Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub sued for aiding hacking in Capital One breach

zdnet.com

Post reply on HN
Print view View original

51–60 of 104 posts

Re: GitHub sued for aiding hacking in Capital One breach

#51

Post by dahfizz »

ForHackernews wrote: post #8
noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

> As someone who thinks the world will be a far better place if we had decentralized dumb platforms Then you should be very much in favour of assigning expensive liability to companies running these centralized platforms. If it becomes extremely expensive or legally risky to maintain a big centralized database, that opens a window for free, open source federated protocols to fill that gap. Consider: You can sue Megau…

Legally, what's the difference between all the distributed, load balanced servers running a "centralized" database and the computers which host the same data in a "distributed" platform?

This doesn't solve the problem. If anything, it amplifies it. We have to either protect platforms or hold platforms liable, but making everyone a platform doesn't help much.

Re: GitHub sued for aiding hacking in Capital One breach

#52

Post by dahfizz »

ForHackernews wrote: post #49
twunde wrote: post #15

Earlier quoted context omitted.

Ah, but you can sue anyone using BitTorrent the protocol and sue the creators of the protocol

Yeah, good luck with that. If you're lucky, you'll win a judgement for both the defendant's Playstation and his Xbox. I'm sure white shoe law firms will be beating down your door to represent you in that suit.

So breaking the law is only bad if you have lots of money?

People don't care about principles anymore. Everything is a special case and you have no concern for precedent.

Re: GitHub sued for aiding hacking in Capital One breach

#53

Post by giancarlostoro »

ben509 wrote: post #41
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Any automated detection scheme can be thwarted by encryption as trivial as ROT13. You could leave a comment in README: "To decrypt, just run 'l33t-xor-crypt --key bob --file hacked-data.txt'" and Github's scanner is none the wiser. Meanwhile, it will be finding all the false positives already mentioned, especially test suites with fake data.

Hell in Python its:

>>> import codecs

>>> codecs.encode('foobar', 'rot_13')

'sbbone'

Re: GitHub sued for aiding hacking in Capital One breach

#54

Post by mbesto »

noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

> Google, Facebook and Amazon

GitHub is Microsoft, which oddly enough has a larger market cap than all of those you listed.

Re: GitHub sued for aiding hacking in Capital One breach

#55

Post by ForHackernews »

dahfizz wrote: post #51
ForHackernews wrote: post #8

Earlier quoted context omitted.

> As someone who thinks the world will be a far better place if we had decentralized dumb platforms Then you should be very much in favour of assigning expensive liability to companies running these centralized platforms. If it becomes extremely expensive or legally risky to maintain a big centralized database, that opens a window for free, open source federated protocols to fill that gap. Consider: You can sue Megau…

Legally, what's the difference between all the distributed, load balanced servers running a "centralized" database and the computers which host the same data in a "distributed" platform? This doesn't solve the problem. If anything, it amplifies it. We have to either protect platforms or hold platforms liable, but making everyone a platform doesn't help much.

Are you being facetious? Are you genuinely asking me to explain the difference between SMTP and Facebook.com?

If you make everyone an individual actor, then there is no "platform". Visa can ban a merchant; you can't ban a merchant from the concept of accepting a cash payment.

Re: GitHub sued for aiding hacking in Capital One breach

#56

Post by donarb »

nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

This is a moot point as Capital One and GitHub have both stated that no personal information from the hack was stored on GitHub's servers.

Re: GitHub sued for aiding hacking in Capital One breach

#57

Post by danShumway »

antpls wrote: post #25
nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

In regards to your edit 1, cost benefit analysis isn't just about a company's bottom line, it's also about the types of architecture and services that are allowed to exist online. Github is not the primary way that PII is leaked online, you're thinking of Pastebin.

Should Pastebin be allowed to exist? Should the Open Source developers behind Wordpress and Ghostery be liable for not scrubbing PII off of websites? The "cost" here isn't really money, it's a social cost. It's regular people's access to services that, on net, make their lives much better.

I'm not worried about Microsoft making less money, I'm worried about damaging one of the best software repository services online and making it less useful to ordinary developers.

In regards to your edit 2, Github is a collection of software repositories. Say you replace all social security numbers with . If I'm a screen scraper, that doesn't block me -- I can just clone the repository. There is no way that Github can block this unless they delete or replace the numbers in the actual uploaded code, which would obviously be a bad idea.

In regards to your edit 3, are you planning on linking Github repositories to real-life identities? Probably not, since that would be a huge privacy problem, and you're trying to improve privacy.

So what happens when ownership transfers? Or when someone makes an innocuous repo and then later on pushes PII? Note that this is not an abstract problem, we've seen multiple malware attacks on packages, browser extensions, and phone apps that boiled down to, "it looked safe, and then somebody stole the credentials or just decided to push malicious code."

I don't understand how a review process would help here unless it was a review process on literally every commit.

Re: GitHub sued for aiding hacking in Capital One breach

#58

Post by joejerryronnie »

A4ET8a8uTh0 wrote: post #23
ryanmarsh wrote: post #21

Earlier quoted context omitted.

There’s a giant wave of political support for this. Right now people are talking on the tv about 8chan and mass shooters. GitHub is being sued for content. The end result will be a (horrifying) market solution m. Site owners will have no choice but to pay outside companies to analyze content for them and auto delete. This will probably end up throwing the baby out with the bath water.

Agreed. I will add that it is both sides of the political spectrum in US seem to push for it though for different reasons.I am annoyed at how many conversations I had with people who think it is not only good, but necessary.

It is the beginning of the end, my friends. Mass governmental censorship to begin in 3...2...1...

Re: GitHub sued for aiding hacking in Capital One breach

#59

Post by [deleted] »

noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

[deleted]
Post reply on HN