10 ms·

GitHub sued for aiding hacking in Capital One breach

brianzelip 7y ago
‘The lawsuit also makes a bold claim that "GitHub actively encourages (at least) friendly hacking." It then links to a GitHub repository named "Awesome Hacking.”[0]’ Oh brother. [0] https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking
- bentona 7y ago
  While I do think that "hacking" is less demonized than it was circa "Hackers", it is not surprising that the attitude around a lawsuit is a little outdated. I'm just glad the target is an entity with sufficient resources to defend such a spurious accusation - a similar suit could probably destroy a smaller company.
- dfcmt 7y ago
  "A collection of awesome lists for hackers, pentesters & security researchers." They are not using "hacker" in the "Hacker News" sense of the word, they are using meaning breaking into some system. So no "oh brother" moment here.
  - stordoff 7y ago
    So? Trying to break into a system can be the only way to know it's reasonably secure. This is like saying locksmiths are bad. Preventing this makes systems _less_ secure, defeating the point of trying to ensure privacy. It doesn't even appear to be an official GitHub page (Hack with GitHub - location: Bangalore, India, email: hackwithgithub@gmail.com). Just because someone creates an "X-with-Github" repository, it doesn't GitHub are actively encouraging X.
  - buzzerbetrayed 7y ago
    It’s a repository to help people learn computer security. Of course this is an “oh brother” moment.
vharuck 7y ago
Barriers to posting SSN-like data would make it difficult for a lot of people to do their job. Software that handles SSN info should have fake data for tests.
- Avamander 7y ago
  Not to mention the pure absurdity of trying to censor numbers.
  - dfcmt 7y ago
    In this digital age, everything (text, images, audio) can be encoded using integers. Does that mean it's absurd to try to make anything secret?
    - deleted 7y ago
      [deleted]
    - Avamander 7y ago
      You're strawmaning. I did not speak about making things secret. I also suggest you check this article out https://en.wikipedia.org/wiki/Free_Speech_Flag https://en.wikipedia.org/wiki/Free_Speech_Flag so you understand the difference between censorship and secrecy.
- RijilV 7y ago
  Also SSN isn’t that distinctive of a format. nnn nn nnnn. Check bits and reserved prefixes were all removed decades ago when it became clear we’d run out unless we use the whole name space (and even then that buys us to 2100). \d{3}\s?\d{2}\s?\d{4} will match a surprising amount. Detecting SSNs is hard without accepting a high false positive rate. Much harder than phone numbers, credit card numbers, or cloud credentials.
  - dfcmt 7y ago
    \w\d{3}[\s\-]?\d{2}[\s\-]?\d{4}\w should not have many wrong results. You can also try to guess is something is a list of SSNs from the context.
mebazaa 7y ago
from the thank-god-for-section-230 dept...
- OldHand2018 7y ago
  Obviously they are going to argue that section 230 doesn't apply. Section 230 subsection d: > (4) No effect on communications privacy law Nothing in this section shall be construed to limit the application of the Electronic Communications Privacy Act of 1986 or any of the amendments made by such Act, or any similar State law.
deleted 7y ago
[deleted]
noego 7y ago
> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violated the federal Wiretap Act. > The lawsuit also makes a bold claim that "GitHub actively encourages (at least) friendly hacking." It then links to a GitHub repository named "Awesome Hacking." ... not associated with GitHub staff or management, but owned by a user who registered on the platform This lawsuit is a natural extension of the calls for internet platforms to better police and accept liability for the content they are hosting. These complaints are usually directed towards the big corporations like Google, Facebook and Amazon. But if the rationale is accepted, it will need to be applied universally to startups and SMBs as well. As someone who thinks the world will be a far better place if we had decentralized dumb platforms, as opposed to very centralized platforms with heavy-handed top-down censorship and moderation, I sure hope this movement is turned back.
- ForHackernews 7y ago
  > As someone who thinks the world will be a far better place if we had decentralized dumb platforms Then you should be very much in favour of assigning expensive liability to companies running these centralized platforms. If it becomes extremely expensive or legally risky to maintain a big centralized database, that opens a window for free, open source federated protocols to fill that gap. Consider: You can sue Megaupload Ltd, but you can't sue BitTorrent-the-protocol.
  - twunde 7y ago
    Ah, but you can sue anyone using BitTorrent the protocol and sue the creators of the protocol
    - ForHackernews 7y ago
      Yeah, good luck with that. If you're lucky, you'll win a judgement for both the defendant's Playstation and his Xbox. I'm sure white shoe law firms will be beating down your door to represent you in that suit.
ForHackernews 7y ago
Microsoft's lawyers are going to have fun with this one.
- Avamander 7y ago
  This might the first time I'm happy about the acquisition if they actually do win this and don't have to create a ridiculous censorship engine.
nickjj 7y ago
> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it just so happens one of the random codes matches a valid SSN pattern? Is GitHub going to mess with your code? What if you have tests that matched on a hardcoded random number in a SSN-like format. If GitHub scrubs that then suddenly your CI tests might not pass. Also how would it deal with modifying your git history so others couldn't clone it with the potentially sensitive data?
- mtrpcic 7y ago
  Or any codebase that might have an SSN input and has a test suite with mock SSNs to test against.
- antpls 7y ago
  Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business at all. Edit 2 : people are totally missing my points. The goal is to not display any plaintext SSN that would be scraped by bots. As I said, the hackers could just encode the SSNs, but then the numbers won't be readable by scrapers Edit 3 : once a project is reviewed and verified, it would stop to trigger alerts. This is trivial, but the HN mentality is just disrespectful regarding people's data, until it's their own personal data that leaked
  - BoorishBears 7y ago
