Yahoo Axis Chrome Extension Leaks Private Certificate File
nikcub.appspot.com
nikcub.appspot.com
For a long time I've said that Yahoo? needs to forget the fact that they started as a search company. They're still a serious player in online display advertising and they own a lot of properties that are disproportionately valuable in terms of CPM. They should stop trying to come up with new doohickies and focus on what they do best - selling targeted advertising to major advertisers.
It's a shame that they didn't hit the goldmine like google or fb did, but there's no point in letting the past get in the way of the opportunities of the moment. Yahoo could still be one hell of an ad network.
Sadly, I think this has a lot to do with management and very little to do with engineers. I personally feel they are just sitting comfortable trying to squeeze every dollar out of the company.
The way this came about was a bit different, because it started with a tweet[1] where I pointed out that the file was there, and then it gradually developed into realizing that it is a pretty big deal. The discovery happen out in the open. If you look at my timeline and the replies and conversations you will see how it came about.
With hindsight I could have handled it differently, but it just happen to come out in this way. I added an update to the end of the post addressing disclosure. The goal at the moment is to make users aware that there is potentially a big issue here.
This is not an obscure bug. This is obvious -- very obvious. Many people will have discovered this already. Furthermore this is a pre-release product.
There is nothing to be gained by not talking about it.
its not responsible disclosure but then again, everyone could see the key after an hour. it's not like if it was a complex exploit. Its more like if you printed the password to your stuff on a document and told the world to grab a copy. ;-)
Please stop parroting "responsible disclosure" like a white knight, and engage your brain.
In the case of a private key exposure, the only possible fix is to tell everyone to stop trusting that key. That's exactly what happened here.
As I understand it, responsible disclosure is primarily there to protect the userbase of a piece of software, not the reputation of the producer of that software.
And surely they can't be being stupid enough to be using this same signing key on established products, can they?
On reflection, scrub that last thought.
If this is the only thing signed with this key, then the attack surface is only people running this thing.
I'm asking because, one day, someone here will leak the wrong key. I already have enough problems with legal on opensourcing our software (we built a very cool CMS that runs on Node.js and MongoDB we'd love to share) and I may need to come up with some creative answer fast.
Hopefully we'll get a full write-up so anyone else this happens to in the future will know what to do.
CMS using Mongo & Node? Sounds like a fad-fest about to be turned a disaster...
Of course, exploring new ideas always creates some rework due to bad decisions (and we had a couple of them along with the good ones).
Well, both projects are rather new and changing. So not a very stable base to base a business on.
Node.js is best suited for long-running, evented type web apps (games, chat, interaction etc), so a CMS would not be a good fit.
Mongo is also known to lose data, and needs several (3 at least) servers to be somewhat stable with this.
A CMS is also not particularly read or write heavy, so a standard DB would fit even better.
I assume the data already have some specific form, so the free-form (schema-less) of Mongo doesn't buy much (and you have to replicate some relational-es on top of Mongo anyway, if you want to avoid inefficient queries returning tons of unneeded data with the response that happen to be on the same level in the "tree").
In a CMS you also have a power-law distribution of read articles, or even worse, with the top page stuff getting the most hits, and older pages being statistical noise. So some caching should provide very good speed with very little memory needs.
(Funny aside/rant: once I've implemented a custom CMS for a large bank in my country, with plain ole Java and DB2. The bank people had fallen for some IBM crap, and wanted the backend to be Domino, which, at the time (2003) was, well, let's say, inadequate. Our team implemented a CMS on top of Domino, and, as it naturally was slow as molasses, I convinced them to let us rewrite it in a sane way, which I did by myself in 1/5 the time it took to build the BS Domino version (about 2-3 months). It even had fancy things like being able to have them just upload an Excel file and automatically populating currency rates and stuff from it, with proper Decimal support, fail-rollback, etc). Hah, I also used Lucene for FTS, which was at version < 1.2 at the time IIRC.
The CMS is also evolving fast. We are a web portal with a strong news side.
> Node.js is best suited for long-running, evented type web apps
This evented nature is handy when more than one person is editing a top page. It started, in fact, as an add-on to our previous CMS (the absolutely awful FatWire) that made it possible to quickly modify those.
> Mongo is also known to lose data
Most of the time, the CMS keeps a copy of the data in memory and spits it to the datastore. Making it DB-agnostic is on the roadmap.
> I assume the data already have some specific form
Not at all. One of the worst sins of any CMS is to constrain the structure of a given document.
> if you want to avoid inefficient queries returning tons of unneeded data
The CMS is not responsible for most of the content-delivery. Most page elements that rely on queries against the article base do so in efficient ways (the content has some structure - but only what's needed). We consider a problem when a page view triggers a DB lookup. We also keep an eye on returned vs. used rates.
(only kidding, for one thing Yahoo's black helicopters don't make any sound)
(Edit: Hey now, downvoters; I'm an ex-Yahoo! layoff target. What else do I need to do before I can crack jokes like this? :D )
But there's a sadness about the Yahoo situation that invites joking as a coping mechanism. If we don't laugh, we'll have to cry. Or rant.
And speaking of rants: plenty of upvoted, 'serious' comments about this incident are just variants of "HUH-hah, look at Yahoo's latest screwup!" Those can be even worse for reasoned discourse than a few silly quips in one tangent. But HN smiles upon the hyper-critical and mock-aghast sort of rhetorical competition.
When you click the period it actually launches a black helicopter.
It isn't actually meant to do this, but the guy who wrote the code left a while back and nobody knows how to fix it, or even where the helicopters are being sent. However there are unconfirmed reports of an interesting pile of scrap metal growing at the bottom of Jerry Yang's garden.
From my experience having worked at Yahoo! I'm a bit shocked as the process has always seemed pretty good.
You don't need to install chrome extensions to look at their source, you can use this extension to view it before installing:
https://chrome.google.com/webstore/detail/bbamfloeabgknfklmg...
(ok, you have to install that extension before you can look at it's source :)
There is always a root of trust in a cert scheme (vs. a web scheme, say, which has no single point of failure but a squishier notion of validity). The reason it got caught is that Chrome implemented an independent "pinning" feature for Google's own domains (basically an independent root of trust) and caught the fraudulent certs.
Want to see the cool Moog doodle? Download the latest HTML5™ toolbar today! Want to use premium Yahoo features? Download the Axis toolbar!
It's a entertaining experience.
If people were interested enough I could write a quick walkthrough of what is needed though since some of it wasn't intuitive :)
edit: probably a lot easier to just get it on github https://github.com/alandipert/ncsa-mosaic -- possibly not nearly as fun. Make linux probably won't work on Mac OS X (almost), I recall having to force the compiler to create a 32 bit executable and some other things.
http://code.google.com/chrome/extensions/packaging.html#H2-0
Still too disgusted at the way the company has been run recently to even consider using their products.