3 ms·
I would say it seems Github thought it would make a difference, based on their request for 48 more hours. Why do you think it won't make a difference to them i
by sounds 6y ago
I would say it seems Github thought it would make a difference, based on their request for 48 more hours.
Why do you think it won't make a difference to them in light of them specifically requesting 48 more hours?
- hn_throwaway_99 6y agoBecause of that 2nd to last point: > Github responds and mentions that they won't be disabling the vulnerable commands by 2020-11-02. They request an additional 48 hours, not to fix the issue, but to notify customers and determine a "hard date" at some point in the future. The issue isn't really with GitHub not making the fix available, but the issue is that if they turn it off now they will break legions of builds. I think the Project Zero disclosure issue for them then is more for pointy haired manager appearances ("Oh no! Github has a disclosed Project Zero vuln!") than for any real difference in security.
- ryanseys 6y agoThen break the legion of builds in the name of security.
- hn_throwaway_99 6y agoThat seems along the lines of "I can just turn off the ability to log in to prevent account hacking!" level of security thinking.
- wbl 6y agoFor some accounts you do exactly that if you have to.
- thw0rted 6y agoIf your choices are "disable all logins" or "anybody can log into my bank account and make whatever transfers they want", the correct choice is the former. (Obviously I would prefer a third option, where the company actually fixed the login bug sometime during the 104-day lead-up, but that's not the point.)
- Robin_Message 6y agoWhat if we could have both, just by sending an email? Hit compose underlying!
- quickthrower2 6y agoWell there could hurt their pride to miss the deadline. They might have an internal metric for this too.