Commit that changed my life

This guy keeps popping-up. Very impressive for a years worth of work. We should be lucky to have someone willing to do this so openly, even after the rebuff from the community. He could have easily gone black hat and we'd all be the worse for it.

brokentone• 13 years ago

I was never against Egor, I don't know that he had a lot to apologize for -- but others do. Either way it's very mature of him to offer apologies. Shows personal growth while learning and demonstrating very succinct security POCs. This kid is one to keep your eyes on.

Egor, if you make it to NYC, let me buy you a drink.

homakov10• 13 years ago

thanks! i'm already choosing a flight for June :)

carterschonwald• 13 years ago

Awesome. Feel free to hit me up at well when you're in NYC! Stumbling into doing what you really love is .... magical. Consulting is a lot of work, make sure you have your work pipelined far ahead of time yet avoid overloading yourself!

Sounds like you've had a benignly interesting year and learned a lot. What more could someone want?

dguido• 13 years ago

Come for SummerCon http://www.summercon.org

pragone• 13 years ago

Likewise Egor - I'd be very excited to meet. I was extremely impressed with the issues you had raised last year, and would love to buy you a beer

borski• 13 years ago

Likewise, if you make it to the Bay Area, beers are on me. I'll even make you some homemade borscht - one web security Russian to another. :)

homakov10• 13 years ago

definitely! missing borsch :)

niggler• 13 years ago

I'm waiting for Egor to spend some time with nodejs ... would like to see what he finds

NuZZ• 13 years ago

Heh, been thinking myself of open sourcing an ecommerce site I'm building from scratch in node. Not sure if it would be good or bad.

The benifits of course being; a learning resource for newbs, a good transparent portfolio piece, easy collaboration with strangers on what is best etc. Downsides being; exposing potential security holes, embarrassment due to facepalm worthy pieces of logic in code (really, a plus) etc.

yuchi• 13 years ago

do you have any economic reasons to keep it closed? If the answer is no, then push it open source. Full stop. It's a gain for everyone.

no_more_death• 13 years ago

NodeJS is written from a MUCH different approach than Rails. An example quotation from Isaac Schlueter (and he says this OVER AND OVER):

  We like dull models.  They're easier to reason about.  Programs should 
  be boring dull things that solve problems in predictable ways. [1]

[1] The whole discussion is most instructive. https://groups.google.com/forum/?fromgroups=#!msg/nodejs/kxw...

Of course, you may easily download a framework that makes foolish choices as a number of Rails developers have migrated to javascript :-p. Actually, I don't have a "thing" about Ruby or Rails developers, but some aspects of their mindset are very dangerous. The first time I heard that YAML could initialize objects from the serialization structure, I was absolutely shocked. How could that NOT be a disaster?

Take care. You're responsible for your code and its security. You're not playing a game. Your business is not a hackathon. Don't claim to offer "services" unless you are plan to be a servant of others. Servants don't code recklessly. You are the custodian of your clients' digital life and wellbeing. Choose projects run by grownups -- like izs and ry (the people who have run nodejs). Again, getting hacked is NOT okay.

By the way, if you want to learn how to run a project, subscribe to the nodejs-dev thread. That's a first-rate education in how to manage a large project with a lot of hype and growing pains. Watch and take notes.

rubyrescue• 13 years ago

Ironically, people said he should have handled the commit differently, and perhaps he should have.

But here we are talking about him 1 year later. I think he probably shouldn't have done it, but on which side of the pg/YC line of creative subversion did his stunt actually fall?

mpyne• 13 years ago

Well let's be fair, we're talking about him because he didn't rest on his laurels, he's been out there doing more and more.

Personally I thought it was hilarious, you can hardly be more gentle in the process of 0wning a system like that and as I recall he did try to warn them beforehand.

redact207• 13 years ago

How interesting he ended up in Mui Ne in Vietnam - it's one of the places I've been considering for a quit-your-job-and-focus-on-launching spot.

Mui Ne is a very small coastal town around 200KM East of Ho Chi Minh city. Although tiny, constant off-shore winds has increasingly made it the kite-surfing capital of SE Asia. Living expenses are cheap, and I've calculated a pretty comfortable lifestyle for USD1,200 pm (YMMV).

His post is somewhat testament to a usable internet connection.

homakov10• 13 years ago

mui ne is not so cheap because of tons of russian tourists coming. I used to spend $2k/month here. but my apart is in the middle of it and it was winter (high season). Internet is pretty decent too!

AYBABTME• 13 years ago

Consider Nha Trang too.

muloka• 13 years ago

I've heard that Vietnam is starting to really "westernize" and is pretty good place to invest in right now.

mikek• 13 years ago

What's the backstory on this?

