10 ms·
GitHub censored my research data
- mattip 10y agoDiscussion of origin of the list here https://news.ycombinator.com/item?id=12707860 https://news.ycombinator.com/item?id=12707860
- pdq 10y agoIsn't pastebin the correct site to post lists like this?
- r3bl 10y agoNot if you want to update it. Also, Pastebin has some shady practices. One example: they offer HTTPS support as a premium feature.
- oolongCat 10y agoI am sorry, but I fail to see how offering https support as a premium feature could be considered "shady".
- chill1 10y agoAll web traffic should be encrypted, regardless of purpose. This increases the work that nation-state level adversaries must do to effectively spy on the population. And it's cheap and easy to do these days.
- oolongCat 10y agoIt's not a question if its easy to do or not. Yes I prefer an encrypted connection over one that is not. BUT! the point here is the op claims this is a shady practice to provide https to their paying customers. A shady practice is if they take your personal information and sell it to another without telling you. Shady is when companies lie to their customers. And this situation is not.
- chill1 10y agoFair enough. I don't think this is a "shady" practice either. But I think it's an old, out-dated practice to charge extra money for a feature that should be on by default.
- synthetik 10y agoIf you might need to make edits in the future, then a temporary account. Like a burner prepaid cell phone. HTTPS is for API users. The majority of pastes are anonymous.
- mistaken 10y agoWhy not ask the archive.org guys to publish it somewhere? The research already relies on their data and they seem to be pretty good at defusing shady legal requests.
- x1798DE 10y agoArticle doesn't say that gitlab censored the list, though the gitlab link is a 404. Also, are they actually using DMCA to get these lists taken down? If so, isn't there some penalty for filing a false DMCA?
- vSanjo 10y agoThe first comment mentions it was taken down about an hour ago.
- x1798DE 10y agoHmm. I didn't (still don't) see any comments. Maybe it's a mobile thing.
- gruez 10y ago>If so, isn't there some penalty for filing a false DMCA? Only if you get caught, which I don't think will be the case if they did anything to cover up their tracks
- ubernostrum 10y agoAs I understand it, it's actually worse: the thing you swear under penalty of perjury is not "this content infringes a copyright", but rather "I am the copyright holder or authorized to act on the copyright holder's behalf". So even if you know beyond doubt something doesn't infringe, you're not committing perjury unless you misrepresent yourself as a copyright holder or authorized agent of a copyright holder.
- vSanjo 10y agoI don't know enough about these kinds of situations yet to form a reasonable argument for-or-against. Is what was done considered a kind, favourable thing for the developers behind those sites or is it something that shouldn't have been displayed?
- chipperyman573 10y agoIt doesn't matter what is kind for the devs, it matters that their website has malware causing their user's data to be compromised.
- inimino 10y agoThe article states the lists were taken down but does not say why. Perhaps there will be an explanation forthcoming from Github or the researcher.
- anondon 10y agoHow exactly does publishing a list of malware-infected stores fall under the DMCA? I always thought DMCA was meant to be for copyright infringement cases. I didn't see the list, but did it by any chance contain the logos of the online stores? If it did, the DMCA notices make sense.
- nihonde 10y agoCompilations can be copyrighted. There's a long legal history on the topic. Also, logos are generally a topic for trademark laws, not so much copyright.
- vog 10y ago> Compilations can be copyrighted. There's a long legal history on the topic. This is true, but totally irrelevant as it misses the point of the question.
- nihonde 10y agoActually, you're wrong. The DMCA was used as a premise for takedown on the basis of purported copyright infringement. I was pointing out that such a claim, however spurious you may think it is, would likely hinge on the claimant's exclusive rights in the compilation. I can't see any other theory that would support a DMCA takedown. Again, it's irrelevant to the question whether or not you think the claim had merit. Also, the question conflated trademark with copyright.