    Are you seriously entertaining the idea that Github should pour resources into developing a SSN detection pipeline? Why don't they also flag repositories with lots of names, those are PII. Too many addresses? That's a red flag. Why would you even for a second entertain this nonsense? Non-technical people who think this: https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking is a smoking gun to prove Github as a company is supporting hackers are the ones putting forth this idea, no one with any technical knowledge should come close to supporting this.
fencepost 7y ago
This is easy. You sue the companies with money. https://www.gocomics.com/bloomcounty/1986/06/22/ https://www.gocomics.com/bloomcounty/1986/06/22/
- DangitBobby 7y ago
  I found this Harvard study a while back about the volume of litigation in the us versus other countries. Their conclusions are interesting. PDF link: http://www.law.harvard.edu/programs/olin_center/papers/pdf/Ramseyer_681.pdf&sa=U&ved=2ahUKEwjyuNyS2OnjAhXBSt8KHU-WAEAQFjAEegQICRAB&usg=AOvVaw1zkpFlLgafNUlTIS0bg6Hl http://www.law.harvard.edu/programs/olin_center/papers/pdf/R... "Coffee spills, Pokemon class actions, tobacco settlements. American courts have made a name for themselves as a wild lottery and a money machine for a lucky few lawyers. At least in part, however, the reputation is unfounded. American courts seem to handle routine contract and tort disputes as well as their peers in other wealthy democracies. "More generally, Americans do not file an unusually high number of law suits. They do not employ large numbers of judges or lawyers. They do not pay more than people in comparable countries to enforce contracts. And they do not pay unusually high prices for insurance against routine torts. "Instead, American courts have made the bad name for themselves by mishandling a few peculiar categories of law suits. In this article, we use securities class actions and mass torts to illustrate the phenomenon, but anyone who reads a newspaper could suggest alternatives. "The implications for reform are straightforward: focus not on the litigation as a whole; focus on the specifically mishandled types of suits." I don't know where I first heard this, but I have in my head the impression that America has the reputation of being overly litigious because mis-behaving companies think they benefit from creating that misconception.
  - hysan 7y ago
    Getting a file not found for that link. Is it available anywhere else?
    - DangitBobby 7y ago
      My bad. https://www.google.com/url?q=http://www.law.harvard.edu/programs/olin_center/papers/pdf/Ramseyer_681.pdf&sa=U&ved=2ahUKEwjfr8nuourjAhVBMt8KHfQpC4kQFjADegQIChAB&usg=AOvVaw32fv5Kmt48xM_zgBWo1rTh https://www.google.com/url?q=http://www.law.harvard.edu/prog...
marcinzm 7y ago
> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data No it's not, especially once you add binary files to the mix. I once worked at a company that required everyone to run some sort of local scanner to see if there's sensitive data on their laptops. My laptop with no sensitive data had something like 10k+ matching files. I promptly ignored the thing.
usaphp 7y ago
Is google liable for piracy if they show you a link to a torrent website?
johnnyAghands 7y ago
Honestly, it scares me that this was even filed. Even though we know how ridiculous it is to include Github in this suit, I'm afraid we're going to be left with some weird middle ground that shouldn't even exist to begin with made by people who have no idea how things work trying to fix something that isn't broken.
- Arubis 7y ago
  This might be the first good, non-entitled argument I’ve run across for having some form of software engineering licensure: having qualified people whose technical testimony in court would carry more weight than Larry McSues-a-lot.
  - mindslight 7y ago
    Except that professional licensure tends to attract the lower end of the spectrum, because obtaining that credential represents a better path to success. So it would be easy to get a certified technical person to say the exact opposite for their paycheck, despite the technical consensus being "wtf". The general problem you're referencing is one of stature, specifically that someone who's core activity is forwarding emails without trimming the replies is viewed as more-equal by the court because they've obtained a thick piece of paper. Alternatively we could just remove professional licensure from the field of Larry McSues-a-lot and diminish his stature.
- strictnein 7y ago
  > "people who have no idea how things work trying to fix something that isn't broken" They're not trying to fix anything. They're trying to get as much money as possible, and they don't care about the damage they will cause in doing so.
boxingdog 7y ago
and what about SSN in other countries? like in Mexico we have CURP, RFC, NSS, etc
epylar 7y ago
It would be trivial to post every SSN online. There's maximum one billion numbers fitting that format. Store each number in 30 bits, that's about 3600 MiB of data.
- colejohnson66 7y ago
  It would also be highly compressible. So maybe 1-2 GB after compression?
nesadi 7y ago
"GitHub actively encourages (at least) friendly hacking." Failing to see how this is a bad thing.
srmatto 7y ago
We need to fix Social Security Numbers and the entire SSN system of identification and stop with this insanity around protecting them.
beecat 7y ago
> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I can't wait until I get to debug our first build that won't run because we uploaded some data, however broadly that ends up being defined, with 9 digits in a row...
theshadowknows 7y ago
I swear lawyers are a bunch of geniuses. How long until your personal computer becomes a liability because some cached content in the browser becomes knowingly hosting content? Had it on your phone and took a trip? Now you’re transporting across state lines. Absolutely ridiculous. And as per my last comment, this is 100% about increasing settlement size because the lawyers get a percent. Never been through a class action before? Let me tell you how it works: the opposing lawyer has a set amount of payout they want before they even begin the process. They work to achieve that amount. Once it’s agreed on then they are happy. It has absolutely nothing at all to do with enforcing laws or protecting rights. It is all about buying a lawyer a new house.
dang 7y ago
https://news.ycombinator.com/item?id=20598138 https://news.ycombinator.com/item?id=20598138

