Hacker News Reader

Comment by JoeCortopassi | Hacker News Reader

Everyone here that is thinking of giving this company the benefit of the doubt needs to go read their (smeagle) responses to RKearney from the original thread. Here are some samples of the careless attitude behind this:

----

"if anyone's concerned about your AWS key, just destroy your IAM user and create a new one. that's what it was designed for."

----

In response to advice saying they should notify users by email:

"good idea. actually, we'll just wipe them and force new ones."

----

In response to RKearney warning people about just what exactly is exposed:

"in case you have issues with your AWS keys. RKearny's email: ryan@ryankearney.com https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286....

View on HN

I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somewhat understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the problem, and should be personally attacked.

They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to only use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.

> it's somewhat understandable in the context of a site that unintentionally goes public before it's ready

Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions.

Actually, I may argue that's the very first thing you do once the controller skeleton is set up.

Agreed. You don't even need to add any gems or do any rails magic for this to work. In your controller:

    def edit
      @aws_credentials = current_user.aws_credentials
    end

    def update
      current_user.aws_credentials.update_attributes(
        params[:aws_credentials].slice(:a, :b, :c)
      )
    end

Don't forget `destroy`.

I'm a big fan of responsible disclosure, and I think that the HN crowd has far too much of a one-track mind about "always disclose security problems everywhere!", especially with something that may not have been ready for release.

But that "contact Ryan if anything goes wrong" is grade A asshole.

This is a severe lack of customer service. The least that can be done is a quick shutdown of the site until there's a good fix, an email to all customers (since legally they have to disclose the breach: http://en.wikipedia.org/wiki/Security_breach_notification_la...), and a thanks out to whomever reported the issue.

If you make a mistake, own up to it. Honesty is the best key to building a business, and I'm sure they've at least lost the HN trust for any product in the future.

Reply on news.ycombinator.com