Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somewhat understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the problem, and should be personally attacked.

They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to only use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.



> it's somewhat understandable in the context of a site that unintentionally goes public before it's ready

Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions.

Actually, I may argue that's the very first thing you do once the controller skeleton is set up.


Agreed. You don't even need to add any gems or do any rails magic for this to work. In your controller:

    def edit
      @aws_credentials = current_user.aws_credentials
    end

    def update
      current_user.aws_credentials.update_attributes(
        params[:aws_credentials].slice(:a, :b, :c)
      )
    end


Don't forget `destroy`.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: