Use Rails? Check yourself for the YAML exploit

Re:Use Rails? Check yourself for the YAML exploit by copremesis on Friday February 01, 2013 @06:08PM (#5154161)

I think this page is hoax ... just an attempt to gather a list of rails urls. looking at my logs I see no such request.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by borski on Friday February 01, 2013 @06:14PM (#5154183)

It's not a hoax - could you get in touch with us at [email protected] or http://www.tinfoilsecurity.com/chat ? I'd love to see what went wrong.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by Harkins on Friday February 01, 2013 @06:09PM (#5154168)

I think it can't deal with the traffic it's getting. I saw a couple of hits to my server and the page's progress bar moved a little, but it's been stalled for quite a while now.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by borski on Friday February 01, 2013 @06:15PM (#5154188)

Are you referring to the scan from our homepage or the Rails checker? Either way, could you get in touch with us at [email protected] or http://www.tinfoilsecurity.com/chat ? I'd love to see what went wrong.

We shouldn't be having issues with load.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by jandy on Saturday February 02, 2013 @01:15AM (#5155359)

I just did it and got this in my logs:

184.73.36.14/ec2-184-73-36-14.compute-1.amazonaws.com - - [02/Feb/2013:06:12:19 +0000] "GET / HTTP/1.1" 200 11310 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-us) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.3 Safari/5 Powered by Spider-Pig by tinfoilsecurity.com"

They're definitely hitting the URLs, I just think they have a backlog.

[ Parent | on HN ]