- Veen 10y agoThat's all well and good if this case ever goes to court, which it almost certainly won't. Most service providers will pull down any content that's included in a takedown notice. The alternative is for each service provider to make a legal decision about each takedown notice. That won't happen. If they don't respond in good time, they risk their safe harbor status. It's smarter (under the seriously f'ed up DCMA system) to pull it down and wait for a counter notice, at which point they put it back up, and they aren't responsible any more — the person filing the counter notice is responsible because a false counter claim counts as perjury. At that point, the original issuer of the takedown notice can sue. Of course, it almost never gets that far when the takedown notices are spurious, as in this case. That's what makes the DMCA such a bad idea — it's a perfect tool for censorship.
- r3bl 10y agoIsn't it the whole point of GitLab that it's decentralized? As in, you can roll your own instance and stop worrying about censorship? I'm pretty sure someone here has a GitLab instance that is willing to share for this purpose.
- pmontra 10y agoAnd get DDoSed by the malware guys who don't want their victims know they are in the list and fix their site. It would be an altruistic offer but I would think twice about it. However it's a problem and we need a solution. A torrent? Yes but Google won't index it. A file on S3 wouldn't work because they could just download it as many times as needed to make the bill skyrocket. Better than a DCMA. Anything that is unaffected by DDoS, costs no money, can be indexed? Edit. One more requirement: not easy censorship.
- cyanbane 10y agoTo be fair, maybe some automated method that hub/lab owners have not vetted the data overall. I hope your list stays up/public personally as long as you are willing to take responsibility for its upkeep. I wish there was some format to submit this list (and your responsibility for keeping up with it) to vendors on the lookout for this kinda stuff (up to them to decide inclusion).
- ddeck 10y agoArchive of the list on Gitlab which is now 404: https://web.archive.org/web/20161014133252/https://gitlab.com/gwillem/public-snippets/snippets/28813 https://web.archive.org/web/20161014133252/https://gitlab.co...
- juskrey 10y agoWhat is the problem to publish on your own site?
- jhou2 10y agoIt would probably get DDOS'ed just as quickly.
- ajmurmann 10y agoJust put it behind the free Cloudfare protection.
- eriknstr 10y ago>Only limited DDoS protection and mitigation is provided to domains on a free or Pro plan through "I'm Under Attack" mode. If you are looking for advanced DDoS protection and mitigation and frequently suffer sizable DDoS attacks, please consider looking at our Business or Enterprise plans. https://support.cloudflare.com/hc/en-us/articles/200170186-Does-CloudFlare-offer-DDoS-protection-to-Free-and-Pro-plans- https://support.cloudflare.com/hc/en-us/articles/200170186-D...
- juskrey 10y agoby whom?
- petre 10y agoOr publish by BitTorrent?
- duncan_bayne 10y agoPerhaps distributing this list is a use case for IPFS? https://ipfs.io/docs/getting-started/ https://ipfs.io/docs/getting-started/
- sqldba 10y agoGitLab and GitHub are both pretty active on HN. I look forward to their response - where is it already?! I'm especially disappointed by GL. GH is already too big to care about such things.
- yincrash 10y agoAfter briefly looking at https://github.com/github/dmca/tree/master/2016 https://github.com/github/dmca/tree/master/2016 there doesn't appear to be any DMCA request for gwillem's content, so maybe it wasn't removed through the DMCA process?
- Pyxl101 10y ago> I understand that Github doesn’t have the resources to investigate each and every DMCA notice. However, it still took me by surprise that Github censors data so easily. Send a counter-notification asserting that the data is not under copyright and have it put back up. Assuming this is really DMCA.
- 0xmohit 10y agoWould be fun to see if the list is censored on Google docs.
- ythl 10y agoYou should host the list and post a high visibility link (i.e. news article). You'll probably discover real quick the pressures that caused GitHub and GitLab to buckle so quickly.
- mankash666 10y agoAnd just like that, we discover how helpless the average Joe is against corporate money. Let's crowdfund an AWS s3+CloudFront hosted site. DDosing that is no easy feat, and if corps do try it, the logs can prove their complicity, which has legal implications I presume
- deleted 10y ago[deleted]
- Waterluvian 10y agoIt's an endless cycle. The Man keeps you down, so you throw together resources and collaborate to have a crowdfunded solution. It becomes successful, grows, hires some employees to maintain things, keeps growing, and becomes The Man.
