Hacker News Reader

Comment by floatingatoll | Hacker News Reader

They do this every time, and have a previously stated spproach of blocking zero day attack scripts for the first X days of a zero day, when they deem it sufficiently dangerous to the Internet. So, yes, yet again, they’re doing this, just as they always do. Is there something new this time that makes this newsworthy?

View on HN

Every time this happens we should think about how powerful github has become and why are we collectively allowing this.

github isnt powerful

I think it meant "powerful" in terms of reliance. When the storage has the items, good, when it locks you out, you are left itemless.

(A limited redundancy warning, along the lines of having mirrors, archives, distributed information etc.)

They seemed pretty powerful while I was waiting for codex access.

I could imagine a world where a select segment of developers got access to an even more impactful tool, with the rest being left out due to arbitrary opaque decisions. How did they even pick who to allow early Codex access? Was it some intern just looking at Google Forms submissions? An algorithm?

GitHub is depended on by most of the software engineers of the world, who themselves hold immense power to decide society's path. All that to say, GitHub is powerful.

Care to elaborate why you believe so?

Git allows multiple remotes, and it really isn’t that hard to self host something like gitlab.

For people that operate near the edges of acceptable (create tools that are VERY easy to misuse) this kind of redundancy should be SOP

Absolutely, but that doesn't make this kind of decisions at any particular host less bad.

As far as I can tell the existing policy is not to allow public repos of a zero day vuln exploit while it is still unpatched. The code is allowed after the issue is mitigated

This seems like a pretty reasonable policy all things considered

Put the zip file to your static site, mirror to bitbucket, mirror to sourcehut. I have more doubts, that you don't find the code. Maybe a link inside the CVE would be good.

Github isn't powerful per se, they just capture a high percentage of the market for online code hosting. But it's just one website. Anyone can set up a git repo, an instance of a git host, etc.

Everyone can, but most just use Github. As a consequence they get to shape the development processes of pretty much anyone and also to do shit like this.

"Shape" is too broad. Everyone has access to lots of almost identical tools from competitors. It's like saying Ford get to "shape" the driving experience of millions - so what? And switching Git provider is much easier than switching car.

> "Shape" is too broad. Everyone has access to lots of almost identical tools from competitors.

Exactly. That's precisely because Github is so big that nobody (except possibly sourcehut, but that's niche) dares to do anything differently and everyone just blindly copies whatever Github does. If that's not "shaping the development experience for everyone", I don't know what is.

> everyone just blindly copies whatever Github does

I don't think this is true.

Would help if gitlab didn't block search engines from indexing it.

I’d love to read a longform blog post about that. Anything that fits into a tweet has already been said a bunch of times already, and hasn’t made a compelling case that there’s a problem here.

I’m pretty sure they only takedown exploit code, not scanner code, but people often choose not to distinguish those conceptually, which makes it quite difficult to have a discussion about it.

Also, see top reply on this post, which references a dual-use policy: https://twitter.com/_mph4/status/1470343429599211528

I'm much more worried about everyone on this site just believing everything they read, then instantly getting mad instead of doing a simple "is this really true" search or even gaining a single data point of their own.

this whole culture is just freaking ripe for manipulation. it's so easy.

Reply on news.ycombinator.com