News for hackers. Stuff that matters.
Re:I think tumblr has a huge security hole by tjogin on Saturday March 19, 2011 @08:49AM (#2343460)
A huge mistake, but Tumblr's staff are probably quite experienced, nonetheless.

How about that gotcha though? A single character is mistakenly changed from "<" to "i" and that exposes the source code to the browser. Think about that.

Re:I think tumblr has a huge security hole by hasenj on Saturday March 19, 2011 @09:57AM (#2343584)
I wonder if the 'i' has anything to do with vim
Re:I think tumblr has a huge security hole by moe on Saturday March 19, 2011 @10:37AM (#2343675)
Clearly they should ban vim from their development process! ;-)

No, joking aside, the normal way to handle this is to have the perimeter server (nginx or varnish) catch any 5* responses and turn them into a user-friendly error-page. That way you never expose sensitive stack traces to your users.

So, this is standard stuff and easy to fix. However who of us hasn't screwed up on a similarly trivial issue before? I wouldn't judge them too hard on this one, happens to the best of us.

Re:I think tumblr has a huge security hole by weinzierl on Saturday March 19, 2011 @12:49PM (#2344031)
Clearly they should make vim mandatory on every machine;-) I guess the 'i' comes from someone who is used to use vim but in this case using another editor.
Re:I think tumblr has a huge security hole by tjogin on Saturday March 19, 2011 @10:46AM (#2343700)
That wouldn't have caught this though, this code wasn't even executed, just sent as plain text.
Re:I think tumblr has a huge security hole by moe on Saturday March 19, 2011 @11:01AM (#2343741)
Nginx/varnish can also catch Content-type: text/plain (or text/php?) and treat that like a 5xx response. Yes, that's a bit of a hack, but unless tumblr needs to serve text-files (which I doubt) it's a legit safeguard.
Re:I think tumblr has a huge security hole by nikcub on Saturday March 19, 2011 @11:38AM (#2343826)
I know you were kidding, removing all text editors from your production servers might be a good idea
Re:I think tumblr has a huge security hole by bdlang on Saturday March 19, 2011 @11:57AM (#2343882)
This is my guess. Anyone who's used VIM for years knows that the first couple of times using a different editor, your text is littered with "i" and ":w".
Re:I think tumblr has a huge security hole by hasenj on Sunday March 20, 2011 @01:12AM (#2345608)
It could simply come from forgetting to exit from insert mode, and then coming back thinking the editor is in normal mode.
Re:I think tumblr has a huge security hole by vidar on Saturday March 19, 2011 @11:35AM (#2343817)
That was my first thought as well, as a long time vim user I kind of cringed.
Re:I think tumblr has a huge security hole by powdahound on Saturday March 19, 2011 @10:58AM (#2343732)
Well, a single character change + a developer not testing their code locally + not running high level unit tests + deploying untested code to production.
Re:I think tumblr has a huge security hole by datasink on Saturday March 19, 2011 @12:12PM (#2343914)
Tumblr has at least one full time sysadmin. I think it's more reasonable to suppose he made the change to a production config file, rather than a developer. A definite failing in their deployment process, but it really says nothing about the quality of the application code or developer testing.