- sh1392 10y agoWe at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service (https://about.gitlab.com/terms/ https://about.gitlab.com/terms/). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely manner. We did not feel comfortable hosting information that could be construed as an open invitation for malicious users to exploit.
- sillysaurus3 10y agotptacek makes a good argument that responsible disclosure is not a requirement: https://news.ycombinator.com/item?id=12309035 https://news.ycombinator.com/item?id=12309035
- Flimm 10y agoDon't you feel uncomfortable in making it harder for users to avoid websites with malicious software? It's definitely worth mentioning and explaining if you do.
- gorer 10y agoCertainly yes, this is why he created new account at HN
- deleted 10y ago[deleted]
- dchest 10y agoWhy are you putting the interests of merchants before the interest of users (of these merchants)? Do you think Google should "responsibly" disclose and wait for webmaster's response before putting websites into Safe Browsing list? Can I host a project which includes a list similar to Google Safe Browsing, or an adware remover where I list software I consider to be adware?
- goodplay 10y agoThese sites are actively participating in harming their users with their negligence. Users should have the ability to know which site is safe and which isn't.
- gwillem 10y agoGL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware. --- Willem, GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination (https://about.gitlab.com/terms/ https://about.gitlab.com/terms/), we have chosen not to terminate or lock your account. Please know this decision was not reached lightly and we appreciate your understanding on the matter. Regards, GitLab GitLab Support Team GitLab, Inc.
- zAy0LfpBZLC8mAC 10y agoAnd even if it were (a list of vulnerable systems, that is), why the fuck do they think that they should censor serious journalism? If you operate a public venue, then it is an important societal role of journalism to report on it if that public venue poses a risk to the public, whether that might also have negative consequences for the people operating it is completely irrelevant.
- 5h 10y agoAre they in the business of journalism? Lots of people are saying "But the sites are already exploited" ... they are probably still exploitable further also, and GH/GL don't want to be at that party.
- zAy0LfpBZLC8mAC 10y agoWould they be required to publish this story if they "were in the business of journalism"? This is not about whether they are legally required to do anything, but whether what they are doing is responsible behavior.
- 5h 10y agoNo, they would not be required - they are a private business and set their own terms. As for being responsible - that is their motivation. Should I assume that now you have access to this list that you will be contacting the site owners to notify them their sites are infected & exploitable? Would that be responsible on your part?
- mlvljr 10y agoPublish it here, what's the issue? It's list after all, right? :)
- ComodoHacker 10y agoBack to the original problem of skimming. I think the fastest way to get sites fixed is to run a script that crawls sites in the list, parses their Twitter and posts a warning there with link to original article. Can someone help with that?
- ChuckMcM 10y agoSo it seems the real bug here is that a site that is hosting malware is doing so because its actually vulnerable to being hacked, was hacked, and malware was installed. So posting the site name identifies a vulnerable site (which is wrong) and stops informing people that those sites have malware on them (which is an issue as well). That is quite the catch 22. And of course many of the sites owners are clueless and don't even know how to patch or fix their systems. My isn't that that a mess?
- jcoffland 10y agoIt's not wrong to expose negligence which endangers others.
- lucaspiller 10y agoI'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off. OP doesn't go into details of how they check the stores, but I'd assume they have some sort of script as they checked 255k. If that's the case it would be trivial to send an automated email if malware is detected, and include links explaining how to fix it. It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong. What I mean is they probably hired a developer or team to build their website, and assumed that they would build a secure website - they didn't go out purposely and find someone to build them a site that would be hacked.
- zAy0LfpBZLC8mAC 10y agoSo, you don't think that if you operate something that is a risk to other people, it's your obligation to reduce the risk? You can just say that you are incompetent at what you are doing, and therefore you shouldn't be shamed for putting other people at risk?
