undefined | Better HN

0 pointshemancuso14y ago0 comments

The users who trust Github don't care if it was a "rails issue" or a "github issue"

It's a Github issue no matter what the cause or responsible party.

If Github was run on unpatched windows XP boxes with all IPs public, you wouldn't argue that it was Microsoft's fault because "everyone knows" what a bad idea that would be. The base assumption should not to be completely reliant on your environment and frameworks to be secure, because they very likely have un-patched bugs and exploits. You do what you can to harden yourself up, but when something goes wrong - it's your problem.

0 comments

beagle314y ago

But (to continue your analogy), github was run on fully patched XP boxes, in which case: yes, it would have been Microsoft's fault.

And it would have ultimately been Github's fault (in the eyes of their users) in that case too -- because they are providing the service, and their choices (XP / Rails, Firewall / Application Firewall / Audit) is their fault.

Contrary to how a lot of things are handled today, fault can be shared by multiple parties. what Egor did was get exposure and reaction from a lot of involved parties, where he was unable to get any reaction from some of them (Rails team) in the past.

j / k navigate · click thread line to collapse

0 pointshemancuso14y ago0 comments

The users who trust Github don't care if it was a "rails issue" or a "github issue"

It's a Github issue no matter what the cause or responsible party.

0 comments

beagle314y ago

But (to continue your analogy), github was run on fully patched XP boxes, in which case: yes, it would have been Microsoft's fault.

j / k navigate · click thread line to collapse