3 ms·
GitHub has githubusercontent.com. Why was this domain not used for these uploads? Or did image uploads in comments predate that domain? But either way putting
by kevincox 3y ago
GitHub has githubusercontent.com. Why was this domain not used for these uploads? Or did image uploads in comments predate that domain?
But either way putting the repo in the URL seems completely unnecessary. If you need to track ownership you can still do that in the backing database.
- captn3m0 3y agoUsing the repo prefix allows them to put the same auth on uploads. So if you don’t have access to a repo, you can’t access files uploaded in its issues either.
- kevincox 3y agoI'm not saying that they don't need to check auth by repo. They can still check the auth when they look up the metadata for the file. Just don't include it in the URL. The auth difficulty may make moving the files to a different domain more difficult, but same domain path shouldn't matter.
- chatmasta 3y agoI could have sworn that githubusercontent was used for these uploads. I’m not at my computer now so I can’t double check, but I’m guessing there is some special case involved for these repos.
- oefrha 3y agoNo, githubusercontent.com is used for image uploads, but file attachments have always been on github.com under the repo path. I recall using this as a makeshift distribution mechanism years ago, I was surprised and already thought about the security implications back then, so this abuse can’t possibly be new.