Security hole found in Rails 2.3's http_authentication.rb

Re:Security hole found in Rails 2.3's http_authentication.rb by tptacek on Wednesday June 03, 2009 @04:44PM (#640367)

This is an absolutely classic indie/startup security fuckup. (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) respond promptly with a "security flaw ID".

You literally don't have to do anything more than this --- mechanically --- to get good-faith people not to publish flaws publicly.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by jf on Wednesday June 03, 2009 @05:38PM (#640482)

Where should the security contact information be?

If you found a flaw on site example.com, where would you look first for a security contact?

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by tptacek on Wednesday June 03, 2009 @07:40PM (#640681)

/security, security@, the "security" tab on the front page.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by petercooper on Thursday June 04, 2009 @05:18AM (#641150)

Depends on the protocol the security flaw is with, but RFC 2142 would indicate that if it's a Web issue, then [email protected] - sadly people don't pay attention to many standards like this anymore, though, because they'd rather the Internet be broken.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by tptacek on Thursday June 04, 2009 @05:40PM (#642304)

A weird comment, since this isn't a web issue, it's an issue with a software library.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by pmjordan on Wednesday June 03, 2009 @07:16PM (#640661)

Probably "feedback", "contact us", and "support", roughly in that order.

[ Parent | on HN ]