Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Repositories held for ransom by using valid credentials

about.gitlab.com

Post reply on HN
Print view View original

71–80 of 158 posts

Re: Repositories held for ransom by using valid credentials

#71

Post by jjeaff »

edwinbalani wrote: post #4

"Gitlab.com was compromised" is a bad title. _Accounts on_ GitLab, and the credentials to access them, were compromised, but the title suggests that the whole platform was affected, which doesn't seem to be the case.

Looks like they changed the title. But I would have to say that the ability to delete a full repo with the credentials is a bit of a vulnerability.

To me, it seems like a good measure would be to mark deleted repos as "delete requested" then notify the users involved and give them a week or two to undo a total delete. Especially if it is an older repo with lots of commits.

Re: Repositories held for ransom by using valid credentials

#72

Post by CSMastermind »

avar wrote: post #17

> We believe that no data has been lost, unless the [...] GitLab copy was the only one. One difference between how GitLab and GitHub run their infrastructure is that GitLab doesn't keep reflogs, and uses git's default "gc" settings. As a result they won't have the data in question anymore in many cases[1]. Well, I don't 100% know that for sure, but it's the default configuration of their software, and I'm assuming th…

That's really fascinating. Thanks for sharing. As someone who uses Gitlab (and likes them a lot), I definitely like Github's approach more here.

Re: Repositories held for ransom by using valid credentials

#73

Post by danharaj »

soulofmischief wrote: post #69
iakh wrote: post #60

Earlier quoted context omitted.

In either case, the secret is already out whether the user wants to admit to it or not

But in one case, damage is mitigated because the sys admins didn't assume everyone is infallible and strictly adheres to protocol.

The correct way to deal with fallibility in this situation is to make it feasible to change secrets when they leak, not pretend they weren't leaked.

Re: Repositories held for ransom by using valid credentials

#74

Post by greggyb »

scruple wrote: post #67
greggyb wrote: post #62

Earlier quoted context omitted.

And an additional observation. Many applications that allow a user to pick their time zone typically show offsets from UTC and a time zone name. It bugs me to no end when I have to select something like "-5:00 Eastern Time (US/Canada)" in those dialogs. I think a lot of people just don't care enough to truly understand time zones and there is enough flexibility in human communication to just absorb the endless ream o…

Isn't that more likely to be an artifact of some framework or library? I have a less than zero interest in creating or maintaining any list of timezones myself, I can tell you that. Besides, if I'm not mistaken, Rails, for instance, is using TZInfo underneath, which is an IANA timezone database. I have to imagine that any other self-respecting web framework is going to also provide things like this out of the box.

Sure. It probably is. I'm not sure what the point is.

It's still something that I see on a regular basis, and it seems clear that I care more about it than others, because in my experience I talk about it more than others.

But the frameworks are not using standard IANA time zone names. Those look like "America/New_York".

The most recent time zone selection I made was installing OpenBSD on a new laptop yesterday. That had me choose a proper time zone name.

As best I can read your post you're implying that I am impugning the character of developers of applications I use. I have already noted very clearly that I think I just notice/care about this more.

You've also appealed to a couple sources of authority (framework maintainers and IANA). If I wanted to impugn the characters of those developers, I think I'd have good standing, as your authorities agree with me on proper time zone names. I don't want to do this, though. I don't think it's a big deal, because, as I've already mentioned, human communication offers much affordance for this type of technical incorrectness. I'm not confused. I doubt others are confused. I'm not frustrated. It just tickles the pedantic annoyance lever in my brain.

Wikipedia article: https://en.m.wikipedia.org/wiki/Tz_database

Tzinfo (note default examples using strings like I mentioned above): https://github.com/tzinfo/tzinfo/blob/master/README.md#examp...

Re: Repositories held for ransom by using valid credentials

#75

Post by soulofmischief »

danharaj wrote: post #73
soulofmischief wrote: post #69

Earlier quoted context omitted.

But in one case, damage is mitigated because the sys admins didn't assume everyone is infallible and strictly adheres to protocol.

The correct way to deal with fallibility in this situation is to make it feasible to change secrets when they leak, not pretend they weren't leaked.

That doesn't prevent someone from not following protocol.

Re: Repositories held for ransom by using valid credentials

#76

Post by saagarjha »

avar wrote: post #17

> We believe that no data has been lost, unless the [...] GitLab copy was the only one. One difference between how GitLab and GitHub run their infrastructure is that GitLab doesn't keep reflogs, and uses git's default "gc" settings. As a result they won't have the data in question anymore in many cases[1]. Well, I don't 100% know that for sure, but it's the default configuration of their software, and I'm assuming th…

> GitHub doesn't expose that to users in any way

Well, links to orphaned commits still work, and GitHub has recently started surfacing UI when you force push a branch.

Re: Repositories held for ransom by using valid credentials

#77

Post by _II__II_ »

soulofmischief wrote: post #75
danharaj wrote: post #73

Earlier quoted context omitted.

The correct way to deal with fallibility in this situation is to make it feasible to change secrets when they leak, not pretend they weren't leaked.

That doesn't prevent someone from not following protocol.

It's not their job to prevent that.

Re: Repositories held for ransom by using valid credentials

#78

Post by tyingq »

blumomo wrote: post #23

Also GitHub users are affected. By the time of writing 379 public GitHub repos have been compromised: https://github.com/search?o=desc&q=1ES14c7qLb5CYhLMUekctxLgc...

The "Global Association of Risk Professionals" got hit. That should be a fun meeting. https://github.com/GARPDev

Re: Repositories held for ransom by using valid credentials

#80

Post by scruple »

greggyb wrote: post #74
scruple wrote: post #67

Earlier quoted context omitted.

Isn't that more likely to be an artifact of some framework or library? I have a less than zero interest in creating or maintaining any list of timezones myself, I can tell you that. Besides, if I'm not mistaken, Rails, for instance, is using TZInfo underneath, which is an IANA timezone database. I have to imagine that any other self-respecting web framework is going to also provide things like this out of the box.

Sure. It probably is. I'm not sure what the point is. It's still something that I see on a regular basis, and it seems clear that I care more about it than others, because in my experience I talk about it more than others. But the frameworks are not using standard IANA time zone names. Those look like "America/New_York". The most recent time zone selection I made was installing OpenBSD on a new laptop yesterday. That…

> I'm not sure what the point is.

Believe me, I'm having the same reaction right now.

> The most recent time zone selection I made was installing OpenBSD on a new laptop yesterday. That had me choose a proper time zone name.

If you don't understand the difference between you selecting "America/Los_Angeles" in an OpenBSD installation and the average user being confronted with a list of country/city names vs. a timezone name and offset then I feel sorry for your users.

Post reply on HN