Ruby "mass assignment" vulnerabilities?

Matt Wagner matt.wagner at redhat.com
Mon Mar 5 14:31:10 UTC 2012


On Mon, Mar 05, 2012 at 08:14:08PM +1100, Justin Clift wrote:
> On 05/03/2012, at 4:52 PM, Kurt Seifried wrote:
<snip> 
> From a non-technical perspective, it seems *extremely* crap of GitHub
> to suspend the guy who exploited them.  He specifically did it to
> *show them* the vulnerability.

Not to delve into a debate about disclosure policies, but they
reinstated his account after determining that his intent was not
malicious: https://github.com/blog/1069-responsible-disclosure-policy

-- Matt



More information about the aeolus-devel mailing list