Microsoft's lawyers are going to have fun with this one.
This might the first time I'm happy about the acquisition if they actually do win this and don't have to create a ridiculous censorship engine.
GitHub sued for aiding hacking in Capital One breach
11–20 of 104 posts
Re: GitHub sued for aiding hacking in Capital One breach
#12Barriers to posting SSN-like data would make it difficult for a lot of people to do their job. Software that handles SSN info should have fake data for tests.
Also SSN isn’t that distinctive of a format. nnn nn nnnn. Check bits and reserved prefixes were all removed decades ago when it became clear we’d run out unless we use the whole name space (and even then that buys us to 2100). \d{3}\s?\d{2}\s?\d{4} will match a surprising amount.
Detecting SSNs is hard without accepting a high false positive rate. Much harder than phone numbers, credit card numbers, or cloud credentials.
Re: GitHub sued for aiding hacking in Capital One breach
#13> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…
Github isn’t anywhere near a startup. It is a big division of Microsoft.
Re: GitHub sued for aiding hacking in Capital One breach
#14> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data
I don't see how they can expect to enforce this with 100% accuracy.
SSNs do have a fixed format but other things could potentially follow the same format.
For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it just so happens one of the random codes matches a valid SSN pattern?
Is GitHub going to mess with your code? What if you have tests that matched on a hardcoded random number in a SSN-like format. If GitHub scrubs that then suddenly your CI tests might not pass. Also how would it deal with modifying your git history so others couldn't clone it with the potentially sensitive data?
Re: GitHub sued for aiding hacking in Capital One breach
#15> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…
> As someone who thinks the world will be a far better place if we had decentralized dumb platforms Then you should be very much in favour of assigning expensive liability to companies running these centralized platforms. If it becomes extremely expensive or legally risky to maintain a big centralized database, that opens a window for free, open source federated protocols to fill that gap. Consider: You can sue Megau…
Ah, but you can sue anyone using BitTorrent the protocol and sue the creators of the protocol
Re: GitHub sued for aiding hacking in Capital One breach
#16This is easy. You sue the companies with money.
Re: GitHub sued for aiding hacking in Capital One breach
#17from the thank-god-for-section-230 dept...
Obviously they are going to argue that section 230 doesn't apply.
Section 230 subsection d:
> (4) No effect on communications privacy law Nothing in this section shall be construed to limit the application of the Electronic Communications Privacy Act of 1986 or any of the amendments made by such Act, or any similar State law.
Re: GitHub sued for aiding hacking in Capital One breach
#18> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…
Github isn’t anywhere near a startup. It is a big division of Microsoft.
It's not about this case, it's about the precedent
Re: GitHub sued for aiding hacking in Capital One breach
#19‘The lawsuit also makes a bold claim that "GitHub actively encourages (at least) friendly hacking." It then links to a GitHub repository named "Awesome Hacking.”[0]’ Oh brother. [0] https://github.com/Hack-with-Github/Awesome-Hacking
"A collection of awesome lists for hackers, pentesters & security researchers."
They are not using "hacker" in the "Hacker News" sense of the word, they are using meaning breaking into some system. So no "oh brother" moment here.
Re: GitHub sued for aiding hacking in Capital One breach
#20Barriers to posting SSN-like data would make it difficult for a lot of people to do their job. Software that handles SSN info should have fake data for tests.
Also SSN isn’t that distinctive of a format. nnn nn nnnn. Check bits and reserved prefixes were all removed decades ago when it became clear we’d run out unless we use the whole name space (and even then that buys us to 2100). \d{3}\s?\d{2}\s?\d{4} will match a surprising amount. Detecting SSNs is hard without accepting a high false positive rate. Much harder than phone numbers, credit card numbers, or cloud credenti…
\w\d{3}[\s\-]?\d{2}[\s\-]?\d{4}\w should not have many wrong results.
You can also try to guess is something is a list of SSNs from the context.