9 ms·
Did GitHub Suspend Egor Homakov account?
I hope this isn't the beginning of something ugly with GitHub.
- VuongN 15y agoIs this supposed to prevent him from doing further damage? I hope this isn't the beginning of something ugly with GH.
- kenkam 15y agoCan't say it is a douche move from GH since they are protecting their users' best interests. The facts are: Egor has a way to cause damage to GH. I don't think GH would sit there wondering whether he would do the ethical thing. _If_ something had happened then the reaction would have been totally different. "Why didn't GH ban him when they could have before the damage was done?"
- saurik 15y agoTo be clear: we all had (past tense, as I'm assuming GitHub effectively fixed it) that "way to cause damage to GH"; it isn't a bug that Egor was hoarding, or that only he was in a position to exploit. You can argue all you want that he deserved to have his account banned (I might even agree with you, although I haven't come to a conclusion on that yet), but to claim that it was some kind of required protection that people would legitimately be able to complain about had they not done it is silly: he can still do the damage from a new account, and someone else can do that damage even if he didn't want to.
- masklinn 15y ago> The facts are: Egor has a way to cause damage to GH. I don't think GH would sit there wondering whether he would do the ethical thing. Uh? It takes about 5mn to create a new GH account and push a new set of keys, it's not like killing his account does anything aside from annoying him.
- joelhaasnoot 15y agoThink this was meant as a short term move. They got a patch out in an hour. Suspending his account atleast stopped him for 5 minutes while they were working on it and prevented further immediate harm. Sure, anything over an hour it wouldn't stop him, but it sent a signal.
- pavel_lishin 15y ago> Suspending his account atleast stopped him for 5 minutes while they were working on it and prevented further immediate harm. But it didn't stop anyone else - and Egor at least very clearly showed that he was not malicious.
- joelhaasnoot 15y agoIt took me 15 minutes to figure out what was going on. Before someone reproduced it you'd be 15 minutes on. It worked for those 15 minutes.
- eli 15y agoNot sure that's the call I would have made, but hacking into other users' accounts does seem like a pretty valid reason for account termination.
- deleted 15y ago[deleted]
- rubynerd 15y agoIf I was in their shoes, I would have made the same call: he hacked into users accounts and threatened to do more damage, quick, bust out the bargepole I would be very concerned about this backfiring, but, I would hack Rails a little to report when anybody attempts to use this glitch and wire that into Hubot(TM), so if he does attempt to use this same hole again, the devs are warned instantly
- jaredonline 15y agoSuspending his account doesn't make any sense. He could easily sign up with another email account. Set up a new set of keys on another computer and he's back at it. GH should be working with him instead... he obviously knows what he's doing.
- nknight 15y agoI mostly agree with you in principle, but sometimes you push the big red button and sort out the pieces later, like when it's not a Sunday.
- rubynerd 15y agoThat's the purpose of sending attempted uses of this exploit straight to the highest place possible: so if he does, they know Working with him to do what? He pissed about a little with WebInspector, it doesn't make him a security consultant He threatened to do more damage to your site, why wouldn't you suspend someone like that?
- deleted 15y ago[deleted]
- narsil 15y agoWhat I would like to know is if this is permanent or just till github completes their security audit. It doesn't seem like homakov intended or caused any real harm, although it was a bit immature to draw attention to the vulnerability that way.
- marshray 15y agoI think it's interesting how sometimes the "immature" course of action is what brings the greatest good.
- krobertson 15y agoHe clearly violated their Terms Of Service. If you like and enjoy a service, exploiting it to prove a point is not the way to do it. It takes no time to spot the clause about exploiting the service. Legally, it wouldn't be good to have a TOS and then not enforce it. You never how that could bite you later on if you get dragged into a dispute. All this "they should give it back when they're done" is pointless. You can't reward stupid behavior.
- deleted 15y ago[deleted]
- mtkd 15y agoThey should be hiring him.
- vasco 15y agoSuspending him only shows that if a vulnerability exists (and they always do) in the future people won't go about it so openly because what they'll get for their troubles will be an account suspension. The guy could have done real harm if he kept silent and used it maliciously, chose not to, and got suspended. Github should pay him for finding the vulnerability instead!