InclinedPlane3• 13 years ago

He discovered a major vulnerability in github and pointed it out by making a commit to the rails master repository (which has rather obvious serious repercussions from a security standpoint).

asveikau• 13 years ago

My recollection (though I don't know much about rails and this is just going from memory) is that he attempted to make an argument to the rails team for more secure defaults in parameter parsing and for the framework to steer apps towards more secure use. When they brushed him off and said it was ultimately the caller's responsibility to use it right, he exploited github to make his point.

InclinedPlane3• 13 years ago

In my impetuous 20s I did something similar. I was rather ... well, rude, really in pointing out a major security flaw on the forums of one of the more famous tech sites. Things devolved from there and I ended up being banned, though they did fix the problem rapidly even so. Since then I've learned the value of tact.

homakov10• 13 years ago

I agree about responsible disclosure but that problem had many facets, and I was rather trying to point out rails problem, sadly, using github hole.

InclinedPlane3• 13 years ago

It's a fine line sometimes. I think your commit is mostly defensible. It's really an open question. What do you do when you point out a serious security issue and it doesn't get the attention it deserves? I think your commit definitely proved that the issue was being downplayed far too much. Is there some better middle ground? If proving a vulnerability results in it getting fixed overnight and merely describing it results in it getting fixed never then what's the right course of action?

jmathai• 13 years ago

I imagine the Internet will be kind and you'll go on to do great things.

We've all done things we regret and deserve apologies. It's not the mistake that defines you but how you respond afterwards.

MojoJolo• 13 years ago

I read almost all the notes in the Github page and it lasted for months. There are different sides shown.

BTW, I think travelling cost and need so much money. I wonder what are Egor's source of income. Don't know him that much so I just assumed consulting (Sakurity) is just his source of income. Also, if Egor is in South East Asia at the moment, he should visit the Philippines!

shadowsun7• 13 years ago

Egor, if you're ever in Singapore, please hit me up. I'll organize a meetup via NUS Hackers at the National University of Singapore. Would be interesting to let other university-level students hear about your experience.

(My email address's on my personal site (which, in turn, may be found on my profile)).

Lucadg• 13 years ago

you've got a Singha beer in Bangkok too :) I worked a lot of time with a great Russian developer until year. Took him to Mexico to work together (no visa requirements) for 3 months. He came from Siberia and I showed him the ocean for the first time then we travelled by car around the country. So far the russians are the best for me, seriously. Would love to meet you.

homakov10• 13 years ago

i know Siberia guys. if you show him the ocean - he is happy for the rest of his life!

see you in BKK

adrianmsmith• 13 years ago

"I left St Petersburg, Russia. I see no future for myself in my country", Could you elaborate?

homakov10• 13 years ago

ugly weather + no prospectives for IT + unsafe streets

I had a decent Rails job there but I have... "ambitions". Just wanna take over the world

tantalor• 13 years ago

Somebody just hire him, amiright?

lhnz• 13 years ago

Why be hired when you can consult?

throwawayG92• 13 years ago

How does that work? I never understood what a consultant does exactly. Offers advice?

nicholassmith• 13 years ago

The argument with security research is how do you responsibly deal with the knowledge when people aren't listening? Well, in this case starting a fire to prove there's smoke wasn't the best decision. It takes a lot to admit you were wrong publicly and offer a mea culpa, and a lot to not get disheartened and stop researching. Kudos Egor, I'm sure I'm not the only person watching your work with interest.

jnazario• 13 years ago

glad to see you growing, egor.

bonzoesc• 13 years ago

Egor, thanks for your writing about the OAuth 2 standard! I've implemented that a few times in the last year and would be in serious trouble (not immediately, but when somebody notices) without your writings.

Aardwolf• 13 years ago

The post links to this: https://github.com/rails/rails/commit/b83965785db1eec019edf1...

And I have a rant about that: I wanted to see the date when that commit was done. But all it says as "date" is: "a year ago".

Why? Why can it not say the actual date? "A year ago", what does that mean? I want to know which month and day, even the time!

vito• 13 years ago

If you hover over them the full time shows up as a tooltip at least.

uxp• 13 years ago

Adding different resource identifiers to the url can also retrieve different commit formats:

Email Patch: https://github.com/rails/rails/commit/b83965785db1eec019edf1...

Unified Diff: https://github.com/rails/rails/commit/b83965785db1eec019edf1...

danso• 13 years ago

I kept a list of the best things I read in 2012. This github commit was near the top of it...everything about it, from its technical insight to how spectacularly (in an attention-grabbig sense) it was executed, to how it spoke about the constant conflict between "read the documentation" and "save the developers from themselves"...fantastic.

I loved the commit from the future :) https://github.com/rails/rails/issues/5239

Commit that changed my life

Related Stories