GitHub censored my research data • Hacker News Board

Re: GitHub censored my research data

#151

Post by kevin_thibedeau » Sat, Oct 15, 2016, 2:05 PM UTC

Fej wrote: post #102

PuffinBlue wrote: post #74

Earlier quoted context omitted.

Couldn't agree more. I'm not sure if GL is trying to protect themselves against something and are making up some excuse to justify it but the reasons given for taken down the list don't hold water. GL would be far better stating the real reason for taking the info down (surely there must be one). So far what they've done is seemingly to protect the merchants reputation and perhaps protect GL from some imagined legal…

The real reason is almost certainly something along the lines of 'it's possible we could get sued for libel' or 'we have been threatened with a libel suit'. Not that such a case would ever go anywhere, but I imagine they figure that it's more trouble than it's worth.

They have safe harbor protection.

Re: GitHub censored my research data

#152

Post by kevin_thibedeau » Sat, Oct 15, 2016, 2:07 PM UTC

notatoad wrote: post #11

anondon wrote: post #7

How exactly does publishing a list of malware-infected stores fall under the DMCA? I always thought DMCA was meant to be for copyright infringement cases. I didn't see the list, but did it by any chance contain the logos of the online stores? If it did, the DMCA notices make sense.

it falls under the DMCA because the DMCA mandates a takedown-first and check the validity later workflow. To be in compliance, a site must respond to any DMCA takedown notice as quickly as reasonably possible, regardless of how fraudulent it might be. As long as you're okay being found guilty of perjury by a US court, or have no plans to enter a US jurisdiction in the near future, you can get any content you want tak…

DMCA is a copyright law. It requires a takedown for alleged copyright violation. That doesn't apply here. The stores don't have copyright over their domain names on a list.

Re: GitHub censored my research data

#153

Post by jrochkind1 » Sat, Oct 15, 2016, 2:11 PM UTC

r3bl wrote: post #13

Isn't it the whole point of GitLab that it's decentralized? As in, you can roll your own instance and stop worrying about censorship? I'm pretty sure someone here has a GitLab instance that is willing to share for this purpose.

Does the author need a git repo with a web UI, as github/gitlab provide, at all? Or were they just using github.com and gitlab.com as convenient free cloud-hosted publishing platforms?

Re: GitHub censored my research data

#154

Post by ythl » Sat, Oct 15, 2016, 2:13 PM UTC

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

I don't even believe that. One or more merchants on that list threatened you with legal action so you took it down.

Even if your cover story is true, you are basically throwing users and banks under the bus to help merchants with dirty card readers continue business as usual. Meanwhile users will continue to be defrauded, and banks will have to take the hit when users complain about charges they didn't make.

Re: GitHub censored my research data

#155

Post by ythl » Sat, Oct 15, 2016, 2:16 PM UTC

0xmohit wrote: post #34

Would be fun to see if the list is censored on Google docs.

You should host the list and post a high visibility link (i.e. news article). You'll probably discover real quick the pressures that caused GitHub and GitLab to buckle so quickly.

Re: GitHub censored my research data

#156

Post by jjnoakes » Sat, Oct 15, 2016, 2:19 PM UTC

pmontra wrote: post #19

r3bl wrote: post #13

Isn't it the whole point of GitLab that it's decentralized? As in, you can roll your own instance and stop worrying about censorship? I'm pretty sure someone here has a GitLab instance that is willing to share for this purpose.

And get DDoSed by the malware guys who don't want their victims know they are in the list and fix their site. It would be an altruistic offer but I would think twice about it. However it's a problem and we need a solution. A torrent? Yes but Google won't index it. A file on S3 wouldn't work because they could just download it as many times as needed to make the bill skyrocket. Better than a DCMA. Anything that is una…

IPFS?

Re: GitHub censored my research data

#157

Post by mrswag » Sat, Oct 15, 2016, 2:37 PM UTC

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

This censorship show that you don't even begin to understand the problem.

This list could prevent people from getting their card skimmed, and you take it down.

I'm moving away from gitlab.

Re: GitHub censored my research data

#158

Post by gruez » Sat, Oct 15, 2016, 2:43 PM UTC

gravypod wrote: post #146

PuffinBlue wrote: post #140

Earlier quoted context omitted.

What services are you referring to please?

Make a torrent?

Can't be easily updated

Re: GitHub censored my research data

#159

Post by sqldba » Sat, Oct 15, 2016, 2:54 PM UTC

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

You've completely screwed up.

Re: GitHub censored my research data

#160

Post by sqldba » Sat, Oct 15, 2016, 2:55 PM UTC

Singletoned wrote: post #109

eridius wrote: post #63

Earlier quoted context omitted.

This is completely unacceptable. You're treating this as though the author was publishing a list of vulnerabilities about sites. That's not what the author did. The author published a list of sites that are already infected with malware and thus are dangerous for users to visit. This is a public service and there is zero expectation of "responsible disclosure" to the sites. The only thing that disclosing to the sites…

I agree. GitLab's reputation has taken a pretty big hit in my opinion. I kind of expected GitHub's reaction, but had hoped for something better from GitLab (if nothing else, just to differentiate themselves from their opposition).

Definitely stuffed my opinion of them. I thought they were for the people and made good decisions.

Nope - corporate suits - and they give us a response which doesn't even make logical sense. Do they think we're idiots?