‘The lawsuit also makes a bold claim that "GitHub actively encourages (at least) friendly hacking." It then links to a GitHub repository named "Awesome Hacking.”[0]’ Oh brother. [0] https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking

bentona 7y ago
While I do think that "hacking" is less demonized than it was circa "Hackers", it is not surprising that the attitude around a lawsuit is a little outdated. I'm just glad the target is an entity with sufficient resources to defend such a spurious accusation - a similar suit could probably destroy a smaller company.
dfcmt 7y ago
"A collection of awesome lists for hackers, pentesters & security researchers." They are not using "hacker" in the "Hacker News" sense of the word, they are using meaning breaking into some system. So no "oh brother" moment here.
- stordoff 7y ago
  So? Trying to break into a system can be the only way to know it's reasonably secure. This is like saying locksmiths are bad. Preventing this makes systems _less_ secure, defeating the point of trying to ensure privacy. It doesn't even appear to be an official GitHub page (Hack with GitHub - location: Bangalore, India, email: hackwithgithub@gmail.com). Just because someone creates an "X-with-Github" repository, it doesn't GitHub are actively encouraging X.
- buzzerbetrayed 7y ago
  It’s a repository to help people learn computer security. Of course this is an “oh brother” moment.

vharuck 7y ago

Barriers to posting SSN-like data would make it difficult for a lot of people to do their job. Software that handles SSN info should have fake data for tests.

Avamander 7y ago
Not to mention the pure absurdity of trying to censor numbers.
- dfcmt 7y ago
  In this digital age, everything (text, images, audio) can be encoded using integers. Does that mean it's absurd to try to make anything secret?
  - deleted 7y ago
    [deleted]
  - Avamander 7y ago
    You're strawmaning. I did not speak about making things secret. I also suggest you check this article out https://en.wikipedia.org/wiki/Free_Speech_Flag https://en.wikipedia.org/wiki/Free_Speech_Flag so you understand the difference between censorship and secrecy.
RijilV 7y ago
Also SSN isn’t that distinctive of a format. nnn nn nnnn. Check bits and reserved prefixes were all removed decades ago when it became clear we’d run out unless we use the whole name space (and even then that buys us to 2100). \d{3}\s?\d{2}\s?\d{4} will match a surprising amount. Detecting SSNs is hard without accepting a high false positive rate. Much harder than phone numbers, credit card numbers, or cloud credentials.
- dfcmt 7y ago
  \w\d{3}[\s\-]?\d{2}[\s\-]?\d{4}\w should not have many wrong results. You can also try to guess is something is a list of SSNs from the context.

mebazaa 7y ago

from the thank-god-for-section-230 dept...

