5 ms·
> Out of an abundance of caution due to the security of the links redirected with the current git.io infrastructure, we have decided to accelerate the timeline.
by ro_bit 4y ago
> Out of an abundance of caution due to the security of the links redirected with the current git.io infrastructure, we have decided to accelerate the timeline. We will be removing all existing link redirection from git.io on April 29, 2022.
What were the security concerns?
- bpeebles 4y agoThe read-only post from January said > Today, git.io is increasingly being used for malicious purposes. So my guess is they observed an increase use of some number of existing git.io URLs (perhaps where the destination URL was squatted on) being actively used for "malicious" things.
- zinekeller 4y ago> perhaps where the destination URL was squatted on ... how? Git.io only redirects to GitHub, isn't it?
- oefrha 4y agoI’m under the impression that gist.githubusercontent.com is a popular malware host and C&C especially before they disabled anonymous gists.
- gurjeet 4y agoPerhaps they are selling the domain, or planning to use it for a new service that allows users to create arbitrary URLs. Both of those scenarios can help an attacker take over old git.io URLs
- jhugo 4y agoIt's basically unimaginable that they would sell the domain. Whatever amount of money they'd get for it wouldn't be worth it given the potential risks to their customers (since it was formerly an URL shortener), and owning git.io is pretty on-brand for GitHub.
- kadoban 4y agoMore likely IMO the backend is some old hacky thing that nobody has been maintaining and someone found a vuln or some software stopped getting security updates.