4 ms·

But not for any binary content as uploaded by the user, that's served from raw.githubusercontent.com.

• jtl999 6y ago
  I'm aware, but I could just as easily see a lesser registrar getting confused by an abuse report and suspending github.com because it embeds content from githubusercontent.com.
  • mbreese 6y ago
    So you also use two different registrars (the cheap option)? Or the more expensive option where you use a registrar that gives you get a direct phone number to an account manager.
• ken 6y ago
  Not all of it. Any bug attachments which don't have previews are served from https://github.com https://github.com directly, for example. Here, I uploaded that image from the other day that crashes some phones. I gzipped it so it wouldn't generate a preview, and attached it to a bug. When you click the "github.com" link, it downloads the file, and (at least with my web browser) uncompresses it and opens it with your default application. It's bit-for-bit the same as what I uploaded. https://github.com/kengruven/strukt-bugs/issues/40 https://github.com/kengruven/strukt-bugs/issues/40 I don't know if this is exploitable. I haven't spent any time trying to break GitHub. This is just something I happened to notice once.
  • mbreese 6y ago
    That's interesting. It looks like the link is active, but the request to github.com results in a 302 redirect to S3. I don't know what that would mean in this type of scenario (phishing) either. I wonder what an html attachment would look like...