Re: CSRF Protection Bypass in Ruby on Rails - I don''t get it ...

Xavier Noria
Wed, 09 Feb 2011 21:25:47 -0000

On Wednesday, February 9, 2011, Michael Pavling
<pavling-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
wrote:
> On 9 February 2011 16:18, Xavier Noria
<fxn-xlncskNFVEJBDgjK7y7TUQ@public.gmane.org> wrote:
>>> I understood the suggestion to post on core as a better way to get
>>> clarification rather than a suggestion that it should not have been
>>> posted here.
>>
>> Exactly :).
>
> Ah! Well I was confused, as you replied to my post (with no questions
> asked) rather than to Siebert''s OP. I was just musing back to the
list
> with my own considerations on the alert... and had I cross posted to
> core, those guys would''ve got stroppy :-D

No prob, I read your wondering comment as an implicit question, but it
doesn''t matter, mine was just a suggestion.

Few people but Koz have the details of the exploit, that''s why I
suggested to ask in -core. And as I suspected the announce is vague on
purpose.