News for hackers. Stuff that matters.

A comment on I think tumblr has a huge security hole. Parent comment

Re:I think tumblr has a huge security hole by russss on Saturday March 19, 2011 @09:13AM (#2343509)
At Last.fm we had a Subversion pre-commit hook which ensured that all .php files began with <?.

That would have easily caught this problem, no drama.

[ Parent | on HN ]
Re:I think tumblr has a huge security hole by SoftwareMaven on Saturday March 19, 2011 @05:54PM (#2344848)
Unless the file was checked in separately. If they were doing something like updating the db password, so they need to update "current running" and "up-and-coming" code. As a result, they may have made the change in production, with the typo, and the change in SVN, without the typo.

I would put my money on something like this being the cause.

[ Parent | on HN ]