Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What does GitHub's security team even do?

orchidfiles.com

Post reply on HN
Print view View original

11–20 of 36 posts

Re: What does GitHub's security team even do?

#11

Post by mschuster91 »

> Why did they stop and take no further action?

Simple: further action was not requested in the Jira ticket, and what is not in a Jira ticket is not getting done because the team responsible for doing the needful is already overloaded with other crap.

Or maybe because the higher-up whose authorization is needed to go on a few days worth of deep dive other than doing exactly what is asked and accounted for in tickets doesn't have the time for a few minutes to explain to them why it is needed, or the higher-up needs authorization from finance or legal first.

Obvious /s, but I wouldn't be surprised at all if this is exactly what happened. If I were to guess, the "legal" is my biggest suspicion - if a provider reacts on notice of illegal/harmful content, they're just fulfilling legal obligations. But if they go and actively wade through the archives to find more incriminating content, that might be construed as Github doing active moderation of their own, leading to a loss of pure content hoster legal protections.

Re: What does GitHub's security team even do?

#12

Post by woodruffw »

jmward01 wrote: post #10

This is like US healthcare. Almost nobody in US healthcare starts of evil. Almost none of the processes start with a clear evil intent. The problem is that the only real reward is money so the processes and people that generate money stay while the processes and people that merely made things better, but didn't increase revenue, slowly fade away. Does GH get money for taking these actions? Do they have any monetary i…

> PyPi and similar package managers should start publishing security warnings about the hosts of projects. That in turn can eventually lead to bans of packages from generally insecure places. Maybe if we start seeing 'WARNING: projects from github.com may contain malware!' after doing pip install XXX MS will start listening.

PyPI goes out of its way to not be an arbiter of package quality or security. PyPI really doesn't want people assuming those things based on presence, since it's (1) an open index, and (2) the resources needed to make those kinds of determinations at PyPI's scale are several orders of magnitude greater than what PyPI actually has access to.

(This is different from PyPI removing malware based on user reports, which does happen. But that's a reactive task and not one that comes with any sort of blanket guarantee.)

Re: What does GitHub's security team even do?

#13

Post by jmward01 »

woodruffw wrote: post #12
jmward01 wrote: post #10

This is like US healthcare. Almost nobody in US healthcare starts of evil. Almost none of the processes start with a clear evil intent. The problem is that the only real reward is money so the processes and people that generate money stay while the processes and people that merely made things better, but didn't increase revenue, slowly fade away. Does GH get money for taking these actions? Do they have any monetary i…

> PyPi and similar package managers should start publishing security warnings about the hosts of projects. That in turn can eventually lead to bans of packages from generally insecure places. Maybe if we start seeing 'WARNING: projects from github.com may contain malware!' after doing pip install XXX MS will start listening. PyPI goes out of its way to not be an arbiter of package quality or security. PyPI really doe…

Agreed. It is a hard job. Decisions like this make sense but likely need to be reevaluated regularly based on how the world is changing.

Re: What does GitHub's security team even do?

#15

Post by lithos »

nickphx wrote: post #5

"security" is a cost-center, it does not generate revenue. Incidents from lack of "security" need to have a greater impact on revenue before the typical corporate entity spends money.

Exec Bonuses being able to be clawed back for Security issues is just about the only fix that will have real effects. Anything else will have MBAs believing it's a "next guy" problem, and a obstacle to hitting their objectives.

Though right now the US thinks it's winning the Security Vulnerability Stockpile war, so it won't change the state quo.

Re: What does GitHub's security team even do?

#16

Post by lenerdenator »

lithos wrote: post #15
nickphx wrote: post #5

"security" is a cost-center, it does not generate revenue. Incidents from lack of "security" need to have a greater impact on revenue before the typical corporate entity spends money.

Exec Bonuses being able to be clawed back for Security issues is just about the only fix that will have real effects. Anything else will have MBAs believing it's a "next guy" problem, and a obstacle to hitting their objectives. Though right now the US thinks it's winning the Security Vulnerability Stockpile war, so it won't change the state quo.

And how do you enact exec bonuses being clawed back? They're often the most connected people in the company to those setting the rules of the company, the board.

Hell, some companies have a CEO that has an absolute majority of voting power, meaning they cannot be held accountable and made to implement changes like the one you suggest.

Re: What does GitHub's security team even do?

#17

Post by vemv »

ofjcihen wrote: post #6

So far this year 40% of my contracts have been a recovery from a Shai Hulud like attack. That’s in the area of 750k profit and more spent by the companies. The instability and security issues that come of relying on the software supply chain has been pointed out for around 30 years. Seriously, go look. Multiple articles have pointed out the problems we’re seeing. I used to ask the same question on behalf of clients b…

Hi ofjcihen, where can I learn more about your professional services?

Re: What does GitHub's security team even do?

#18

Post by NegativeK »

lithos wrote: post #15
nickphx wrote: post #5

"security" is a cost-center, it does not generate revenue. Incidents from lack of "security" need to have a greater impact on revenue before the typical corporate entity spends money.

Exec Bonuses being able to be clawed back for Security issues is just about the only fix that will have real effects. Anything else will have MBAs believing it's a "next guy" problem, and a obstacle to hitting their objectives. Though right now the US thinks it's winning the Security Vulnerability Stockpile war, so it won't change the state quo.

Europe is implementing a law that requires software made for profit to hit at least industry security standards. Punishments include the purchaser being able to sue the seller as well as jail time for execs.

At some point, we need to push back against the reality in the US that we have effectively no way to stop mass harvesting (and then breaching) of our PII -- and there's basically zero downside to companies when it happens.

Re: What does GitHub's security team even do?

#20

Post by Fr0styMatt88 »

woodruffw wrote: post #3

GitHub's response time on malicious repositories is often lackluster. However, from conversations with folks at GitHub, my suspicion is that this is because they're being starved for resources, not incompetency or maliciousness. This (IMO) points to a perverse reality: things need to get worse before they can get better. In other words, Microsoft probably needs to feel more pain (in the form of negative revenue press…

Reminds me of when Windows security problems hit critical mass in the early-2000s and Microsoft went all-in on addressing it (this started in the XP days IIRC).
Post reply on HN