5 ms·
This is completely unacceptable. You're treating this as though the author was publishing a list of vulnerabilities about sites. That's not what the author did.
by eridius 10y ago
This is completely unacceptable. You're treating this as though the author was publishing a list of vulnerabilities about sites. That's not what the author did. The author published a list of sites that are already infected with malware and thus are dangerous for users to visit. This is a public service and there is zero expectation of "responsible disclosure" to the sites. The only thing that disclosing to the sites without telling the public does is protect the reputation of the site, but there's no expectation for anyone to try and protect the reputation of sites that are serving malware.
> We did not feel comfortable hosting information that could be construed as an open invitation for malicious users to exploit.
The sites were already exploited. That's the thing. At best I can see the argument you're making being "we don't want the sites to get exploited a second time", but that really shouldn't be a concern. The sites were already exploited, there's nothing left to protect. And publishing a list saying "this site has malware on it" doesn't actually tell anybody how the site was vulnerable anyway, unlike disclosing security vulnerabilities which by their very nature informs people how to take advantage of them.
- PuffinBlue 10y agoCouldn't agree more. I'm not sure if GL is trying to protect themselves against something and are making up some excuse to justify it but the reasons given for taken down the list don't hold water. GL would be far better stating the real reason for taking the info down (surely there must be one). So far what they've done is seemingly to protect the merchants reputation and perhaps protect GL from some imagined legal backlash? The backlash would have no basis is court or other services like Google's own SafeBrowing would not be viable. Are we to assume the GL cares more about that than users/visitors to these sites? The statement from GP is frankly pathetic.
- Fej 10y agoThe real reason is almost certainly something along the lines of 'it's possible we could get sued for libel' or 'we have been threatened with a libel suit'. Not that such a case would ever go anywhere, but I imagine they figure that it's more trouble than it's worth.
- kevin_thibedeau 10y agoThey have safe harbor protection.
- bigiain 10y agoBut maybe not any more - since they're now shown to be acting in an editorial capacity...
- Singletoned 10y agoI agree. GitLab's reputation has taken a pretty big hit in my opinion. I kind of expected GitHub's reaction, but had hoped for something better from GitLab (if nothing else, just to differentiate themselves from their opposition).
- sqldba 10y agoDefinitely stuffed my opinion of them. I thought they were for the people and made good decisions. Nope - corporate suits - and they give us a response which doesn't even make logical sense. Do they think we're idiots?
- monkeycantype 10y agoIs it possible that gitlab's position is that the presence of malware is proof that the site is vulnerable, not that the malware is the vulnerability?
- eridius 10y agoI addressed that in the second half of my comment.