News for hackers. Stuff that matters.
Re:I think tumblr has a huge security hole by hasenj on Saturday March 19, 2011 @09:57AM (#2343584)
I wonder if the 'i' has anything to do with vim
Re:I think tumblr has a huge security hole by moe on Saturday March 19, 2011 @10:37AM (#2343675)
Clearly they should ban vim from their development process! ;-)

No, joking aside, the normal way to handle this is to have the perimeter server (nginx or varnish) catch any 5* responses and turn them into a user-friendly error-page. That way you never expose sensitive stack traces to your users.

So, this is standard stuff and easy to fix. However who of us hasn't screwed up on a similarly trivial issue before? I wouldn't judge them too hard on this one, happens to the best of us.

Re:I think tumblr has a huge security hole by weinzierl on Saturday March 19, 2011 @12:49PM (#2344031)
Clearly they should make vim mandatory on every machine;-) I guess the 'i' comes from someone who is used to use vim but in this case using another editor.
Re:I think tumblr has a huge security hole by tjogin on Saturday March 19, 2011 @10:46AM (#2343700)
That wouldn't have caught this though, this code wasn't even executed, just sent as plain text.
Re:I think tumblr has a huge security hole by moe on Saturday March 19, 2011 @11:01AM (#2343741)
Nginx/varnish can also catch Content-type: text/plain (or text/php?) and treat that like a 5xx response. Yes, that's a bit of a hack, but unless tumblr needs to serve text-files (which I doubt) it's a legit safeguard.
Re:I think tumblr has a huge security hole by nikcub on Saturday March 19, 2011 @11:38AM (#2343826)
I know you were kidding, removing all text editors from your production servers might be a good idea
Re:I think tumblr has a huge security hole by bdlang on Saturday March 19, 2011 @11:57AM (#2343882)
This is my guess. Anyone who's used VIM for years knows that the first couple of times using a different editor, your text is littered with "i" and ":w".
Re:I think tumblr has a huge security hole by hasenj on Sunday March 20, 2011 @01:12AM (#2345608)
It could simply come from forgetting to exit from insert mode, and then coming back thinking the editor is in normal mode.
Re:I think tumblr has a huge security hole by vidar on Saturday March 19, 2011 @11:35AM (#2343817)
That was my first thought as well, as a long time vim user I kind of cringed.