Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

The RoR security issues have been depressing for me. My daughter had a credit card stolen from a web site, built on rails by a third party for the owner, the owner didn't know what powered the web site, they had a really "easy to use" tool for putting things up there. A code audit showed the site had been completely re-done to appear the same and provide a card harvesting service forwarding card information to the Ukraine.

How many more of these are there out there? tens? hundreds? thousands?

View on HN

I'm sorry to hear the problems you and your family had with it.

But on the discussion we had before[1], this one does not seem to affect Rails[2]:

tiegz 14 hours ago | link | parent

Rails has been built around Rack for a couple years, but I think its sessions are safe from this Rack vulnerability. Rails' CookieStore class inherits from Rack::Session::Cookie, but it overwrites the unpacked_cookie_data() method which was open to a timing attack. Rails uses its own MessageVerifier class (https://github.com/rails/rails/blob/master/activesupport/lib...) to do a constant time comparison, which would avoid this attack.

Any other frameworks/libs that use Rack's session cookies should upgrade though, afaik.

[1] http://news.ycombinator.com/item?id=5186245

[2] http://news.ycombinator.com/item?id=5186466

Also, as I understand it, many american websites seems to store credit card details, why is that?

In Denmark we often use a payment gateway, exactly to avoid these types of attack. If my webshops database got leaked, my customers would not have to fear creditcard leakage.

I suppose it is possible that programmers in Denmark are more skilled in crafting secure payment processes than Americans, but isn't it more likely that you're opinion is biased by a reporting bias? You are simply observing more reports of problems at US websites because they are so many more US websites than Denmarkian.

I don't believe that programmers in Denmark is more skilled, or more focused on security.

I have just often wondered why a lot of the webshops in the US that I use stores all my information, I have never seen it here.

And no, I don't believe that I use more US-based webshops than Danish.

Many American websites use payment gateways as well. That doesn't mean they all do.

We have laws that you must comply with if you store data: http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...

Not a law, its an industry standard. Its enforced by the card companies (Visa, etc) but generally only if you are processing enough transactions.

Ahh, I was mistaken. I thought that you could be hit with fines if you don't comply with PCI.

(This is why I always use a payment gateway and never keep details myself.)

Yeah, you can be fined, audited, have your merchant account revoked - all sorts of badness.

It's hard to say how that site was compromised though, isn't it? It could just as easily been a weak user password, or an Ubuntu vulnerability or any number of other vectors and then it wouldn't have mattered what the application was written in.

Members of our team have been receiving recruiter calls for the past few days - it seems a few places running Rails apps are on the lookout for developers to help secure and update their apps. At least one has apparently experienced the awesomeness of the Ruby way, and had their servers compromised.

Make the decision to move onto Python seem more correct every day.

The Python world has had very, very similar problems. Two popular Django add-ons (piston and tastypie) had remote code execution vulnerabilities due to the exact same cause as the recent Rails RCE vulns: insecure deserialization of YAML.

See https://www.djangoproject.com/weblog/2011/nov/

This isn't an exactly equivalent situation, since this wasn't a problem with the core Django framework --- but that's in part because the core Django framework does less. Functionality similar to these extensions is bundled with Rails.

It is impossible to write insecure web applications in Python. /s

We don't seem to see the Python community embrace magic and shiny quite so much as in Ruby. That alone seems to help.

That is subjective. What is "magic and shiny" and who is doing this embracing? "Magic and shiny" is embraced more in Sinatra than in Django? "Magic and shiny" is, by your definition, a security vulnerability?

Reply on news.ycombinator.com