- lucaspiller 10y agoI edited my post, but I don't think that's really fair. The business most likely outsourced the development of their site to someone who probably assured them that they would build a secure site. The business probably trusted them (maybe the developer was even recommended) yet here we are. The business didn't know enough about building a secure website, so hired someone they assumed did. Edit - Poor analogy removed.
- zAy0LfpBZLC8mAC 10y agoWhat's even your analogy here? Because sometimes people have bad luck and you can make up a completely unrealistic scenario of how bad luck someone possibly could have, we should not hold anyone responsible for anything? To give you an idea of how unrealistic your scenario is: In reality, yes, the owner of the damaged property could force you to pay for the repair, but also, you could force the plumber to reimburse you for that, and they in turn probably will have insurance for that sort of thing that will reimburse them in turn. Noone would be kicked out of anything, except for the plumber by the insurer if they had that happen a bit too often.
- Animats 10y agoDo this kind of thing on your own domain. I have a list of major sites with currently active phishing pages.[1] This is basically a join of PhishTank and DMOZ. Nobody seems to be upset by that. Google is at the top of the list because of their hosting business. It's not just Google Sites. You can put a web site in a Google Spreadsheet cell, which Google doesn't seem to check as a possible phishing site. If you host for others, or offer a URL shortening service, you need automated checking against all available phishing lists or you will be exploited. [1] http://sitetruth.com/reports/phishes.html http://sitetruth.com/reports/phishes.html
- bsder 10y agoOkay, so assume he hosted the list himself and is now DDoS'd. Now what? I'll give you a budget of $100 a year.
- RubyPinch 10y agoI don't believe that gitlab's offered service is "DDoS Protection"
- giancarlostoro 10y agoWell there is Frantech / BuyVM. We had a VM we used as a proxy for about $15 a year + the $3 IP DDoS filtering. We had several proxies on top of our Limestone Networks server (they didn't offer protection at the time - still this is cheaper). Game servers become hot targets by kids who just don't care and do anything to get your server taken down, whether it be competition or a user got banned or just about any reason they can sum up to try and find any given approach to take your service down. Edit: Forgot to mention the free CloudFlare option as well (unless they stopped doing this, haven't had to deal with these things in a few years, but I have a feeling it's still about the same, there's likely even more offers now out there).
- quirkafleeg 10y agoSo your recommendation for people who have material that might incite a DDoS is let Github/Gitlab/another free hosting service deal with the expense/inconvenience?
- beedogs 10y agoMoney talks. Uness it's consumers' money being stolen, it seems.
- franciscop 10y agoHave you thought about contacting Adblockers or even Browsers? They might be interested in this data to block the sites for the average Joe.
- halter73 10y agoFrom the article: 7. I have, prior to publication, submitted all URLs and malware samples to Google’s Safe Browsing team. They have since only acted upon a small portion of the sites.
- franciscop 10y agoWhen I read that I assumed it was Google Search team, not Google Chrome team
- bruce_one 10y agoAs soon as I read this I assumed it was as a libel prevention method. I'd be curious whether Gitlab/hub could be held responsible for proving the accuracy of the claims? (That was my initial assumption as to the reason they were taken down.)
- akerro 10y agohttp://gogsys33repvmfz5.onion/ http://gogsys33repvmfz5.onion/ Free gog git server in Tor. Also, it will ask for an email on registration, but it isn't verified and no email is sent.
- leni536 10y agoI wonder how google acts, if you dump the list here: https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/
- Svenskunganka 10y agoThat's covered in the article: > I have, prior to publication, submitted all URLs and malware samples to Google’s Safe Browsing team. They have since only acted upon a small portion of the sites.
- ptman 10y agoFor once, the Gitlab employees on HN don't comment on a Gitlab-related story.
- icebraining 10y agoHum... https://news.ycombinator.com/item?id=12712996 https://news.ycombinator.com/item?id=12712996
- Hacker_Chai 10y ago"Someone hacked your store and installed malware" "Shut up or I'll sue you" Like wut
- qwertyuiop924 10y agoWell, as an absolute last resort, you can use Freenet or Dat to store your list.
