<story><title>We found and fixed a rare race condition in our session handling</title><url>https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare-race-condition-in-our-session-handling/</url></story><parent_chain><item><author>bvanderveen</author><text>Well that&amp;#x27;s embarrassing. Passing a mutable dictionary—containing callbacks that could be closed over heaven-even-knows-what, no less!—between threads? And it&amp;#x27;s re-used between requests?&lt;p&gt;They are lucky this wasn&amp;#x27;t much, much worse.&lt;p&gt;Why does the error reporting service need to call the web thread back anyway?&lt;p&gt;Yet another case where immutable-everything would have prevented this hairball from accreting in the first place.</text></item></parent_chain><comment><author>arkadiyt</author><text>&amp;gt; Well that&amp;#x27;s embarrassing.&lt;p&gt;An IDOR is embarrassing - this was a complex bug and Github&amp;#x27;s investigation&amp;#x2F;response was great here. I&amp;#x27;d be proud if my company handled a security incident like this.</text></comment>
<story><title>We found and fixed a rare race condition in our session handling</title><url>https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare-race-condition-in-our-session-handling/</url></story><parent_chain><item><author>bvanderveen</author><text>Well that&amp;#x27;s embarrassing. Passing a mutable dictionary—containing callbacks that could be closed over heaven-even-knows-what, no less!—between threads? And it&amp;#x27;s re-used between requests?&lt;p&gt;They are lucky this wasn&amp;#x27;t much, much worse.&lt;p&gt;Why does the error reporting service need to call the web thread back anyway?&lt;p&gt;Yet another case where immutable-everything would have prevented this hairball from accreting in the first place.</text></item></parent_chain><comment><author>matthewaveryusa</author><text>Never underestimate the inertia of working code that makes money.</text></comment>