4 ms·

Kudos to Github for not charging him with "Unauthorized Access of a Computer"

• jessaustin 11y ago
  Given their customer base, that sort of response would have kicked off a shit-storm. ISTM that any "responsible disclosure" ought to at least rate a T-shirt. (If GH don't want to pony up the T-shirt, that's fine, but they can't send customer notifications before the researcher publishes.)
  • robzyb 11y ago
    > (If GH don't want to pony up the T-shirt, that's fine, but they can't send customer notifications before the researcher publishes.) In my uneducated opinion, that seems like a really good way to judge whether something qualifies as worthy of a bug bounty etc.
  • benjojo12 11y ago
    I'm not saying that I didnt get anything for it what so ever, The peer of mine did manage to send over some swag as a thanks, I now have http://i.imgur.com/d2f7mcD.png http://i.imgur.com/d2f7mcD.png on my work desk :)
• kardos 11y ago
  Sure, but as I understand it, he doesn't/didn't need to actually try it on github's servers. If he put the public keys in question into the authorized_keys list of a second account on his personal system, he can locally verify that the brute forced private key is correct. I think the wording agrees with this: > <snip> and then a few more minutes to transform those back into a SSH key that I could log into systems with.
• dimino 11y ago
  To be wildly pedantic, GitHub wouldn't charge him with anything, the DoJ would, regardless of what GitHub does/doesn't do.
• grkvlt 11y ago
  > List public keys for a user - Lists the verified public keys for a user. This is accessible by anyone. Hardly 'kudos' for them; the API to list public keys is listed by GitHub as 'accessible by anyone' in the documentation, it would be difficult to construe what they did as 'unauthorized' because of that.