- rdtsc 15y agoActually now that they've suspended him, I kind of wish did some real damage. The whole 'get hung for a lamb' saying. That is why I don't really believe in 'white hat hacker' label. Organization when humiliated by their vulnerability strike back and treat the white hacker as a criminal. Or I guess since he actually modified a file or to instead of just publicly commented about the theoretical vulnerability, he is now a gray hat hacker ... ? But if he just blogged about the vulnerability without proving it, he wouldn't have been taken seriously and less people would have believed him (did you know about this guy before this happened? I didn't). That is why I think, as an individual, if you hack, always be a black hat hacker. Organizations do not have mercy and will not treat you with respect if you just break in to point out a problem to try to help them. So might as well do some real damage, hide and or profit from it, by selling it on a black market. (Note, not saying that I condone, or personally agree with such activities, just proposing a better course of actions for those who do).
- pavel_lishin 15y agoRemind me to never play Prisoner's Dilemma with you.
- ricardobeat 15y agoWell, this is not exactly what I expected to find in the ToS: GitHub, in its sole discretion, has the right to suspend or terminate your account and refuse any and all current or future use of the Service, or any other GitHub service, for any reason at any time. Such termination of the Service will result in the deactivation or deletion of your Account or your access to your Account, and the forfeiture and relinquishment of all Content in your Account. GitHub reserves the right to refuse service to anyone for any reason at any time That means my company's code can be wiped out by GH at any time, for any reason. Please don't hurt me :(
- jpeterson 15y agoGit is a distributed SCM, you know. I would highly recommend that you push your code to other remotes in any case.
- deleted 15y ago[deleted]
- ch0wn 15y agoThat's certainly true for the code, but Github is more than just that. Think of the commit-comments, issues, pull requests, private messages and wiki pages. I guess you could create backups of most of these things with the API, but who does that?
- joeyhess 15y agoI do. Well, not private messages, but the rest of it (including all the forks). Checked into branches of the git repository so any clone has all the data. http://github.com/joeyh/github-backup/ http://github.com/joeyh/github-backup/
- ch0wn 15y agoThis is exactly what I was looking for. Thank you for sharing!
- 15y ago
- aquarin 15y agoThis is really childish attitude. Egor grow up.
- kpanghmc 15y agoWhat's to prevent Egor from setting up a new account and using it to exploit the vulnerability he's found?
- marshray 15y agoI believe Github has patched this specific vulnerability.
- jannes 15y agoThey claim to have fixed it. http://news.ycombinator.com/item?id=3663313 http://news.ycombinator.com/item?id=3663313 If they were thorough enough to fix it everywhere in their code is a different matter, though.
- rdtsc 15y agoThat is why this just seems like petty bureaucratic revenge. It looks good for PR purposes and placates other users ("look we got rid of the problem, the hacker has been eliminated").
- stock_toaster 15y agoI think it is more likely they need to verify that he only did what is currently known about and nothing else (such as if he had granted himself access to some private repos, for instance). Much safer to suspend/terminate his account first just in case. They are likely combing access logs, etc. Maybe they will reinstate it later after a review. Who knows other than Github. It could also be to reduce legal culpability. If they left his account enabled and he had granted himself access, and later did more damage, they might be liable for negligence? Not sure. IANAL, etc.
- rdtsc 15y ago> It could also be to reduce legal culpability. Ok that makes sense. In light of that they most likely acted rationally and correctly.
- xpaulbettsx 15y agoIn the future, if folks find vulnerabilities in GitHub, please report them via an Email to security@github.com or support@github.com.
- rdtsc 15y agoOr if you want to keep your account, don't tell GitHub, but sell the vulnerability on black market and make some profit off of it.
- holman 15y agoWe will never, ever suspend or ban accounts that follow responsible disclosure. Ever.
- mpd 15y agoPlease update your TOS to explicitly define what 'reasonable disclosure' is. I'm a paying customer and this comes off as arbitrary.
- deleted 15y ago[deleted]
- andybak 15y agoCan you not see that to many people, suspending Egor's account looks churlish and petty. It's bad PR with your core demographic.
- mtkd 15y agoIf the only activity he's done is what he's mentioned in those issue comments - he really needs his account reinstating soon. There was no malicious intent from those comments - and he's done you a favour. If his account doesn't get reinstated - Github has become something I didn't think it would whilst the founders were still in the business.
- rdtsc 15y agoI think from a PR point of view with respect to the rest of the developer community you might have lost this one. You didn't eliminate the threat posed by him as an individual because he can create a new account. (Note: as far as your enterprise or big-corp clients, you probably did the right thing, because that is what they would have done and that is what they expected. So if they are the clients who put bread on your table, then you have acted correctly) What I think you could have done better (and I speak as a developer not a corporate client): issue a public note saying something to the effect of "Thanks for finding this out, maybe you'd like to interview with us. But please, everyone, do not do it this way, this is against TOS and most likely illegal. Here is is the email where to report these things and we will make sure to give you full credit after we fix the problem".
