U2F token, which is supported by gitlab, would have stopped this
Repositories held for ransom by using valid credentials
61–70 of 158 posts
Re: Repositories held for ransom by using valid credentials
#62Weird aside question: I notice the article says "at approximately 10:00pm GMT". Can someone explain why GMT might be chosen as a reference point here? Is there something I'm missing about the usage of GMT (and not UTC). It just seems particularly odd given that GMT is not (to my knowledge) actually being used as a concrete time-zone at the minute (BST is in effect for daylight savings).
I usually attribute it to mild ignorance, not in a bad way. For a long time GMT was a good reference point. Times have changed. I used to work with a gentleman who would always schedule meetings on the phone as: > Great, let's put that on the schedule for 2:00 o'clock Eastern Standard Time. There was always a bit of officiousness to his tone and I think he just liked the idea of being precise. And he certainly was pr…
And an additional observation. Many applications that allow a user to pick their time zone typically show offsets from UTC and a time zone name.
It bugs me to no end when I have to select something like "-5:00 Eastern Time (US/Canada)" in those dialogs. I think a lot of people just don't care enough to truly understand time zones and there is enough flexibility in human communication to just absorb the endless ream of off-by-one-time-zone errors.
Re: Repositories held for ransom by using valid credentials
#63I don't get the ransom thing: users of a git repository have a clone of the repo that contains the whole history, no? So isn't it trivial to recreate the repository?
I do not have local clones of my old projects.
Re: Repositories held for ransom by using valid credentials
#64Weird aside question: I notice the article says "at approximately 10:00pm GMT". Can someone explain why GMT might be chosen as a reference point here? Is there something I'm missing about the usage of GMT (and not UTC). It just seems particularly odd given that GMT is not (to my knowledge) actually being used as a concrete time-zone at the minute (BST is in effect for daylight savings).
[deleted]
Re: Repositories held for ransom by using valid credentials
#65Mandated 2FA should really be a thing, especially on tech-oriented sites with such importance.
Both GitLab and GitHub allow organizations to require members to use 2fa. So the option is there.
Re: Repositories held for ransom by using valid credentials
#66kinda hoping "testing weak passwords on your existing user's passwords" becomes standard practice at some point.
GitHub does that...it warns you with a banner.
Re: Repositories held for ransom by using valid credentials
#67Earlier quoted context omitted.
I usually attribute it to mild ignorance, not in a bad way. For a long time GMT was a good reference point. Times have changed. I used to work with a gentleman who would always schedule meetings on the phone as: > Great, let's put that on the schedule for 2:00 o'clock Eastern Standard Time. There was always a bit of officiousness to his tone and I think he just liked the idea of being precise. And he certainly was pr…
And an additional observation. Many applications that allow a user to pick their time zone typically show offsets from UTC and a time zone name. It bugs me to no end when I have to select something like "-5:00 Eastern Time (US/Canada)" in those dialogs. I think a lot of people just don't care enough to truly understand time zones and there is enough flexibility in human communication to just absorb the endless ream o…
Isn't that more likely to be an artifact of some framework or library? I have a less than zero interest in creating or maintaining any list of timezones myself, I can tell you that. Besides, if I'm not mistaken, Rails, for instance, is using TZInfo underneath, which is an IANA timezone database. I have to imagine that any other self-respecting web framework is going to also provide things like this out of the box.
Re: Repositories held for ransom by using valid credentials
#68> We believe that no data has been lost, unless the [...] GitLab copy was the only one. One difference between how GitLab and GitHub run their infrastructure is that GitLab doesn't keep reflogs, and uses git's default "gc" settings. As a result they won't have the data in question anymore in many cases[1]. Well, I don't 100% know that for sure, but it's the default configuration of their software, and I'm assuming th…
This tendency of Hacker News users to want to monetize everything is sickening.
This is curious to me. You either run a charity or a business. Is that sickening?
OSS is huge on HN, and a ton of HN users release OSS all the time. Yet, we all have bills to pay, and a lot of us look for ways to make money as well. Food and whatnot.
I'm not really sure what you're objecting to here? You make it sound like because a user talked about monetizing a feature to a hypothesized product that they're the same as a pharmaceutical company with life-needing medication forcing users to pay absurd amounts.
I agree that in certain scenarios how you monetize matters heavily. Yet, I can't help but feel that only applies to freedom and life-essentials. Things like basic internet access and medications.
But a git hosting service? In my view, you could open one and make it as colossally greedy as you like. It seems you disagree with this, can you voice your thoughts in more depth?
Thanks :)
Re: Repositories held for ransom by using valid credentials
#69Earlier quoted context omitted.
Security isn't rendered in absolutes. We have to assume some sheepish new employee somewhere is scared of approaching management about a mistake they made committing a secret, so they reverse the commit and pretend nothing ever happened. We have to try and mitigate damage from lapses in communication and protocol like that.
In either case, the secret is already out whether the user wants to admit to it or not
But in one case, damage is mitigated because the sys admins didn't assume everyone is infallible and strictly adheres to protocol.
Re: Repositories held for ransom by using valid credentials
#70Weird aside question: I notice the article says "at approximately 10:00pm GMT". Can someone explain why GMT might be chosen as a reference point here? Is there something I'm missing about the usage of GMT (and not UTC). It just seems particularly odd given that GMT is not (to my knowledge) actually being used as a concrete time-zone at the minute (BST is in effect for daylight savings).
In the UK, GMT is often used to refer to "the current British time" both GMT/BST. I've seen the same in the US where people say EST but mean EDT.
Is it? I mean, I'm British and I'm not aware of this.