I'm very impressed by GitHub's response - what a prime example of how you should handle an intrusion attempt! 11/10 for style from an IT governance and disclosu

I'm very impressed by GitHub's response - what a prime example of how you should handle an intrusion attempt! 11/10 for style from an IT governance and disclosure point of view. They've successfully: identified the nature of the attack, notified customers in a polite manner, publicly disclosed the goings on, and exercised added paranoia (which in this case == security) by disabling related accounts. Kudos! The only thing they missed is disclosing that they're working with local law enforcement - something I'd presume they're doing. More interesting is the attempt. I frequently scan customer systems on their behalf, by spinning up clouds of resources to hammer their login APIs. By using Digital Ocean $0.05/hour boxes, and massive threading, tests tend to cost me ~$50/hour (yes, that's 1000 boxes orchestrated). Given the real world cost of cloud computing, and the ease of libraries such as libCloud (or ruby's: FOG), the cost of doing this in terms of time and real money has dropped dramatically.