5 ms·
This is a good time time for EFF to step in. This is open huge so many terrible ways for abuse. 1. Make some random crypto project. 2. Motivate people con
by SXX 4y ago
This is a good time time for EFF to step in.
This is open huge so many terrible ways for abuse.
1. Make some random crypto project.
2. Motivate people contribute to it, see DigitalOcean hacktoberfest.
3. Replace the code with Tornado.Cash source.
Everyone's account is banned by Microsoft. Also I wonder what happen if you didnt sent PR yourself, but someone crafted git commit with your email and added it to such repository.
- ngetchell 4y agoWhat would be the motivation to pull off that heist?
- zekica 4y agoTo prove a point I assume? Nothing else comes to mind.
- mhh__ 4y agoChaos, ransom etc.
- a_t48 4y agoGood ole trolling
- SXX 4y agoWhat motivation do someone have for swatting people? Problem is that Microsoft is certainly overreaching here and this precedent will be abused by malicious actors. One day someone will come to work and find out that whole organization was banned on github just by forging to commits.
- trinovantes 4y agoUnless they enabled PGP signed commits, can't you just forge their commits?
- SXX 4y agoYeah you can and I mentioned I curios who exactly Github has banned. It's possible they only banned people who created PRs under their own account.
- forgotpwd16 4y ago>2. Motivate people contribute to it, see DigitalOcean hacktoberfest. Can skip this step. Just make fake commits (https://github.com/asizikov/gang/graphs/contributors https://github.com/asizikov/gang/graphs/contributors).
- jdpedrie 4y agoAlways sign your commits! gpg is a pain but once you set it up you never have to think about it again.
- dom96 4y agoor don't sign your commits and then you have plausible deniability about commits in your name
- SnowHill9902 4y agoYeah and leave your wifi open so that you have plausible deniability for downloading CP.
- Beltalowda 4y agoYou can use ssh keys to sign commits too, since git version some-time-last-year. GitHub should have support for it sometime this month (not that this is required to verify signatures).
- Beltalowda 4y agoGitHub didn't remove the account of everyone who ever contributed to the repository; if you go to the Web Archive many of the people listed under "contributors" still have accounts. Presumably, they just removed the people who were a member of the organisation.
- _fat_santa 4y agoOk this makes alot more sense. I can totally see how they would nuke every member of the org in an attempt to CYA. It sounded like they nuked every contributor which would have been insane.
- shkkmo 4y agoIt looks like only three accounts were affected, all three were org owners.
- pca006132 4y agoThis should be the top comment and the title should be changed. The title and other comments made me wonder if GitHub deleted the account of all contributors to that repo, which is more serious than deleting the account of members in an organization.
- JumpCrisscross 4y ago> Replace the code with Tornado.Cash source. Everyone's account is banned by Microsoft. Code is speech, that's settled law. It's the entity and wallets that are sanctioned. If someone is a member of the Tornado Cash group on GitHub, it’s safe to say they’re in at least legal jeopardy. GitHub puts itself at risk by knowingly continuing to facilitate their work.
- shakezula 4y agoI would encourage everyone on both sides of this argument to watch this [1] video from Peter van Valkenburgh at ZCON. It lays out a very clear argument why this is really much more serious than just a sanction against a bad actor. 1. https://www.youtube.com/watch?v=XpTrCA3tEKM https://www.youtube.com/watch?v=XpTrCA3tEKM