OldHand2018 7y ago
Obviously they are going to argue that section 230 doesn't apply. Section 230 subsection d: > (4) No effect on communications privacy law Nothing in this section shall be construed to limit the application of the Electronic Communications Privacy Act of 1986 or any of the amendments made by such Act, or any similar State law.

deleted 7y ago

[deleted]

noego 7y ago

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violated the federal Wiretap Act. > The lawsuit also makes a bold claim that "GitHub actively encourages (at least) friendly hacking." It then links to a GitHub repository named "Awesome Hacking." ... not associated with GitHub staff or management, but owned by a user who registered on the platform This lawsuit is a natural extension of the calls for internet platforms to better police and accept liability for the content they are hosting. These complaints are usually directed towards the big corporations like Google, Facebook and Amazon. But if the rationale is accepted, it will need to be applied universally to startups and SMBs as well. As someone who thinks the world will be a far better place if we had decentralized dumb platforms, as opposed to very centralized platforms with heavy-handed top-down censorship and moderation, I sure hope this movement is turned back.

ForHackernews 7y ago
> As someone who thinks the world will be a far better place if we had decentralized dumb platforms Then you should be very much in favour of assigning expensive liability to companies running these centralized platforms. If it becomes extremely expensive or legally risky to maintain a big centralized database, that opens a window for free, open source federated protocols to fill that gap. Consider: You can sue Megaupload Ltd, but you can't sue BitTorrent-the-protocol.
- twunde 7y ago
  Ah, but you can sue anyone using BitTorrent the protocol and sue the creators of the protocol
  - ForHackernews 7y ago
    Yeah, good luck with that. If you're lucky, you'll win a judgement for both the defendant's Playstation and his Xbox. I'm sure white shoe law firms will be beating down your door to represent you in that suit.

ForHackernews 7y ago

Microsoft's lawyers are going to have fun with this one.

Avamander 7y ago
This might the first time I'm happy about the acquisition if they actually do win this and don't have to create a ridiculous censorship engine.

nickjj 7y ago

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it just so happens one of the random codes matches a valid SSN pattern? Is GitHub going to mess with your code? What if you have tests that matched on a hardcoded random number in a SSN-like format. If GitHub scrubs that then suddenly your CI tests might not pass. Also how would it deal with modifying your git history so others couldn't clone it with the potentially sensitive data?

mtrpcic 7y ago
Or any codebase that might have an SSN input and has a test suite with mock SSNs to test against.
antpls 7y ago
Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business at all. Edit 2 : people are totally missing my points. The goal is to not display any plaintext SSN that would be scraped by bots. As I said, the hackers could just encode the SSNs, but then the numbers won't be readable by scrapers Edit 3 : once a project is reviewed and verified, it would stop to trigger alerts. This is trivial, but the HN mentality is just disrespectful regarding people's data, until it's their own personal data that leaked
- BoorishBears 7y ago
  Are you seriously entertaining the idea that Github should pour resources into developing a SSN detection pipeline? Why don't they also flag repositories with lots of names, those are PII. Too many addresses? That's a red flag. Why would you even for a second entertain this nonsense? Non-technical people who think this: https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking is a smoking gun to prove Github as a company is supporting hackers are the ones putting forth this idea, no one with any technical knowledge should come close to supporting this.

fencepost 7y ago

This is easy. You sue the companies with money. https://www.gocomics.com/bloomcounty/1986/06/22/ https://www.gocomics.com/bloomcounty/1986/06/22/

