Hey Github, Remember This Article? | Hacker News Reader

Hey Github, Remember This Article?

blackhole12.blogspot.com

30 pointsblackhole14 comments

github has commented on the issue, and only suspended his account until they had gotten to the bottom of the issue, the hack, and his intent. This seems totally reasonable (as in he says this wasn't malicious, but let's make sure just in case). His account has been reinstated.

https://github.com/blog/1069-responsible-disclosure-policy

Knee-jerk reaction from people within this community seems baffling to me.

They did that in this case, because it apparently wasn't clear enough. Their real response was to create this: http://help.github.com/responsible-disclosure/

Which more explicitly forbids this.

The author cites reporting the issue to the rails community but why didn't he report it to security@github.com? As some of the GH people have already said (on other articles), they would have taken him very seriously and not banned his account if he would have reported it the correct way instead of hacking into high profile accounts.

Reporting it to github wouldn't have demonstrated the problem he was trying to flag. His problem wasn't "gitub is insecure" but instead "rails by default is insecure." When told by the rails team that fixing this problem was the responsibility of rails users, he demonstrated that even the most sophisticated users (presumably, github devs) were exposed.

If he had submitted a bug report to github, they would have probably just fixed it. And the problem he was flagging in rails wouldn't have been any closer to fixed.

Apparently he did. However, GH only fixed that specific exploit he provided. The general vulnerability was apparently spread throughout their entire code-base. After realizing this, he filed a report with the framework GH uses (which would fix the problem for everyone - not just GH). They told him to fuck off (politely). So he proved his point.

Childish? Yes. But then again, he is a child. The kid is a teenager. That's how they're supposed to behave.

Also, I have a strange feeling things will actually be fixed now? So the kid gets results.

The author says Github ignored the issue when it was reported to them, but cites an issue opened on the Rails issue tracker. Unless I missed Github's acquisition of Rails, I don't see how that counts as reporting the issue to Github.

The reason this was ignored at first should be obvious: his writing is hard to read, because he isn't fluent in English. While it turned out that he did have something important to say, most broken English is noise so people filter it out instinctively.

The _pragmatic_ thing to do is indeed to suspend and investigate.

Read https://github.com/rails/rails/issues/5228

The vulnerability discoverer tried to explain the dangerousness of the bug multiple times... but he was ignored despite attempts to show benign ways to exploit it.

So he did the right thing by exploiting the vulnerability to perform a rogue commit to the master Github repo. No one was taking him seriously.

Now Github finally fixed it!

Finally someone speaks up! +1

This is not a white hat hacker does. A white hat would have contacted Github in private with a PoC done with a dummy account and a test repo. There is a reason responsible disclosure guidelines exist.

Oh wait, but it doesn't matter! :D Because, you know, the whole point of the article being that whether or not what he did was "right" is irrelevant because banning him and then presenting a twisted truth to customers is not a productive solution to the problem.

I actually defend Github on that front too. Let's take the long view here - Github has a growing code base and this won't be the last 0-day exploit they face. Do they really want to signal any future person that they're ok with being broken into as long as it is 'benign'? If I were Github, I would want to be telling people "Hey, work with us and you'll get your cred as a security researcher. "

I reject the dichotomy that this pushes people to sell their exploits on some illegal market. I think if people wanted to do that, they would irrespective of what Github did.

It took many years for the security industry to arrive at responsible disclosure guidelines; there is a reason they exist.

The "whole point of the article" was that the reaction from GitHub should have been different. It should not have been. They knew the cause of the issue immediately. They resolved it immediately. There was no reason to involve him. He broke into their house and publicly announced how to cut your own key, so they changed the locks and got a temporary restraining order.

Nothing to see here, move along.

Reply on news.ycombinator.com