Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub censored my research data

gwillem.gitlab.io

Post reply on HN
Print view View original

121–130 of 206 posts

Re: GitHub censored my research data

#121

Post by mugsie »

chriscool wrote: post #107
barkbro wrote: post #52

Earlier quoted context omitted.

According to the article, the stores were running malicious javascript which grabs people's credit card info. This obviously means they are vulnerable in some kind of way, but I fail to see how this is reasonably likely to be exploited. Even if it was, you also have to consider the benefit of warning the users. I am not a security expert though, and I might be missing out on something.

The responsibility of GitLab and GitHub is not to investigate if those 1000 sites are indeed running malware and how dangerous the malwares on these sites are, and who could be harmed by these malwares. The responsibility of GitLab and GitHub is also not to judge if it's "more important" to protect the site owners' businesses or the people going to the sites. If some sites are running malware, the site owners are res…

> On the contrary if site owners could be harmed by the name of their sites being on such list on GitLab or GitHub, then GitLab or GitHub are responsible according to the DMCA.

Nope. DCMA is about copyright, and we have not gotten to the point where someones URL is copyrighted.

Re: GitHub censored my research data

#123

Post by johnsea »

Singletoned wrote: post #108
johnsea wrote: post #65

Earlier quoted context omitted.

Did you ask them for permission to publish a private communication? Probably not, bad of you! - Github/-lab is for projects imho and not a publishing platform. Why don't you publish it on your blog or something? All power to Github/-lab, kick out such stuff!

Given that they both offer to host web sites, then they are both (to some extent) publishing platforms. https://pages.github.com/ https://pages.gitlab.io/

As you said: to some extent! Have a look at the "What is Github Pages" [1] and one clearly feels that Pages is meant for software, projects, manuals etc. And NOT to publish documents to shame 3rd party misbehaviour and hopefully attract publicity and quarrel. Such content should go to other places (imho).

[1] https://pages.github.com/

Re: GitHub censored my research data

#124

Post by austincheney »

gwillem wrote: post #40

GL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware. --- Willem, GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination ( https://about.gitlab.com/terms/ ), w…

I am working on a partial solution to this kind of problem and plan to move from Alpha to Beta version later today.

https://github.com/prettydiff/biddle

This is not a CVS, so you would still need to run something like git locally on your own server, but the idea of self-hosted modules will solve for the censorship of central authorities.

Re: GitHub censored my research data

#125

Post by lazyjones »

lucaspiller wrote: post #58

I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off. OP doesn't go into details of how they check the stores, but I'd assume they have some sort of script as they chec…

> Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off.

So, because you expect the owners of the affected websites to be dumb, users should not be protected from malware?

But I'll give you an example of how such sites would get fixed: I used to own and work for a CSE, where thousands of stores are listed. If I had easy access to this list, I'd take a quick look at it for possible clients and ask my former company to contact them. They'd first delist the affected shops from the comparison shopping website, then spend enough time with the owners to make sure they understand and can fix the problem.

Github in their ignorance prevented this, but thankfully archive.org exists...

On the other hand, the safe browsing feature of modern browsers usually creates enough pressure on affected shops that they are fixed quickly - so if some shops don't seem to act quickly, they're probably fraudulent themselves.

Re: GitHub censored my research data

#126

Post by mtarnovan »

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

So when GitLab finally bothers to respond they do so from a new account? Any proof this comes from GitLab?

Which terms specifically does it violate? The terms page you linked to is 10k words long.

As others have mentioned, this is not about responsible disclosure. If those merchants have the good of their customers to heart, they will act to cleanup their sites and disclose the breach themselves. If not they will move to censor this to avoid losing face, maybe not even bothering to remove the malware. And you're just helping them with this.

Re: GitHub censored my research data

#127

Post by formula_ninguna »

The malisious code on those websites isn't your bussiness guys. If their owners wish not to respond and not fix it -- they have a right to do so. Why are you all so anxious? It has nothing to do with you all. Just don't buy from them, that is simple.

Needless to say, I've seen most of those websites for the 1st time.

The world is unfair? No, it's fair and this proves that it is fair.

Re: GitHub censored my research data

#128

Post by lazyjones »

edejong wrote: post #79
bsder wrote: post #66

Earlier quoted context omitted.

> I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. So the malware should be allowed to continue stealing credit card numbers just because the site owners don't know any better? Is that really a position you wish to defend?

Sites will always continue to carry malware. Naming and shaming without looking at all the parties involved is a crude and ineffective way of changing things. Change the browser, change the payment system, educate the user by using plugins, propose enhanced security methods in ECMAscript. Write about how easy it is to make missteps on the net. These are all alternatives which might help in a more permanent fashion.

That's like saying "corruption will always exist, investigative journalism is crude and ineffective - instead educate people to spot corruption and live with better morals".

There's nothing ineffective about uncovering a problem and using transparency to create an incentive to fix it. Crude, yes, but not ineffective at all.

What GL did might be considered complicit in skimming users, especially if they acted under pressure from fraudulent shops or even the skimmers themselves (how do we know?).

Re: GitHub censored my research data

#129

Post by kuschku »

pmontra wrote: post #19
r3bl wrote: post #13

Isn't it the whole point of GitLab that it's decentralized? As in, you can roll your own instance and stop worrying about censorship? I'm pretty sure someone here has a GitLab instance that is willing to share for this purpose.

And get DDoSed by the malware guys who don't want their victims know they are in the list and fix their site. It would be an altruistic offer but I would think twice about it. However it's a problem and we need a solution. A torrent? Yes but Google won't index it. A file on S3 wouldn't work because they could just download it as many times as needed to make the bill skyrocket. Better than a DCMA. Anything that is una…

Let someone selfhost who can just update the hardware firewall rules every few minutes to mitigate the DDoS?

Re: GitHub censored my research data

#130

Post by chriscool »

mugsie wrote: post #121
chriscool wrote: post #107

Earlier quoted context omitted.

The responsibility of GitLab and GitHub is not to investigate if those 1000 sites are indeed running malware and how dangerous the malwares on these sites are, and who could be harmed by these malwares. The responsibility of GitLab and GitHub is also not to judge if it's "more important" to protect the site owners' businesses or the people going to the sites. If some sites are running malware, the site owners are res…

> On the contrary if site owners could be harmed by the name of their sites being on such list on GitLab or GitHub, then GitLab or GitHub are responsible according to the DMCA. Nope. DCMA is about copyright, and we have not gotten to the point where someones URL is copyrighted.

According to https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...:

> It criminalizes production and dissemination of technology, devices, or services intended to circumvent measures (commonly known as digital rights management or DRM) that control access to copyrighted works. It also criminalizes the act of circumventing an access control, whether or not there is actual infringement of copyright itself.

So no the DMCA is not just about copyright.

Post reply on HN