http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/
The first two are even more interesting when read in the light of Hobo's internal permissions system, and the way it interacts with the view layer. In particular, the second bug (mass updating the encryption key) is likely to be stopped as a side-effect of not wanting that field to appear in autogenerated views; you'd typically write: def update_permitted (current_user.administrator? || ... ) && none_changed?(:serialized_key, ...) end just to get the field to vanish, and get security as a bonus. :) --Matt Jones -- You received this message because you are subscribed to the Google Groups "Hobo Users" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/hobousers?hl=en.
