Hacker News Reader

Comment by headcanon | Hacker News Reader

So let me get this straight - They're publishing a secret key on a Gist, and then getting whiny when it somehow gets leaked.

Github very clearly states that "secret" gists are NOT private: https://help.github.com/articles/about-gists/

View on HN

> getting whiny

Actually, they're subpoenaing. This is necessary to identify who may have accessed it; i don't think this is a suit over the privacy of gists.

> This is necessary to identify who may have accessed it

Actually, it's not. If Github's TOS (and their legal argument in response to the subpoena) is strong enough, Uber can go fly a kite.

Fair—but they won't have the opportunity without the subpoena. Point is, the subpoena means nothing bad about github itself.

So how is the IP address of someone that has viewed or crawled said secret Gist relevant anyways? Someone crawling a website is not probable cause (even if there is a single IP address which can be traced to specific machine, which is highly unlikely).

Secret gists are not published publicly, and thus are not crawled. You would need to have a direct link to the gist to have accessed it. Having the link either means you had access to it as an internal employee, it was shared by an internal employee, or an internal employee's system or email was accessed by someone else.

Or it could have been linked somewhere public? It's far-fetched to think that you'd be able to prove that someone seeing this gist is malicious. Github clearly states Warning: Secret gists aren't private.

Yes, I'm definitely not disagreeing with that.

> and then getting whiny when it somehow gets leaked

How did you come away with that? They're trying to subpoena GitHub to gather information on who may have been responsible for the hack.

How do we know it was a gist published by Uber, and not a third party?

I couldn't find that information in the article or the subpoena.

http://regmedia.co.uk/2015/02/28/ubergithubexhibit.pdf

It was published by github.com/hhlin. The commit has a SHA256 hash of 2a4fae0e6d443b29826096fe043409e2c305bb79.

The publisher works for Bayes Impact, and according to his LinkedIn page, worked for Uber from April 2011 to October 2014.

Reply on news.ycombinator.com