Slashdot Mirror
Vine's Source Code Was Accidentally Made Public For Five Minutes (theregister.co.uk)
An anonymous reader writes from The Register: Vine, the six-second-video-loop app acquired by Twitter in 2012, had its source code made publicly available by a bounty-hunter for everyone to see. The Register reports: "According to this post by @avicoder (Vjex at GitHub), Vine's source code was for a while available on what was supposed to be a private Docker registry. While docker.vineapp.com, hosted at Amazon, wasn't meant to be available, @avicoder found he was able to download images with a simple pull request. After that it's all too easy: the docker pull https://docker.vineapp.com:443/library/vinewww request loaded the code, and he could then open the Docker image and run it. 'I was able to see the entire source code of Vine, its API keys and third party keys and secrets. Even running the image without any parameter, [it] was letting me host a replica of Vine locally.' The code included 'API keys, third party keys and secrets,' he writes. Twitter's bounty program paid out -- $10,080 -- and the problem was fixed in March (within five minutes of him demonstrating the issue)."
o... BeauHD!!! Congratulations!
Although the title says "Vine's Source Code Was Accidentally Made Public For Five Minutes ", the code was available for an indeterminate amount of time, reported as a problem, asked for more info by Twitter, then fixed 5 minutes after proof was shown.
Here's the real source: https://avicoder.me/2016/07/22/Twitter-Vine-Source-code-dump/
Not some shitty summation from the register.
RTFA? Don't bother. The entirety of the article is in the summary, for once.
Better known as 318230.
The Docker Registry deployment instructions specifically walk you through restricting access using basic auth. Did someone not read the instructions, or did they try to get fancy and screw something up?
That doesn't seem like very much for this kind of problem.
good old times when the symbol for anarchy was an A instead of a G. (for example, thanks to Gnome I had an Apache server for 5 minutes too.)
The text of the third link reads "this post", but the target is "https://github.com/vjex", which is not actually a post. The *expected* target (avicoder's original post) is quite possibly the most relevant and useful page to associate with the story, yet that's missing in its entirety.
I try to cut the editors some slack (typos, incomplete sentences, poor wording/grammar, etc...), but a blatantly false title and a mistargeted link are enough to pull me out of the woodwork.
Agreed, I noticed this immediately. I RTFA (which is practically the same as the summary anyway) just to check. Thanks for the link.
No surprise there. I still don't understand why he hasn't been fired yet. My best guess is because he's still slightly better than EditorDavid.
Still a felony under the CFAA better get a good lawyer.
o... BeauHD!!! Congratulations!
Oh come on now. Don't be so hard on the poor guy. At least this time he didn't add a gratuitous link to something like grape vines of Southern California.
I am Slashdot. Are you Slashdot as well?
....for longer and some improvements might ensure!
Why should I care about this Vine code?
I have a new startup everyone should checkout called... umm.. Chime. Yes. Chime. That will do, nicely. It's an innovative app that allows you to upload and share 6 second movies...
... nobody cares!
That's a lot of 6 second vines to publish the source code, complete with shaky cam effect, background noise and low bitrate to make the source code extra readable.
It was public for a much longer, unknown time.
You guys are really funny....
LMAO after reading this thread...
He's the new owner.
Vine's Source Code Was Accidentally Made Public For Five Minutes
Incorrect.
Twitter's bounty program paid out - US$10,080 - and the problem was fixed in March (within five minutes of him demonstrating the issue).
Who knows how long the docker container was actually available to the public.
had its source code made publicly available by a bounty-hunter
Where did that come from? I saw nothing in the article or the blog post that said the "bounty hunter" made the source code available to anyone.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
No surprise there. I still don't understand why he hasn't been fired yet. My best guess is because he's still slightly better than EditorDavid.
Now, now. There's no need to be so harsh on BeauHD. All of the the current 'editors' are equally horrible.
No, whipslash is the new owner. Apparently his parents' company bought Slashdot and made him President, and he has less of an idea than Dice did about how to run the site (say what you want about Dice, but they didn't have as many clickbaity headlines and inaccurate or just flat-out wrong summaries).
Sure, he inherited a trainwreck, but it's been six months, and it doesn't look like it's getting much better.
> Who knows how long the docker container was actually available to the public.
Images were created around mid January as I also checked the info about them, So I guess it was publicly accessible for 3 months.
I think the next gen version will be called Grape and offer tomorrow's children videos that are 1.8 seconds long.
If it was some big fucking deal it had to be secret you could either:
1) not give a fuck
2) walk up to him with a big rock and say give me the source code or I hit you
Why are people so slow to figure this out.
That's funny, because this page:
http://www.techinvestornews.co...
sometimes has non-Apple Inc. related articles on it.
Their scanner doesn't reject pages well enough. IIRC, they're usually companies in other industries with Apple in the name, not actual produce-related articles. In my very quick skim of the first page right now, I don't see any non-Apple Inc. related articles.
Deploy with one click. But your image contains all your secrets (and outdated libs of course).