Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub waited 3 months to notify about potential compromise

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 83 posts

Re: GitHub waited 3 months to notify about potential compromise

#61

Post by Doxin »

chrisseaton wrote: post #18
cypherg wrote: post #11

They explained it themselves - there's no evidence of abuse/exploitation. They literally have no legal requirement to even tell you as much as they did. You should be commending them for filling you in at all.

> They literally have no legal requirement to even tell you as much as they did. Is ‘fulfilling legal requirements’ all you look for in a business relationship? A restaurant has no legal requirement to make this food tasty but it’s what I’m looking for when choosing where to go.

> A restaurant has no legal requirement to make this food tasty

Somewhat tangential but I'm not even sure that's entirely true. It gets all sorts of tricky due to the subjectivity, but surely fit-for-purpose laws apply here? I'd be really surprised if a five star restaurant selling $500 tasteless gruel with chunks wouldn't manage to get into trouble if they refused refunds.

Re: GitHub waited 3 months to notify about potential compromise

#62

Post by philwelch »

cypherg wrote: post #11

They explained it themselves - there's no evidence of abuse/exploitation. They literally have no legal requirement to even tell you as much as they did. You should be commending them for filling you in at all.

They’re obviously capable of doing more, and they’re in a competitive market, so I wholeheartedly support the freedom of dissatisfied customers to publicly shame them. Either they will learn from this and do better in future, or the community will enrich their competitors at Microsoft’s expense. And that is how we can have nice things rather than the mere minimum that our corporate overlords are “legally required” to provide us with!

Re: GitHub waited 3 months to notify about potential compromise

#63

Post by zx8080 »

Doxin wrote: post #61
chrisseaton wrote: post #18

Earlier quoted context omitted.

> They literally have no legal requirement to even tell you as much as they did. Is ‘fulfilling legal requirements’ all you look for in a business relationship? A restaurant has no legal requirement to make this food tasty but it’s what I’m looking for when choosing where to go.

> A restaurant has no legal requirement to make this food tasty Somewhat tangential but I'm not even sure that's entirely true. It gets all sorts of tricky due to the subjectivity, but surely fit-for-purpose laws apply here? I'd be really surprised if a five star restaurant selling $500 tasteless gruel with chunks wouldn't manage to get into trouble if they refused refunds.

Dishes similar to described ones could be served in the top "Scandinavian food movement" restaurants [1].

[1] - https://www.nbcnews.com/news/world/ants-cod-liver-moss-denma...

Re: GitHub waited 3 months to notify about potential compromise

#64

Post by supermatt »

riffraff wrote: post #53
naikrovek wrote: post #39

Earlier quoted context omitted.

memory of that stuff is just never ever going to die, is it? yet the same people use google, and facebook, and AWS, like those companies sit upon moral high ground. they do not. Linux succeeded and defeated Microsoft in every single way that matters to open source people, and the response is to continue to hate Microsoft for their loss? I do not understand. Just admit your motivation for saying things like this: you…

> Linux succeeded and defeated Microsoft in every single way that matters to open source people I don't know, hardware still regularly does not support Linux, the Linux desktop has a risible fraction of the world's user base, popular apps still only exist for winmac. It won on the server, sure, but that's hardly every single way that matters, at least from what I remember as an open source user in the '00s.

About 80% of the smartphone market too..

Re: GitHub waited 3 months to notify about potential compromise

#65

Post by cxr »

remram wrote: post #49
cxr wrote: post #47

Earlier quoted context omitted.

> Linux succeeded and defeated Microsoft in every single way that matters to open source people So when someone gets a job where they're required to use Windows and spend all day in IE11 and Microsoft Office, let's say at a very large semiconductor company, they're hallucinating?

The fact that there exists people who don't get to use X is not proof that X is not the most common, or that they are hallucinating.

I think I got whiplash from this episode of HNers Moving the Goalposts.

Re: GitHub waited 3 months to notify about potential compromise

#66

Post by dundarious »

smarx007 wrote: post #32
dundarious wrote: post #27

Earlier quoted context omitted.

It seems like the appropriate thing to do would be to inform anyone who had tokens created during the affected time period, so they could assess if any of the permissions led to undesired changes. Instead of GitHub saying “we don’t have hard proof of anything bad happening” and waiting 3 months, just give the customer the time of relevant token creations.