DangitBobby 7y ago
I found this Harvard study a while back about the volume of litigation in the us versus other countries. Their conclusions are interesting. PDF link: http://www.law.harvard.edu/programs/olin_center/papers/pdf/Ramseyer_681.pdf&sa=U&ved=2ahUKEwjyuNyS2OnjAhXBSt8KHU-WAEAQFjAEegQICRAB&usg=AOvVaw1zkpFlLgafNUlTIS0bg6Hl http://www.law.harvard.edu/programs/olin_center/papers/pdf/R... "Coffee spills, Pokemon class actions, tobacco settlements. American courts have made a name for themselves as a wild lottery and a money machine for a lucky few lawyers. At least in part, however, the reputation is unfounded. American courts seem to handle routine contract and tort disputes as well as their peers in other wealthy democracies. "More generally, Americans do not file an unusually high number of law suits. They do not employ large numbers of judges or lawyers. They do not pay more than people in comparable countries to enforce contracts. And they do not pay unusually high prices for insurance against routine torts. "Instead, American courts have made the bad name for themselves by mishandling a few peculiar categories of law suits. In this article, we use securities class actions and mass torts to illustrate the phenomenon, but anyone who reads a newspaper could suggest alternatives. "The implications for reform are straightforward: focus not on the litigation as a whole; focus on the specifically mishandled types of suits." I don't know where I first heard this, but I have in my head the impression that America has the reputation of being overly litigious because mis-behaving companies think they benefit from creating that misconception.
- hysan 7y ago
  Getting a file not found for that link. Is it available anywhere else?
  - DangitBobby 7y ago
    My bad. https://www.google.com/url?q=http://www.law.harvard.edu/programs/olin_center/papers/pdf/Ramseyer_681.pdf&sa=U&ved=2ahUKEwjfr8nuourjAhVBMt8KHfQpC4kQFjADegQIChAB&usg=AOvVaw32fv5Kmt48xM_zgBWo1rTh https://www.google.com/url?q=http://www.law.harvard.edu/prog...

marcinzm 7y ago

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data No it's not, especially once you add binary files to the mix. I once worked at a company that required everyone to run some sort of local scanner to see if there's sensitive data on their laptops. My laptop with no sensitive data had something like 10k+ matching files. I promptly ignored the thing.

usaphp 7y ago

Is google liable for piracy if they show you a link to a torrent website?

johnnyAghands 7y ago

Honestly, it scares me that this was even filed. Even though we know how ridiculous it is to include Github in this suit, I'm afraid we're going to be left with some weird middle ground that shouldn't even exist to begin with made by people who have no idea how things work trying to fix something that isn't broken.

Arubis 7y ago
This might be the first good, non-entitled argument I’ve run across for having some form of software engineering licensure: having qualified people whose technical testimony in court would carry more weight than Larry McSues-a-lot.
- mindslight 7y ago
  Except that professional licensure tends to attract the lower end of the spectrum, because obtaining that credential represents a better path to success. So it would be easy to get a certified technical person to say the exact opposite for their paycheck, despite the technical consensus being "wtf". The general problem you're referencing is one of stature, specifically that someone who's core activity is forwarding emails without trimming the replies is viewed as more-equal by the court because they've obtained a thick piece of paper. Alternatively we could just remove professional licensure from the field of Larry McSues-a-lot and diminish his stature.
strictnein 7y ago
> "people who have no idea how things work trying to fix something that isn't broken" They're not trying to fix anything. They're trying to get as much money as possible, and they don't care about the damage they will cause in doing so.

boxingdog 7y ago

and what about SSN in other countries? like in Mexico we have CURP, RFC, NSS, etc

epylar 7y ago

It would be trivial to post every SSN online. There's maximum one billion numbers fitting that format. Store each number in 30 bits, that's about 3600 MiB of data.

colejohnson66 7y ago
It would also be highly compressible. So maybe 1-2 GB after compression?

nesadi 7y ago

"GitHub actively encourages (at least) friendly hacking." Failing to see how this is a bad thing.

srmatto 7y ago

We need to fix Social Security Numbers and the entire SSN system of identification and stop with this insanity around protecting them.

beecat 7y ago

theshadowknows 7y ago

I swear lawyers are a bunch of geniuses. How long until your personal computer becomes a liability because some cached content in the browser becomes knowingly hosting content? Had it on your phone and took a trip? Now you’re transporting across state lines. Absolutely ridiculous. And as per my last comment, this is 100% about increasing settlement size because the lawyers get a percent. Never been through a class action before? Let me tell you how it works: the opposing lawyer has a set amount of payout they want before they even begin the process. They work to achieve that amount. Once it’s agreed on then they are happy. It has absolutely nothing at all to do with enforcing laws or protecting rights. It is all about buying a lawyer a new house.

dang 7y ago

https://news.ycombinator.com/item?id=20598138 https://news.ycombinator.com/item?id=20598138