4 ms·

I've been on both sides of this, and sadly having HackerOne/BugCrowd as intermediaries often hurts more than it helps. On one hand I've had to sort through the

by dsl 6y ago

I've been on both sides of this, and sadly having HackerOne/BugCrowd as intermediaries often hurts more than it helps. On one hand I've had to sort through the never ending stream of "if you bypass the safeguards first" issues and some guy in India copying and pasting open source vuln scanner reports. I get why people don't want to deal with this and outsource it. On the other hand, I have a legitimate exploit against GitHub that is "working as intended" for months now. No amount of back and forth is going to convince them that leaking commit messages on enterprise accounts is serious apparently.

Cpoll 6y ago
> No amount of back and forth is going to convince them that leaking commit messages on enterprise accounts is serious apparently. If true, this deserves a write-up. I'm sure a few enterprise accounts might agree, if anyone can see their dev-branch commit named "feature xyz" a month before they announce it.
- chias 6y ago
  Joke's on you: trying to fix bug maybe this? fuck idk idk idk maybe works k ready now
  - Cpoll 6y ago
    But also: "fix stupid fucking sql injection"
- avianlyric 6y ago
  This sounds far worse than just leaking branch names. They said it’s leaking entire commit messages. Those messages could contain very detailed descriptions of how a companies product works, or how a companies fraud controls operated.
  - Cpoll 6y ago
    Sorry, that's what I meant. I should rephrase: a commit message for a commit on the dev branch. I was assuming a relatively lazy commit message as an example. You're correct in identifying that certain organizations might put a lot of information into a commit message.
user5994461 6y ago
Can you publish more details? Consider pastebin, github, personal blog, anywhere you can really. Enterprises, as in publicly traded companies, should definitely not be leaking products and roadmaps because this affects their stock values. I bet you regulators won't like that and it will be fixed in a heartbeat. edit: there is the CEO owner of github commenting on another front page article, might want to drop a word. https://news.ycombinator.com/item?id=22867627 https://news.ycombinator.com/item?id=22867627

by dsl 6y ago

Cpoll 6y ago

> No amount of back and forth is going to convince them that leaking commit messages on enterprise accounts is serious apparently. If true, this deserves a write-up. I'm sure a few enterprise accounts might agree, if anyone can see their dev-branch commit named "feature xyz" a month before they announce it.

chias 6y ago
Joke's on you: trying to fix bug maybe this? fuck idk idk idk maybe works k ready now
- Cpoll 6y ago
  But also: "fix stupid fucking sql injection"
avianlyric 6y ago
This sounds far worse than just leaking branch names. They said it’s leaking entire commit messages. Those messages could contain very detailed descriptions of how a companies product works, or how a companies fraud controls operated.
- Cpoll 6y ago
  Sorry, that's what I meant. I should rephrase: a commit message for a commit on the dev branch. I was assuming a relatively lazy commit message as an example. You're correct in identifying that certain organizations might put a lot of information into a commit message.

user5994461 6y ago

Can you publish more details? Consider pastebin, github, personal blog, anywhere you can really. Enterprises, as in publicly traded companies, should definitely not be leaking products and roadmaps because this affects their stock values. I bet you regulators won't like that and it will be fixed in a heartbeat. edit: there is the CEO owner of github commenting on another front page article, might want to drop a word. https://news.ycombinator.com/item?id=22867627 https://news.ycombinator.com/item?id=22867627