Never Give Your Information To 10 Minute Old Startups

Re:Never Give Your Information To 10 Minute Old Startups by enoch_r on Saturday October 06, 2012 @01:51AM (#4619910)

I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somewhat understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the problem, and should be personally attacked.

They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to only use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.

[ Parent | on HN ]

Re:Never Give Your Information To 10 Minute Old Startups by oelmekki on Saturday October 06, 2012 @06:15AM (#4620218)

> it's somewhat understandable in the context of a site that unintentionally goes public before it's ready

Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions.

Actually, I may argue that's the very first thing you do once the controller skeleton is set up.

[ Parent | on HN ]

Re:Never Give Your Information To 10 Minute Old Startups by alinajaf on Saturday October 06, 2012 @07:24AM (#4620275)

Agreed. You don't even need to add any gems or do any rails magic for this to work. In your controller:

    def edit
      @aws_credentials = current_user.aws_credentials
    end

    def update
      current_user.aws_credentials.update_attributes(
        params[:aws_credentials].slice(:a, :b, :c)
      )
    end

[ Parent | on HN ]

Re:Never Give Your Information To 10 Minute Old Startups by bhousel on Saturday October 06, 2012 @07:55AM (#4620308)

Don't forget `destroy`.

[ Parent | on HN ]