the code is useful for some skilled people they will fix and improve the code, at least for themselves. Good ones will submit the patches back to the community.

So, fuck off.

tmcw• 16 years ago

The Register is simply silly journalism for the tech set: tailoring shocking headlines and 'begging the question' far more often than they actually do research.

Groxx• 16 years ago

"landmines" implies intent. Strongly. Landmines don't happen by accident, they're placed. The title is rather offensive, probably for linkbait reasons.

Agree with elbrodeur, it's a "duh" situation. Pre-alpha, no warranty, known security holes and bugs. They haven't advertised it as anything it isn't.

Code for open-source Facebook riddled with landmines

Related Stories