<story><title>&quot;Egor, stop hacking Github&quot;</title><url>http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.html</url></story><parent_chain></parent_chain><comment><author>JangoSteve</author><text>Given the recent story on HN about how former YouSendIt founder had taken their servers down to prove their vulnerability [1] [2], I&apos;m surprised how little reverence these &quot;lol-hackers&quot; (that&apos;s going to be my term for them) give to showcasing these vulnerabilities by exploiting them in the real-world and messing with people&apos;s real things.&lt;p&gt;I know as hackers, we feel a duty to show people how serious these things are and that we get impatient and annoyed when ignored. And I also know that it&apos;s hard for us to reconcile the idea that when we &lt;i&gt;show&lt;/i&gt; the owners rather than &lt;i&gt;tell&lt;/i&gt;, it&apos;s suddenly considered a crime. But it is.&lt;p&gt;Let&apos;s try an analogy. Door locks on houses are ineffective. Think about it. Your house is covered with windows, which are made of glass. Glass is really easy to break. I mean really easy. If you found out your neighbor didn&apos;t have a house alarm, you might talk to them and tell them they should get one. If they didn&apos;t get one, would you then break into their house one night and walk into their bedroom to show them how dangerous it is?&lt;p&gt;OK, who knows, maybe you have a weird relationship with your neighbor. Furthermore, this is an imperfect analogy, because here, Rails and Github are both responsible for other people&apos;s property.&lt;p&gt;But now imagine it&apos;s a business across town and that you don&apos;t actually know the business owner. If you broke into their business to show them their building&apos;s security vulnerabilities, you bet your ass they would press charges and I don&apos;t think anyone would blame them. Even if you&apos;re doing it with the best intentions, it&apos;s still vandalism at best.&lt;p&gt;All of that being said, this is a very effective way of making your point and getting people to fix the problem. That doesn&apos;t make it right. But if you&apos;re willing to put yourself in harm&apos;s way and essentially become a martyr to get these security vulnerabilities fixed, more power to you.&lt;p&gt;[1] &lt;a href=&quot;http://news.ycombinator.com/item?id=3643102&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=3643102&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http://www.inc.com/magazine/201203/burt-helm/a-silicon-valley-tale-of-humiliation-and-revenge.html&quot; rel=&quot;nofollow&quot;&gt;http://www.inc.com/magazine/201203/burt-helm/a-silicon-valle...&lt;/a&gt;</text></comment>
<story><title>&quot;Egor, stop hacking Github&quot;</title><url>http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.html</url></story><parent_chain></parent_chain><comment><author>wycats</author><text>For what it&apos;s worth, we&apos;d like it if security vulnerabilities in Rails were disclosed to &lt;a href=&quot;http://rubyonrails.org/security&quot; rel=&quot;nofollow&quot;&gt;http://rubyonrails.org/security&lt;/a&gt;.&lt;p&gt;Obviously this situation is a bit more complicated, as a ticket was opened up, and a lot of community discussion occurred. In general, emails to the security list are taken extremely seriously.</text></comment>