- epalmer 10y ago@gwillem thanks for doing this important investigative work.
- formula_ninguna 10y agoThe malisious code on those websites isn't your bussiness guys. If their owners wish not to respond and not fix it -- they have a right to do so. Why are you all so anxious? It has nothing to do with you all. Just don't buy from them, that is simple. Needless to say, I've seen most of those websites for the 1st time. The world is unfair? No, it's fair and this proves that it is fair.
- orf 10y agoWhat a stupid comment. Here is a list of thousands of sites that people other than you do visit and buy from, causing their cards to be skimmed, and your response is 'stop being so uptight'? Imagine if this is instead a list of real world ATMs. The correct response is not "well ive never seen these ATMs before just don't use them, duh", it's "how the fuck can this be allowed to happen and how do we fix it".
- rawfan 10y agoNow I see. I thought this was a list of stores hacked through the current vulnerability. This is a list of stores hacked through 1-2y old vulnerabilities.
- blahblah12356 10y agoPlease post it to pastebin.com or something like that! put up a torrent I want to know which sites so i can steer clear of them.
- blahblah12356 10y agoPost it to Pastebin.com or make a torrent!
- cweiske2 10y agoList is at http://p.cweiske.de/366 http://p.cweiske.de/366
- zimbatm 10y agoWhy is a third-party required to publish the list, couldn't it be hosted on the blog post itself? That would have the advantage of being to archive the whole thing on a single page.
- jrochkind1 10y ago> I understand that Github doesn’t have the resources to investigate each and every DMCA notice. The DMCA as written really encourages no investigation whatsoever on the part of the service provider, this is pretty much how everyone acts. File a counter-notice with the service provider if you don't think your content violates anyone's copyright. In this case, if Github took it down because of a DMCA notice, i think Github actually behaved _better_ than Gitlab. Github is simply following DMCA, if you file a counter-notice, they'll probably restore it -- if they don't, and say it's not an issue of copyright, it's just that they don't want to host your material, then at that point they'll be behaving similarly to Gitlab. Gitlab did not take it down because of a DMCA notice, they took it down because they decided it was 'egregious' and they just didn't want to host it. https://help.github.com/articles/guide-to-submitting-a-dmca-counter-notice/ https://help.github.com/articles/guide-to-submitting-a-dmca-... I can't find any gitlab docs on filing a DMCA counter notice. Their DMCA policy at https://about.gitlab.com/dmca/ https://about.gitlab.com/dmca/ is short and solely targetted at those claiming infringement, there is no description of how to file a counter-notice. In this case, I think github wins. The terrible parts of github's counter-notice policy (10-14 days until your content comes back) is part of the DMCA law. Take it up with your congresspeople. http://io9.gizmodo.com/the-dmca-how-it-works-and-how-its-abused-1616830093 http://io9.gizmodo.com/the-dmca-how-it-works-and-how-its-abu... However, reading OP again -- it's not clear to me that Github took it down because of DMCA. They may simply be acting exactly like Gitlab, taking it down because they don't want to host it, unrelated to DMCA. But I wanted to clear up some things about the DMCA, since OP mentioned it.
- syshum 10y ago>>>it's not clear to me that Github took it down because of DMCA. Exactly, there seems to be a common misunderstanding that if anything is taken down then it because of DMCA, there are number of ways content may be removed from a platform, be it GitHub, Facebook, YouTube, etc. Not all of it is DMCA. In fact for large platforms that offer take down processes outside of DMCA I would say the vast majority is not, for example anything taken down via ContentID on Youtube is NOT a dmca take down.
- problems 10y agoPost it on a WordPress.com blog or host it on an OVH box or put it behind CloudFlare. All of these are quite censorship resistant in my experience.
- webjunkie01 10y agoThe only way this will get fixed is if a script is written to take advantage of the vulnerabilities and clean the sites affected.
