Security Lessons Learned From The Diaspora Launch: MicroISV on a Shoestring
Nice post. Although the programming language used in Diaspora is Ruby, the vulnerabilities can pop up in any web application targeted at a large end-user community.
The team is manifestly out of their depth with regards to web application security, and it is almost certainly impossible for them to gather the required expertise and still hit their timetable for public release in a month. You might believe in the powers of OSS to gather experts (or at least folks who have shipped a Rails app, like myself) to Diaspora’s banner and ferret out all the issues. You might also believe in magic code-fixing fairies. Personally, I’d be praying for the fairies because if Diaspora is dependent on the OSS community their users are screwed. There are, almost certainly, exploits as severe as the above ones left in the app, and there almost certainly will be zero-day attacks by hackers who would like to make the headline news. “Facebook Competitor Diaspora Launches; All Users Data Compromised Immediately” makes for a smashing headline in the New York Times, wouldn’t you say?
Nice post. Although the programming language used in Diaspora is Ruby, the vulnerabilities can pop up in any web application targeted at a large end-user community.
