5 ms·
This came up recently in a different HN thread: https://news.ycombinator.com/item?id=19118740 https://news.ycombinator.com/item?id=19118740 The main gist is th
by otras 8y ago
This came up recently in a different HN thread: https://news.ycombinator.com/item?id=19118740 https://news.ycombinator.com/item?id=19118740
The main gist is that GitHub doesn't require proof of ownership in order to set a custom domain.
This means that if your GitHub Pages configurations are incorrect for any reason (for example, that user switched from a Pro to a regular account and lost the ability to have a GH page on a private repo), another user can come along and claim your page (confidencetoexplore.com) as the custom domain for that repo.
My bet would be that this happened to you. As another user in that thread mentioned, report them: https://github.com/contact/report-abuse https://github.com/contact/report-abuse
- applecrazy 8y agoYes. This is what I just discovered. OP here's the malicious github account, so we can get it banned: https://github.com/OnyonCapitaly https://github.com/OnyonCapitaly I found a repo with your domain: https://github.com/OnyonCapitaly/confidencetoexplore.com https://github.com/OnyonCapitaly/confidencetoexplore.com edit: just reported them, but you should too OP.
- sarcasmatwork 8y agoReported too...
- scottndecker 8y agoThank you!
- scottndecker 8y agoThank you! This is nuts that this can happen and someone would do such a thing. Stupid.
- ronsor 8y agoThe script kiddie will just signup for another account and "hack" the same sites again.
- vokep 8y agoAt least now they have to go through that effort again
- techntoke 8y agoDoes GitLab have this issue? Don't they offer all this for free, unlike GitHub?
- lscotte 8y agoI don't know if they handle this case better specifically, but I found almost all GitLab page functionality is better than GitHub - plus it's more generic, you can wire any static page generator into the built-in CI/CD, not just limited to jekyll or doing it yourself.
- therealmarv 8y agoGitLab requires you to put a txt record with a verification code in your custom private domain DNS to verify ownership. TL;DR no, GitLab does not have that issue.
- gitlab-security 8y agoConfirming the previous poster's comment on GitLab Pages domain ownership verification functionality, which was rolled out in February of 2018. https://about.gitlab.com/2018/02/05/gitlab-pages-custom-domain-validation/ https://about.gitlab.com/2018/02/05/gitlab-pages-custom-doma...
- deleted 8y ago[deleted]
- applecrazy 8y agoAaaand it’s down! Good job Github and everyone who helped. Hope this helped, OP
- marketgod 8y agoYou are awesome. Good work!
- applecrazy 8y agoThanks! This is the first time I've done this kind of internet sleuthing. It's a fun experience.
- scottndecker 8y agoSon of a biscuit! This is exactly what happened. They said I could have my 7 private repos without a Pro account so I downgraded and didn't realize it shut down my gh-pages websites. Then this schmuck comes along and steals them. THANK YOU TO EVERYONE WHO IS REPORTING THIS!!
- chrisweekly 8y agoThank you for "son of a biscuit"! Best pseudo-swear since "Shut the front door".
- lloeki 8y agoIn french my wife uses "lutin en herbe" (or just "lutin") instead of "putain de merde"
- tendencydriven 8y agoGoogle translate says "budding goblin" ... I'm just going to use that in English
- morpheuskafka 8y agoGitHub recebtly introduced a domain verification system for an unrelated feature, they should really integrate it with Pages.
- hopler 8y agoThat thread is 2months old and GitHub/Microsoft still hasn't closed this security hole.
- applecrazy 8y agoThey should at least flag accounts with an unusually high number of custom domains. Seems easy to do IMO.
- dragonwriter 8y agoThat thread was 54 days ago, and the flaw was being exploited and was reported to GH then. Shouldn't they, I don't know, do something beyond banning accounts caught exploiting this?
- max23_ 8y agoYes, I got my GitHub page 'hijacked' in a similar way some time ago when I switched the repo to private (when GitHub announced free private repos for regular account). Quick response from GitHub after raising a report and got my CNAME back after going through the domain ownership verification with them.