- abalone 15y agoHe has a get out of jail free card. http://homakov.blogspot.com/2011/07/octocat-tattoo.html http://homakov.blogspot.com/2011/07/octocat-tattoo.html
- muyuu 15y agoIn his master commit he commented that next tattoo would be real :-D
- chbrown 15y agoWhy is someone who can hack Github working for $30/hr on oDesk? @Egor, quit selling yourself short!
- user2634 15y ago4500 USD / month is great money for 18 year old in Russia. It's 10 times usual wage.
- homakov 15y agoI wouldn't say 'great' but decent and ok.
- deleted 15y ago[deleted]
- mahmud 15y agoThis whole tree doesn't understand the contracting business. Hint: it's NOT 40 hours per week. It's not consistent. And there is that little thing called opportunity cost. To be even close to $54k pa you might need to charge ~$100
- rmc 15y agoPerhaps, but now he might be able to get 10 times that
- ricardobeat 15y agoRemember when Zed Shaw took down GitHub for purely personal reasons, disturbing service for millions? I don't remember him getting suspended, his account is live and well at http://github.com/zedshaw http://github.com/zedshaw http://sheddingbikes.com/posts/1306816425.html http://sheddingbikes.com/posts/1306816425.html
- ceol 15y agoDid Zed do that on purpose, though? He was continuously added to a troll repo with no way to block the guy, so he spammed his repo with commits and fake branch merges, but I don't think he crashed GitHub on purpose.
- T-Winsnes 15y agoSo if I got this right, this is the order of how things happened. 1. Egor finds a vulnerability and reports it. https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228 2. It gets ignored and he is being called a troll. 3. He proves that he was right by doing a harmless commit to to the rails master repo. 4. The vulnerability gets fixed quickly as it got the focus of the community. 5. His account gets suspended Not sure I agree with the suspension.
- lunarscape 15y agoExcept he also opened a closed issue, compromised 2 other accounts and impersonated another user, something he admits to in his blog.
- adharmad 15y agoWere his other actions (impersonating another user, compromising other accounts) also to demonstrate vulnerabilities or just unnecessary semi-malicious actions on his part?
- lunarscape 15y agoThey were not malicious but, imho, they crossed the line. It's not be too difficult to justify something simple like opening a closed issue but once he did things that interfered with other peoples accounts that's the point at which I feel no sympathy for for him being suspended.
- lunarscape 15y agoDownvoted for pointing out what the OP conveniently ignores? Or downvoted for daring to even appear to go against the hivemind? Edit: I guess that answers that question. As pointed out in other threads the response to this has shown that HN is no different to other sites and not in a good way. I wasn't even being critical in my original comment but the very suggestion of dissent against the mainstream response is deemed non-conforming enough to warrant anonymous downvoting. That 'hivemind' mentality is the reason I left Reddit. At least others have pointed out this more eloquently than I in relation to this incident.
- heimidal 15y agoHis account has been reinstated, Github has patched their service, and the Rails team has committed a patch with new defaults. All in less than eight hours. Let's move on.
- skeletonjelly 15y agoMove on? There's no lessons we can take away from this?
- heimidal 15y agoThere are certainly lessons to be taken away, but this whole thing has devolved into a witch hunt. Take away the good, move on from the bad, and get back to making software better instead of treating the OSS community like a soap opera.
- 0xEA 15y agoLink to the patch?
- sriramk 15y agoI'm sorry but I have to defend Egor here. Here's how you actually report a vulnerability, demonstrated by dfranke here on HN -> http://news.ycombinator.com/item?id=639976 http://news.ycombinator.com/item?id=639976 What Egor did was to violate sensible disclosure rules. He should have contacted GitHub in private, created a test repo and demonstrated his exploit there, rather than impersonate users and compromise multiple accounts. If I was in Github's shoes and I was trying to figure out what damage was done, the first step would be to suspend the account doing the damage to make sure no further surprises were headed my way.
- espeed 15y agoDon't suspend him -- hire him.
- rurounijones 15y agoHis account has been unsuspended. https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57#commitcomment-1041295 https://github.com/rails/rails/commit/b83965785db1eec019edf1...