GitHub and Rails: You have let us all down.

Re:GitHub and Rails: You have let us all down. by rogerbinns on Sunday March 04, 2012 @09:54PM (#3665200)

What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.)

On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the URL. The values you had to guess in the URL were a ticket number (they start from 1), a repository name, a date (YMD) and a filename. Sure there is some variety in there but it is not in the billions of possibilities, just hundreds and that won't make any computer break into a sweat and in my words at the time "easy". To make matters worse you can't delete the attachments to tickets.

This may not affect you. It certainly affected me. For example we had some keyfiles in one ticket. Coredumps in others.

Two weeks later the issue still hadn't been fixed and I don't know when it was. I've never seen disclosure of the issue. There wasn't even any way of knowing if attachments had been accessed in an unauthorized way since there was no checking in the first place.

[ Parent | on HN ]

Re:GitHub and Rails: You have let us all down. by zalew on Sunday March 04, 2012 @11:35PM (#3665433)

> What makes you think they are saints?

What makes you think I think that?

[ Parent | on HN ]

Re:GitHub and Rails: You have let us all down. by rogerbinns on Sunday March 04, 2012 @11:45PM (#3665459)

You suggested bitbucket as an alternative to the github the thread starter had lost trust in.

[ Parent | on HN ]

Re:GitHub and Rails: You have let us all down. by dangrossman on Sunday March 04, 2012 @07:29PM (#3664749)

I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops.

It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; it's worth it.

[ Parent | on HN ]

Re:GitHub and Rails: You have let us all down. by zalew on Sunday March 04, 2012 @07:37PM (#3664775)

> as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue.

BitBucket is owned by Atlassian for 2 years now and they don't look like they're about to go out of business ($60mil revenue in 2011, 400employees, worldwide offices). When they bought it, it was them who set private repos to unlimited (when @jespern was running it alone, it was set to 5), so I believe they know what they're doing and that it fits their business model. Over 5 collaborators need a paid plan and that's just how they set up the pricing scheme.

As far as I can see as an active user and lurking through their blog and bugtracker, BB is actively developped, so I assume you don't have to worry about them running out of business, looks like it's a valuable asset in Atlassian's software portfolio (at least valuable enough to work on it).

[ Parent | on HN ]

Re:GitHub and Rails: You have let us all down. by batista on Sunday March 04, 2012 @09:01PM (#3665051)

I prefer to pay someone to host the private repos.

Yeah, and people payed GitHub to host their private repos --how did that go?

[ Parent | on HN ]

Re:GitHub and Rails: You have let us all down. by jcoder on Monday March 05, 2012 @02:50AM (#3665836)

It's going _just fine_.

[ Parent | on HN ]

Re:GitHub and Rails: You have let us all down. by batista on Monday March 05, 2012 @01:10PM (#3667532)

Except when they don't handle security well, and you end up with anybody that feels like it capable of reading your private source code... Like, say, NOW.

[ Parent | on HN ]