Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub waited 3 months to notify about potential compromise

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 83 posts

Re: GitHub waited 3 months to notify about potential compromise

#31

Post by kenbolton »

In the same minute that I learned GitHub had been acquired by Microsoft, I cancelled my pro subscription and began moving my critical repositories elsewhere. I'm old enough to remember the MS that tried to choke the life out of GNU/Linux and spread FUD about all FLOSS, the one that engaged in anti-competetive behavior during the "Browser Wars". I'm not suggesting that this blunder of a delay is related to the Microsoft acquisition, but the abusive "Look at me, I'm changing" spiel never cut any mustard with me.

Vote at the ballot box and with your dollars. Do not reward executives, lawyers, or engineers who dissemble or obfuscate.

Re: GitHub waited 3 months to notify about potential compromise

#32

Post by smarx007 »

dundarious wrote: post #27
nrmitchi wrote: post #14

Earlier quoted context omitted.

>Each of these tokens are valid for up to 1 hour. > GitHub quickly fixed the issue and established that this bug was recently introduced, existing for approximately 5 days between 2022-02-25 18:28 UTC and 2022-03-02 20:47 UTC. It doesn't sound like there is anything you can or need to do with respect to these tokens (whether they were used to take action with elevated permissions is a different thing, but it doesn't…

It seems like the appropriate thing to do would be to inform anyone who had tokens created during the affected time period, so they could assess if any of the permissions led to undesired changes. Instead of GitHub saying “we don’t have hard proof of anything bad happening” and waiting 3 months, just give the customer the time of relevant token creations.

The email listed the apps that issued tokens in the specified time window. If your notification email listed 0 apps, it means no apps created tokens during the time window in question (I got 1 app listed). I only missed that those tokens had 1h lifetime.

Re: GitHub waited 3 months to notify about potential compromise

#33

Post by [deleted] »

PradeetPatel wrote: post #30
chrisseaton wrote: post #18

Earlier quoted context omitted.

> They literally have no legal requirement to even tell you as much as they did. Is ‘fulfilling legal requirements’ all you look for in a business relationship? A restaurant has no legal requirement to make this food tasty but it’s what I’m looking for when choosing where to go.

As someone who works in the reputation management sector, fulling legal requirements is crucial in establishing a presence in key markets. However, oversharing of internal information that's not required by legal requirements can lead to unnecessary reputation damage, which would lead to a decrease in value for key stakeholders. I think many engineers often overlook the business implication of disclosing security iss…

[deleted]

Re: GitHub waited 3 months to notify about potential compromise

#34

Post by wahnfrieden »

kenbolton wrote: post #31

In the same minute that I learned GitHub had been acquired by Microsoft, I cancelled my pro subscription and began moving my critical repositories elsewhere. I'm old enough to remember the MS that tried to choke the life out of GNU/Linux and spread FUD about all FLOSS, the one that engaged in anti-competetive behavior during the "Browser Wars". I'm not suggesting that this blunder of a delay is related to the Microso…

That’s a pretty neoliberal attitude to effecting systemic change, do you think that’s enough to mitigate those behaviors considering they crop up elsewhere and ongoing

Re: GitHub waited 3 months to notify about potential compromise

#35

Post by splch »

kenbolton wrote: post #31

In the same minute that I learned GitHub had been acquired by Microsoft, I cancelled my pro subscription and began moving my critical repositories elsewhere. I'm old enough to remember the MS that tried to choke the life out of GNU/Linux and spread FUD about all FLOSS, the one that engaged in anti-competetive behavior during the "Browser Wars". I'm not suggesting that this blunder of a delay is related to the Microso…

What are you using now? I've only heard of GNU Savannah.

Re: GitHub waited 3 months to notify about potential compromise

#36

Post by slondr »

splch wrote: post #35
kenbolton wrote: post #31

In the same minute that I learned GitHub had been acquired by Microsoft, I cancelled my pro subscription and began moving my critical repositories elsewhere. I'm old enough to remember the MS that tried to choke the life out of GNU/Linux and spread FUD about all FLOSS, the one that engaged in anti-competetive behavior during the "Browser Wars". I'm not suggesting that this blunder of a delay is related to the Microso…

What are you using now? I've only heard of GNU Savannah.

try gitlab or sourcehut

Re: GitHub waited 3 months to notify about potential compromise

#37

Post by captn3m0 »

_7gt4 wrote: post #6

My recent experience with GitHub regarding a security issue was not very positive either.[1] It turned out, unlike two vendors I notified that were affected, they just didn't care. And they didn't bother to even tell me that they didn't care. It's a very edge-case issue in Enterprise SSO, so I wasn't really able to generate any blowback with disclosure either. But if you find an org with just the right setup it blows…

How is tailscale mitigating this? They can’t enforce GitHub SAML at their end, right?

Re: GitHub waited 3 months to notify about potential compromise

#38

Post by gjs278 »

zwass wrote: post #9
lambada wrote: post #3

Given it existed for 5 days and you’re only now finding out about it, it sounds to me like it was perhaps a bug that was fixed without realising the full impact of it, or perhaps without realising it made it to production; and only an audit that happened later caught it. Not ideal by any means. I’d be curious to know if my theory is correct or not.

Their statements indicate they were aware and investigating. My frustration is that they didn't give users the opportunity to do their own timely investigation. > GitHub learned via a customer support ticket that GitHub Apps were able to generate scoped installation tokens with elevated permissions. Each of these tokens are valid for up to 1 hour. > GitHub quickly fixed the issue and established that this bug was rec…

No post body was provided.

Re: GitHub waited 3 months to notify about potential compromise

#39

Post by naikrovek »

kenbolton wrote: post #31

In the same minute that I learned GitHub had been acquired by Microsoft, I cancelled my pro subscription and began moving my critical repositories elsewhere. I'm old enough to remember the MS that tried to choke the life out of GNU/Linux and spread FUD about all FLOSS, the one that engaged in anti-competetive behavior during the "Browser Wars". I'm not suggesting that this blunder of a delay is related to the Microso…

memory of that stuff is just never ever going to die, is it?

yet the same people use google, and facebook, and AWS, like those companies sit upon moral high ground. they do not.

Linux succeeded and defeated Microsoft in every single way that matters to open source people, and the response is to continue to hate Microsoft for their loss? I do not understand.

Just admit your motivation for saying things like this: you hate Microsoft because Slashdot told you to, or tells you to, and you want to let people know about that, unprompted. Nothing about Microsoft's behavior in the 1990s has any bearing on what GitHub does today.

Re: GitHub waited 3 months to notify about potential compromise

#40

Post by bastardoperator »

smarx007 wrote: post #10

I just got it as well and don't understand what I can do. Can I somehow force all generated tokens to be revoked and get apps to generate new tokens to be on the safe side? Or, rather, is there a way to do this without uninstalling the apps and installing them again?

You could revoke the pem that generated these tokens, but as others have pointed out the tokens in question are only valid for 60 minutes at maximum.
Post reply on HN