5 ms·

Fair enough. Ignoring the issue and not fixing it after it was brought to their attention to me is where they screwed up. As for the account suspension, I'm no

by dkrich 15y ago

Fair enough. Ignoring the issue and not fixing it after it was brought to their attention to me is where they screwed up. As for the account suspension, I'm not sure I agree that the account should not have been suspended. Github is a code repository first, and I don't think they have an obligation to keep people around who are exposing security flaws by notifying the entire community. As the author of the post points out, hundreds of thousands of apps rely on Github, so to an extent it is their responsibility to block people who may jeopardize their users. Let's say that they left his account active, and then two months from now he exposed a larger security flaw by greatly damaging a users' app or business. I'll bet there would be more posts like this one blasting Github for not suspending his account. Personally, I think they should offer him a job.

refulgentis 15y ago
Aye, that's where it gets hairy – I (or anyone else) could write equally impassioned blog posts for making him their chief security officer, or for suing him. The article starts going down the road of playing Monday morning quarterback with that issue, but it's short enough that it's acceptable. Not looking forward to the avalanche of posts on either side of the debate, though.
icebraining 15y ago
As the author of the post points out, hundreds of thousands of apps rely on Github, so to an extent it is their responsibility to block people who may jeopardize their users. But they haven't blocked him. They blocked his account, so all he has to do is create another. Github has put their users in far more danger by being dicks to a guy to gain nothing.
- res0nat0r 15y ago
  In what way do they have to prevent him from ever accessing the site from any account ever again? The best they can do is suspend his account per policy while they are investigating.
  - icebraining 15y ago
    In what way do they have to prevent him from ever accessing the site from any account ever again? Who said they did? The best they can do is suspend his account per policy while they are investigating. Why? What's the point of suspending his account?
    - yummyfajitas 15y ago
      Why? What's the point of suspending his account? There are two issues with any exploit: (1) prevent future exploits and (2) making sure that whoever discovered the exploit hasn't retained any unauthorized access. Fixing the bug addresses (1) and suspending his account gives them time to address (2).
      - vidarh 15y ago
        But the thing here is that if he genuinely wanted to retain unauthorized access, he had at the very least several days to create a ton of alternative accounts to make use of this exploit with. Suspending his account wouldn't have affected him if he was being black hat about this. A suspension in this case serves pretty much no purpose other than to make Github feel better about themselves.

by dkrich 15y ago

refulgentis 15y ago

Aye, that's where it gets hairy – I (or anyone else) could write equally impassioned blog posts for making him their chief security officer, or for suing him. The article starts going down the road of playing Monday morning quarterback with that issue, but it's short enough that it's acceptable. Not looking forward to the avalanche of posts on either side of the debate, though.

icebraining 15y ago

As the author of the post points out, hundreds of thousands of apps rely on Github, so to an extent it is their responsibility to block people who may jeopardize their users. But they haven't blocked him. They blocked his account, so all he has to do is create another. Github has put their users in far more danger by being dicks to a guy to gain nothing.

res0nat0r 15y ago
In what way do they have to prevent him from ever accessing the site from any account ever again? The best they can do is suspend his account per policy while they are investigating.
- icebraining 15y ago
  In what way do they have to prevent him from ever accessing the site from any account ever again? Who said they did? The best they can do is suspend his account per policy while they are investigating. Why? What's the point of suspending his account?
  - yummyfajitas 15y ago
    Why? What's the point of suspending his account? There are two issues with any exploit: (1) prevent future exploits and (2) making sure that whoever discovered the exploit hasn't retained any unauthorized access. Fixing the bug addresses (1) and suspending his account gives them time to address (2).
    - vidarh 15y ago
      But the thing here is that if he genuinely wanted to retain unauthorized access, he had at the very least several days to create a ton of alternative accounts to make use of this exploit with. Suspending his account wouldn't have affected him if he was being black hat about this. A suspension in this case serves pretty much no purpose other than to make Github feel better about themselves.