I wonder if the 'i' has anything to do with vim
Clearly they should ban vim from their development process! ;-)
No, joking aside, the normal way to handle this is to have the perimeter server (nginx or varnish) catch any 5* responses and turn them into a user-friendly error-page. That way you never expose sensitive stack traces to your users.
So, this is standard stuff and easy to fix. However who of us hasn't screwed up on a similarly trivial issue before? I wouldn't judge them too hard on this one, happens to the best of us.
Re:I think tumblr has a huge security hole
by weinzierl on Saturday March 19, 2011 @12:49PM
(#2344031)
Clearly they should make vim mandatory on every machine;-)
I guess the 'i' comes from someone who is used to use vim but in this case using another editor.
That wouldn't have caught this though, this code wasn't even executed, just sent as plain text.
Nginx/varnish can also catch Content-type: text/plain (or text/php?) and treat that like a 5xx response. Yes, that's a bit of a hack, but unless tumblr needs to serve text-files (which I doubt) it's a legit safeguard.
I know you were kidding, removing all text editors from your production servers might be a good idea
This is my guess. Anyone who's used VIM for years knows that the first couple of times using a different editor, your text is littered with "i" and ":w".
It could simply come from forgetting to exit from insert mode, and then coming back thinking the editor is in normal mode.
That was my first thought as well, as a long time vim user I kind of cringed.
Re:I think tumblr has a huge security hole
by powdahound on Saturday March 19, 2011 @10:58AM
(#2343732)
Well, a single character change + a developer not testing their code locally + not running high level unit tests + deploying untested code to production.
Re:I think tumblr has a huge security hole
by datasink on Saturday March 19, 2011 @12:12PM
(#2343914)
Tumblr has at least one full time sysadmin. I think it's more reasonable to suppose he made the change to a production config file, rather than a developer. A definite failing in their deployment process, but it really says nothing about the quality of the application code or developer testing.
How about that gotcha though? A single character is mistakenly changed from "<" to "i" and that exposes the source code to the browser. Think about that.