Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you’re trying to hack/deface a website, don’t submit a pull request

github.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#31

Post by Ozark »

Achshar wrote: post #15

What is happening here? I am not very accustomed to open source yet. Edit: un-checking "show inline notes" helps. Edit 2: So if I understand correctly, OP tried to hack into a website... by submitting code to github. I was confused at first because that would have been (very) wrong way to "hack", but as it turns out, that is indeed true. And rest is about the code he/she used. It seems to be auto generated in some wy…

I had no idea what was going on either until I read the un-checking "show inline notes" thank you

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#32

Post by schrodinger »

mastofact wrote: post #11
judofyr wrote: post #6

God, I'm so tired of animated GIFs in GitHub comment threads. The code critique is far more amusing to me.

I'm more shocked that they even allow images to be embedded in comments.

You guys are a bunch of cranky pants

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#33

Post by EthanHeilman »

Xylakant wrote: post #26

This attempt is blatant and obvious, but what about a more serious attempt where you first establish some credibility with a couple of "good" PR that fix major problems and then add a tiny little backdoor that loads code from somewhere else. Distribute the relevant code over a couple of commits and you might just slip it in. With Githubs ease of merging and automatted testing by Travis, it's easy to forget that chang…

Why not just find an exploit in the code.

Spending months building trust while creating a giant trail of information that can be used to find you and then really pissing off the open-source community seems like a bad plan for someone that is attempting to quietly gain root. Might work if one project is attempting to discredit another project (think closed source vendor trying to steal clients who use opensourced github projects).

I'm not saying someone wont do it, I suspect it has been done a few times, but it is a dumb way to break into computers and far more work/risk than downloading metasploit and using a public exploit.

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#36

Post by AimHere »

Hilarious.

But if I ever need a jury of my peers to audit my coding style to see how good it is, now I know what to do - a pretend-attempted-defacement is bound to be more effective than finding some place on the net to ask 'Is this proper idiomatic javascript?'.

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#37

Post by zbowling »

bratsche wrote: post #16
raimondious wrote: post #12

Earlier quoted context omitted.

Allow? They just released a feature that lets you drag and drop images into comments — it automatically uploads to s3 and inserts the URL in your comment. For some reason, they encourage it.

I assumed that was because of changes in Skitch. Everyone I know used to take screenshots with Skitch, upload them and Skitch would copy the URL into your clipboard and you could post into Github. But since Evernote bought them they closed things down and they're basically useless now, so I figured that was why Github was motivated to add this feature.

I know that so much. Skitch is so crippled now. It was my favorite fast and simple "here let me point it out and show you" tool for everything. I annotated everything with it. With evernote killing the ease of "let me show" half, whats the point of annotating things and taking screen shots?

If there was ever an opportunity for a disruptive simple startup idea it would be to replicate what skitch did before evernote bought it and broke the original use case.

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#38

Post by mwill »

ot wrote: post #20

Please GitHub, implement the evil bit [1] on pull requests so we can filter out defacing attempts when merging. [1] http://en.wikipedia.org/wiki/Evil_bit

OT: I think everyone has made the Evil Bit/DNT header connection at some point, but it seems especially funny/snarky being tacked on without any further note in the See Also section of the Evil Bit entry. It's not often I get a laugh out of non-content stuff on Wikipedia : )

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#39

Post by Xylakant »

EthanHeilman wrote: post #33
Xylakant wrote: post #26

This attempt is blatant and obvious, but what about a more serious attempt where you first establish some credibility with a couple of "good" PR that fix major problems and then add a tiny little backdoor that loads code from somewhere else. Distribute the relevant code over a couple of commits and you might just slip it in. With Githubs ease of merging and automatted testing by Travis, it's easy to forget that chang…

Why not just find an exploit in the code. Spending months building trust while creating a giant trail of information that can be used to find you and then really pissing off the open-source community seems like a bad plan for someone that is attempting to quietly gain root. Might work if one project is attempting to discredit another project (think closed source vendor trying to steal clients who use opensourced gith…

Because it works even if you can't find a proper codepath to exploit. It might gain you anything you want: A quiet path to leak admin account info to a server of your choice. An attack vector into a system trusted by more than one person.

You don't need to provide much information to get a github account, so the risk is not very much elevated.

Post reply on HN