- inlineint 10y agoThere is a service http://www.cryptograffiti.info/ http://www.cryptograffiti.info/ which can be used for posting sensitive information that should not be removed or hidden. It allows to write a message and store it in Bitcoin blockchain as a transaction. It costs near 0.0015 BTC or $1 per kB. Large files can be posted as magnet links to torrents with them. Even if the service's site had been shut down, everyone would always be able to obtain the transaction from it's hash using any bitcoin client/blockchain explorer, convert it to ASCII and read the text. I'd like to note that it is worth to sign with GPG all messages posted that way in order to have ability to post updates and verify authorship.
- eeeeeeeeeeeee 10y agoDefinitely feels like a bad interpretation on Gitlab's part, but not done out of malice. The person was not exposing sites that nobody previously knew about -- the sites were already compromised, there is nothing to compromise again except maybe having more than one attacker in your compromised account. The damage is already done, though. These are likely web applications that were not kept up to date so the responsible security disclosure already happened when it was reported for WordPress/Drupal/Joomla. It is the site owners responsibility to pay attention to those security disclosures, which they likely failed to do. And those compromised sites, in my experience, are usually attacking and infecting other sites and servers on the Internet. That makes them a public nuisance and so public disclosure is necessary so they can be appropriately blocked/isolated.
- stepik777 10y agoI tried to pay in several of these shops. Most didn't even had the functionality to pay with card. The only one in my sample where I was able to get to the payment form had redirected me to the proper payment gateway.
- gwillem 10y agoGitlab CEO just called me and apologized, will restore data shortly. I am personally very sorry that GL got in a bad light here. They had misinterpreted my data and have acknowledged that. For comparison, I have heard nothing from GH over the last two days. Gitlab, you rock.
- kefka 10y agoThey should be much more careful in how these types of reportings are done. You were doing a public service of already-explited machines that are snarfing credit card numbers. And that is of great importance for anyone who buys stuff online (Like... all of us). It also goes to show, that we need to further develop P2P type technologies like IPFS and similar stacks, to rid ourselves from monolithic companies dictatorial hands. Because what they find "unsuitable", you are no longer welcome. That's a problem, for all of us. I had a similar problem with a VPS provider 2 weeks ago. I run IPFS on all my nodes, and comply with good netizen and compsec principles. They ToSsed me, because "my machine was scanning :4001 and they received a complaint". Bullshit. That is the chatter IPFS uses when maintaining the DHT. However, I was actually using a machine and what I paid for... and they didn't like it. Fortunately, since all my data is via IPFS (and /ipfs and /ipns thanks to filesystem mounting), my data was already backed up and distributed. Filing a dispute with Paypal and purchasing another VPS provider was simple.
- turncharlie 10y agoFWIW, if GitLab sees this: Well done. We were planning on buying their hosted service (GitHost) for my employer next week and after this story initially broke I was going to table that and use something else. This has restored our faith in GitLab as a company.
- sytse 10y agoThanks Charlie, glad to hear that. For reference our response blog post is https://about.gitlab.com/2016/10/15/gitlab-reinstates-list-of-servers-that-have-malware/ https://about.gitlab.com/2016/10/15/gitlab-reinstates-list-o...
- 10y ago
- vacri 10y ago"Moderated", not "censored". Neither GitHub nor GitLab have stopped the message going out from outlets other than their own. Would we be comfortable calling the moderators here on HN "censors"?
- DeAndre222 10y agoMany Claim to be HACKERS but few are REAL!!! I believe in Actions not Words... I'm a professional hacker with over Nice (6) years of experience. My Jobs are secured and neat. Contact me for my porpular hacking feed: University Grades Changing Erase Criminal Records Bank Accounts Hack Retrieval of Lost File/Documents Hacking of Database Sales of Dumps cards of all kinds Websites Hack Facebook Hack Control Devices Remotely Hack Verified Paypal Accounts Hack Any Social Media Account Hack Android & iPhone Alibaba and Tax Refund Tutorial. Interested PERSON should contact me at: deepdatashaft@gmail.com Your Satisfaction is guaranteed!!!!!!