I went to go try and fix the XSS bugs and found no view testing, or integration testing. Just model and controller unit tests. I managed to get a general patch in  to help a bit, but there are other, deep seated problems. This needs a lot of work. I'm no security expert by far, so like he says in TFA, I fear for what tptacek or someone that knows what they're doing could do.
What was the problem I was getting at? Oh, yeah: Diaspora has no apparent access to the software security expertise they need to pull this off. I looked at it for 17 seconds, rolled my eyes, and stopped reading. Maybe someone at iSec Partners will take this project under their wings. But why? Most software security professionals are up to their ears in interesting projects that aren't attempts by college kids to take on Facebook.
More than a few of those professionals are now busy working for Facebook.
This is a dumb idea for a project.
edit (show edit form) checks that it's your photo to edit
update (make changes to photo) does not, you can update anyone's photo to anything
destroy (delete the photo) does not, you can delete anyone's photo w/ the id.
This is stuff you just DON'T DO in a web app. It's something any self respecting web developer, especially Rails developer, will look at and shudder. And those are the simple things that immediately stand out. Who knows what kind of security failures are built into this system due to ignorance or just plain lack of care.
But none of that matters because they've picked a project that they have to get right, and that in the long run is going to be defined in large part by design security.
I was expecting some integral libraries that would encapsulate privacy and authentication logic which would be reused for the entire framework. I don't really care if this was 'only' 3 months of work. That lack of security/privacy checking in that photo update section speaks volumes about where the developers and entire project are at.
Is it doomed? Probably not - apparently even Duke Nukem Forever has a new release date(?) - but they've got a long way to go to convince early adopter techies (people like me) to install this and evangelize on their next round.
A code review by frickin entire world???
This will help them WHEN THEY DO THEIR ALPHA RELEASE. Thanks...
Reading all this actually is the first moment I imagined that diaspora wouldn't be the total disaster it threatened to be.
Diaspora? Or doing a security audit of Diaspora's code?
Reasons to work on this?
Visibility, visibility, visibility, visibility, visibility, and visibility.
Did I mention visibility?