Re:I think tumblr has a huge security hole
by hasenj on Saturday March 19, 2011 @09:57AM
(#2343584)
I wonder if the 'i' has anything to do with vim
[ Parent
| on HN ]
Clearly they should ban vim from their development process! ;-)
No, joking aside, the normal way to handle this is to have the perimeter server (nginx or varnish) catch any 5* responses and turn them into a user-friendly error-page. That way you never expose sensitive stack traces to your users.
So, this is standard stuff and easy to fix. However who of us hasn't screwed up on a similarly trivial issue before? I wouldn't judge them too hard on this one, happens to the best of us.
Re:I think tumblr has a huge security hole
by weinzierl on Saturday March 19, 2011 @12:49PM
(#2344031)
Clearly they should make vim mandatory on every machine;-)
I guess the 'i' comes from someone who is used to use vim but in this case using another editor.
That wouldn't have caught this though, this code wasn't even executed, just sent as plain text.
Nginx/varnish can also catch Content-type: text/plain (or text/php?) and treat that like a 5xx response. Yes, that's a bit of a hack, but unless tumblr needs to serve text-files (which I doubt) it's a legit safeguard.
I know you were kidding, removing all text editors from your production servers might be a good idea
This is my guess. Anyone who's used VIM for years knows that the first couple of times using a different editor, your text is littered with "i" and ":w".
It could simply come from forgetting to exit from insert mode, and then coming back thinking the editor is in normal mode.