4 ms·

Where do you draw the line? I mean github.com is the corporate email domain of the GitHub company, it also hosts repositories (user generated content)

• fred256 6y ago
  But not for any binary content as uploaded by the user, that's served from raw.githubusercontent.com.
  • jtl999 6y ago
    I'm aware, but I could just as easily see a lesser registrar getting confused by an abuse report and suspending github.com because it embeds content from githubusercontent.com.
    • mbreese 6y ago
      So you also use two different registrars (the cheap option)? Or the more expensive option where you use a registrar that gives you get a direct phone number to an account manager.
  • ken 6y ago
    Not all of it. Any bug attachments which don't have previews are served from https://github.com https://github.com directly, for example. Here, I uploaded that image from the other day that crashes some phones. I gzipped it so it wouldn't generate a preview, and attached it to a bug. When you click the "github.com" link, it downloads the file, and (at least with my web browser) uncompresses it and opens it with your default application. It's bit-for-bit the same as what I uploaded. https://github.com/kengruven/strukt-bugs/issues/40 https://github.com/kengruven/strukt-bugs/issues/40 I don't know if this is exploitable. I haven't spent any time trying to break GitHub. This is just something I happened to notice once.
    • mbreese 6y ago
      That's interesting. It looks like the link is active, but the request to github.com results in a 302 redirect to S3. I don't know what that would mean in this type of scenario (phishing) either. I wonder what an html attachment would look like...
• mbreese 6y ago
  But it isn't... directly. Github.com is their corporate site, hosts their application, and is how we all interact with repositories (via https or git://). But, the only data you get from that site has been processed through their application and sanitized. The only way to get access to the raw user-generated data is through raw.githubusercontent.com or Github Pages which hosted on github.io. And the data from raw.githubusercontent.com has the MIME types set so that you don't get HTML rendered -- only the raw plaintext (I think). So, in this specific example, if there was someone hosting a phishing site in a github account, it would have been active only through github.io, not the main github.com site. (You could have likely seen the source code from the main site, but it would not have actually generated an HTML form). For historical views, here is the Github blog post that details the change (2013): https://github.blog/2013-04-05-new-github-pages-domain-github-io/ https://github.blog/2013-04-05-new-github-pages-domain-githu...
  • pmontra 6y ago
    Nevertheless some countries blocked github.com, not (only?) githubusercontent.com or github.io https://en.wikipedia.org/wiki/Censorship_of_GitHub https://en.wikipedia.org/wiki/Censorship_of_GitHub Probably they think that GitHub didn't sanitize the content on github.com well enough.
  • jasonlotito 6y ago
    That’s exactly what they are doing, too. Google effectively shut down github.com for the issues in github.io that didn’t exist anymore, in your example. https://news.ycombinator.com/item?id=23425569 https://news.ycombinator.com/item?id=23425569