Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anyone can access deleted and private repository data on GitHub

trufflesecurity.com

Post reply on HN
Print view View original

181–190 of 394 posts

Re: Anyone can access deleted and private repository data on GitHub

#181

Post by TheDong »

cyrnel wrote: post #69
liendolucas wrote: post #25

Earlier quoted context omitted.

Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…

Security disclosures are like giving someone an unsolicited gift. The receiver is obligated to return the favor. But if you buy someone non-refundable tickets to a concert they already have tickets for, you aren't owed compensation.

Security disclosures are like telling someone they have a spot on their face. It's not always welcome, and there's no obligation on anyone to do so, nor anyone to return the favor.

In this case, the spot turned out to be a freckle, which everyone involved already knew was a freckle (since it was documented), and if anyone owes anyone anything, it's the researcher that owes github for wasting their time.

Re: Anyone can access deleted and private repository data on GitHub

#182

Post by majorchord »

riedel wrote: post #149
madewulf wrote: post #108

In fact, there is a process to request complete removal of data, but it involves sending an email that will be reviewed by github staff: https://docs.github.com/en/site-policy/content-removal-polic... On the other hand, once an API key or password has been published somewhere, you should rotate it anyway.

I was wondering, how they can otherwise comply with legislation. Makes sense there is a way to do this e.g. in case of valid GDPR, DMCA, etc. cases.

Github's own DMCA reporting repo has warez in it from deleted PRs you can still access with the original link. Been that way for years

Re: Anyone can access deleted and private repository data on GitHub

#183

Post by mkl »

JohnMakin wrote: post #95
keybored wrote: post #90

People are so preoccupied with putting the code on GitHub. It’s like it doesn’t exist before it’s on GitHub. If you’re not gonna share it then it hardly matters. Use a backup drive. Git is distributed. You don’t have to put your dotfiles on GitHub. Local is enough.

Your laptop breaks in a way that your disk cannot be recovered. Now what? How often are you backing up your disk? Probably much easier to type "git commit" and "git push"

It's much easier to use an automated backup system/service than to manually run commands.

Re: Anyone can access deleted and private repository data on GitHub

#184

Post by fmeyer »

I reported a similar and even more damaging I my opinion (https://hackerone.com/reports/2240374) and they also dismissed as by design.

Turns out I found out you could even invite external collaborators into your fork and totally bypass enforced SSO.

Even if you block forking into your main repo, the existing forks remains active and still can pull from upstream.

It feels like if you need proper security, you have to go with enterprise

Re: Anyone can access deleted and private repository data on GitHub

#185

Post by Waterluvian »

majorchord wrote: post #173
TazeTSchnitzel wrote: post #3

This is not new. Many people have noticed this before, e.g. https://hikari.noyu.me/blog/2020-05-05-github-private-repos-...

No but I think attention should still be raised to it in the hopes they will fix it. The squeaky wheel gets the grease. https://xkcd.com/1053

I love this xkcd.

We all need to embrace: Nobody has ever been impressed that you already knew something. When people share a discovery with you, it’s not about you. It’s about them and their joy of discovery. They want to share that joy with you.

Re: Anyone can access deleted and private repository data on GitHub

#186

Post by _heimdall »

tedivm wrote: post #8
andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

I reported a different security issue to github, and they responded the same (although they ultimately ended up fixing it when I told them I was going to blog about the "intended behavior").

Did you end up getting a bug bounty out of it?

Re: Anyone can access deleted and private repository data on GitHub

#187

Post by scosman »

I maintain a pretty popular template for SaaS websites. Every few weeks someone would send a PR with all their private fork data, then quickly try to delete it.

Making it a "template" repo mostly fixed the issue. That creates a copy instead of a fork. However it still happens from time to time.

Re: Anyone can access deleted and private repository data on GitHub

#188

Post by [deleted] »

berdario wrote: post #109
madeofpalk wrote: post #101

Earlier quoted context omitted.

The point of a bug bounty is for companies to find new security problems. If the (class of) problem is already known, it’s not worth rewarding.

I can see this argument making a bit of sense, but if they documented this 3 years after the issue was reported, they don't have a way to demonstrate that they truly already knew. At the end it boils down to: is Github being honest and fair in answering the bug bounty reports? If you think it is, cool. If you don't, maybe it's not worth playing ball with Github's bug bounty process

[deleted]

Re: Anyone can access deleted and private repository data on GitHub

#189

Post by sgc »

This walks like a dark pattern and quacks like a dark pattern. People's entire livelihoods are at stake and they don't care. Most likely because plausible deniability and obscure TOS rights of how and when the code is used is more valuable to them than the reputation hit. It is hard to imagine this is very hard to fix.
Post reply on HN