4 ms·

As with many things in life, it's a tradeoff... Does it help someone who is conducting recon on Silent Circle employees? Absolutely. But by the same token, we f

As with many things in life, it's a tradeoff... Does it help someone who is conducting recon on Silent Circle employees? Absolutely. But by the same token, we feel the fact that we do have employees who are active parts of communities like this is an asset. For that matter, communities like HN are a great asset to companies like us (we've had great success with the Who's Hiring threads). It wouldn't take much for someone to sort out my HN profile regardless of my disclaimer though. My HN username is the same as my GitHub username, which is linked to the Silent Circle organization.

bellerocky 12y ago
If you have private repos on GitHub, and lets say GitHub has a security vulnerability[1] that lets users post to private repos it probably would be better if malicious people who knew that their target used Silent Circle didn't know you were on GitHub. Which I didn't, until you just mentioned it. Why are you on GitHub? [1] http://arstechnica.com/business/2012/03/hacker-commandeers-github-to-prove-vuln-in-ruby/ http://arstechnica.com/business/2012/03/hacker-commandeers-g...
- JshWright 12y ago
  We don't host any private repos at GitHub. I'm on GitHub because we release the sources of our clients and because we use several open source libraries in our stack and it's very impractical to push changes upstream if you don't have a GitHub account. I could certainly do that anonymously, but again... tradeoffs. It's more convenient for me to do it from my primary account (which makes me more likely to do it) and there are advantages to publicly sharing that we give back to projects that we use. Do you think someone doing a recon on a target like a developer at Silent Circle _wouldn't_ check for a GitHub profile? EDIT: Dunno who is downvoting you. You raise very valid points (ones that we have had many conversations about), and have been very cordial...

bellerocky 12y ago

If you have private repos on GitHub, and lets say GitHub has a security vulnerability[1] that lets users post to private repos it probably would be better if malicious people who knew that their target used Silent Circle didn't know you were on GitHub. Which I didn't, until you just mentioned it. Why are you on GitHub? [1] http://arstechnica.com/business/2012/03/hacker-commandeers-github-to-prove-vuln-in-ruby/ http://arstechnica.com/business/2012/03/hacker-commandeers-g...

JshWright 12y ago
We don't host any private repos at GitHub. I'm on GitHub because we release the sources of our clients and because we use several open source libraries in our stack and it's very impractical to push changes upstream if you don't have a GitHub account. I could certainly do that anonymously, but again... tradeoffs. It's more convenient for me to do it from my primary account (which makes me more likely to do it) and there are advantages to publicly sharing that we give back to projects that we use. Do you think someone doing a recon on a target like a developer at Silent Circle _wouldn't_ check for a GitHub profile? EDIT: Dunno who is downvoting you. You raise very valid points (ones that we have had many conversations about), and have been very cordial...