4 ms·
This is not a white hat hacker does. A white hat would have contacted Github in private with a PoC done with a dummy account and a test repo. There is a reason
by sriramk 15y ago
This is not a white hat hacker does. A white hat would have contacted Github in private with a PoC done with a dummy account and a test repo. There is a reason responsible disclosure guidelines exist.
- blackhole 15y agoOh wait, but it doesn't matter! :D Because, you know, the whole point of the article being that whether or not what he did was "right" is irrelevant because banning him and then presenting a twisted truth to customers is not a productive solution to the problem.
- chrisrhoden 15y agoThe "whole point of the article" was that the reaction from GitHub should have been different. It should not have been. They knew the cause of the issue immediately. They resolved it immediately. There was no reason to involve him. He broke into their house and publicly announced how to cut your own key, so they changed the locks and got a temporary restraining order. Nothing to see here, move along.
- sriramk 15y agoI actually defend Github on that front too. Let's take the long view here - Github has a growing code base and this won't be the last 0-day exploit they face. Do they really want to signal any future person that they're ok with being broken into as long as it is 'benign'? If I were Github, I would want to be telling people "Hey, work with us and you'll get your cred as a security researcher. " I reject the dichotomy that this pushes people to sell their exploits on some illegal market. I think if people wanted to do that, they would irrespective of what Github did. It took many years for the security industry to arrive at responsible disclosure guidelines; there is a reason they exist.
- deleted 15y ago[deleted]