5 ms·
They do this every time, and have a previously stated spproach of blocking zero day attack scripts for the first X days of a zero day, when they deem it suffici
by floatingatoll 5y ago
They do this every time, and have a previously stated spproach of blocking zero day attack scripts for the first X days of a zero day, when they deem it sufficiently dangerous to the Internet. So, yes, yet again, they’re doing this, just as they always do. Is there something new this time that makes this newsworthy?
- naikrovek 5y agoI'm much more worried about everyone on this site just believing everything they read, then instantly getting mad instead of doing a simple "is this really true" search or even gaining a single data point of their own. this whole culture is just freaking ripe for manipulation. it's so easy.
- turminal 5y agoEvery time this happens we should think about how powerful github has become and why are we collectively allowing this.
- floatingatoll 5y agoI’d love to read a longform blog post about that. Anything that fits into a tweet has already been said a bunch of times already, and hasn’t made a compelling case that there’s a problem here. I’m pretty sure they only takedown exploit code, not scanner code, but people often choose not to distinguish those conceptually, which makes it quite difficult to have a discussion about it. Also, see top reply on this post, which references a dual-use policy: https://twitter.com/_mph4/status/1470343429599211528 https://twitter.com/_mph4/status/1470343429599211528
- jokowueu 5y agogithub isnt powerful
- mdp2021 5y agoI think it meant "powerful" in terms of reliance. When the storage has the items, good, when it locks you out, you are left itemless. (A limited redundancy warning, along the lines of having mirrors, archives, distributed information etc.)
- nefitty 5y agoThey seemed pretty powerful while I was waiting for codex access. I could imagine a world where a select segment of developers got access to an even more impactful tool, with the rest being left out due to arbitrary opaque decisions. How did they even pick who to allow early Codex access? Was it some intern just looking at Google Forms submissions? An algorithm? GitHub is depended on by most of the software engineers of the world, who themselves hold immense power to decide society's path. All that to say, GitHub is powerful.
- turminal 5y agoCare to elaborate why you believe so?
- dghlsakjg 5y agoGit allows multiple remotes, and it really isn’t that hard to self host something like gitlab. For people that operate near the edges of acceptable (create tools that are VERY easy to misuse) this kind of redundancy should be SOP
- kenniskrag 5y agoPut the zip file to your static site, mirror to bitbucket, mirror to sourcehut. I have more doubts, that you don't find the code. Maybe a link inside the CVE would be good.
- turminal 5y agoAbsolutely, but that doesn't make this kind of decisions at any particular host less bad.
- dghlsakjg 5y agoAs far as I can tell the existing policy is not to allow public repos of a zero day vuln exploit while it is still unpatched. The code is allowed after the issue is mitigated This seems like a pretty reasonable policy all things considered
- Cthulhu_ 5y agoGithub isn't powerful per se, they just capture a high percentage of the market for online code hosting. But it's just one website. Anyone can set up a git repo, an instance of a git host, etc.
- turminal 5y agoEveryone can, but most just use Github. As a consequence they get to shape the development processes of pretty much anyone and also to do shit like this.
- robertlagrant 5y ago"Shape" is too broad. Everyone has access to lots of almost identical tools from competitors. It's like saying Ford get to "shape" the driving experience of millions - so what? And switching Git provider is much easier than switching car.
- turminal 5y ago> "Shape" is too broad. Everyone has access to lots of almost identical tools from competitors. Exactly. That's precisely because Github is so big that nobody (except possibly sourcehut, but that's niche) dares to do anything differently and everyone just blindly copies whatever Github does. If that's not "shaping the development experience for everyone", I don't know what is.
- robertlagrant 5y ago> everyone just blindly copies whatever Github does I don't think this is true.
- aaomidi 5y agoWould help if gitlab didn't block search engines from indexing it.