Hacker News Reader

Comment by ro_bit | Hacker News Reader

> Out of an abundance of caution due to the security of the links redirected with the current git.io infrastructure, we have decided to accelerate the timeline. We will be removing all existing link redirection from git.io on April 29, 2022.

What were the security concerns?

View on HN

The read-only post from January said

> Today, git.io is increasingly being used for malicious purposes.

So my guess is they observed an increase use of some number of existing git.io URLs (perhaps where the destination URL was squatted on) being actively used for "malicious" things.

> perhaps where the destination URL was squatted on

... how? Git.io only redirects to GitHub, isn't it?

I’m under the impression that gist.githubusercontent.com is a popular malware host and C&C especially before they disabled anonymous gists.

Perhaps they are selling the domain, or planning to use it for a new service that allows users to create arbitrary URLs. Both of those scenarios can help an attacker take over old git.io URLs

More likely IMO the backend is some old hacky thing that nobody has been maintaining and someone found a vuln or some software stopped getting security updates.

It's basically unimaginable that they would sell the domain. Whatever amount of money they'd get for it wouldn't be worth it given the potential risks to their customers (since it was formerly an URL shortener), and owning git.io is pretty on-brand for GitHub.

Reply on news.ycombinator.com