The email listed the apps that issued tokens in the specified time window. If your notification email listed 0 apps, it means no apps created tokens during the time window in question (I got 1 app listed). I only missed that those tokens had 1h lifetime.

Listing token times instead of just apps, and doing so nearer the actual time instead of 3 months later, are the key parts of my suggestion.

Re: GitHub waited 3 months to notify about potential compromise

#67

Post by pastacacioepepe »

PradeetPatel wrote: post #30
chrisseaton wrote: post #18

Earlier quoted context omitted.

> They literally have no legal requirement to even tell you as much as they did. Is ‘fulfilling legal requirements’ all you look for in a business relationship? A restaurant has no legal requirement to make this food tasty but it’s what I’m looking for when choosing where to go.

As someone who works in the reputation management sector, fulling legal requirements is crucial in establishing a presence in key markets. However, oversharing of internal information that's not required by legal requirements can lead to unnecessary reputation damage, which would lead to a decrease in value for key stakeholders. I think many engineers often overlook the business implication of disclosing security iss…

> which would lead to a decrease in value for key stakeholders.

I couldn't care less. I want value as a customer. Any company that prioritizes stockholders to customers doesn't deserve my customer money.

Re: GitHub waited 3 months to notify about potential compromise

#68

Post by remram »

cxr wrote: post #65
remram wrote: post #49

Earlier quoted context omitted.

The fact that there exists people who don't get to use X is not proof that X is not the most common, or that they are hallucinating.

I think I got whiplash from this episode of HNers Moving the Goalposts.

Yet you moved the goal post from "Linux defeated Microsoft in open source" to "there isn't anyone using Windows at all". Or are we all hallucinating your comment?

Re: GitHub waited 3 months to notify about potential compromise

#69

Post by cxr »

remram wrote: post #68
cxr wrote: post #65

Earlier quoted context omitted.

I think I got whiplash from this episode of HNers Moving the Goalposts.

Yet you moved the goal post from "Linux defeated Microsoft in open source" to "there isn't anyone using Windows at all". Or are we all hallucinating your comment?

Try undertaking to recognize the actual premises of ∀x-style statements and ∃x-style statements that you encounter in the wild, scooter.

The goalpost was set at "Linux succeeded and defeated Microsoft in every single way that matters to open source people". Ignore the record of what was actually claimed if you want (the quotes you're throwing around are works of your imagination), but that is not merely a claim that either Windows or Linux is "the most common".

The observation that that there exists some X where P does not hold is precisely the way to counter a claim that for all X, P is true.

Re: GitHub waited 3 months to notify about potential compromise

#70

Post by remram »

cxr wrote: post #69
remram wrote: post #68

Earlier quoted context omitted.

Yet you moved the goal post from "Linux defeated Microsoft in open source" to "there isn't anyone using Windows at all". Or are we all hallucinating your comment?

Try undertaking to recognize the actual premises of ∀x-style statements and ∃x-style statements that you encounter in the wild, scooter. The goalpost was set at "Linux succeeded and defeated Microsoft in every single way that matters to open source people". Ignore the record of what was actually claimed if you want (the quotes you're throwing around are works of your imagination), but that is not merely a claim that…

First let me say that talking with you is really annoying, way worse than anyone else I've interacted with on this site. Removing the "must be hallucinating", "try undertaking to recognize", "scooter" would turn your comment more into thoughtful discourse than sneer (you might want to check out the HN guidelines). I am trying to politely argue, pointed out that your comment didn't make sense to me hoping for a clarification, and got shit on, twice. Nice.

To attempt to answer you (I might regret this): what did you take "every single way that matters to open source people" to mean? By gazing through your insults into your comment, trying to find the "∀x statement" you think you saw, I have to assume that you think that means "every one developing open source code isn't using Microsoft?" Is your made-up acquaintance working at a semiconductor company primarily developing open source software there (rather than, say, semiconductors)?

Is the "∀x statement" about "x: way that matter"? Am I to take "non-free software is being used for making semiconductor at a large company" as an example of something that should matter to open source people?

You seem so convinced that there is a logic statement written right there with quantifiers and everything that you don't hesitate to use ridicule on complete strangers and question their grasp of logic. It's funny but couldn't really count as an argument (assuming you were trying to argue rather than just get some bile out).

Post reply on HN