Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub waited 3 months to notify about potential compromise

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: GitHub waited 3 months to notify about potential compromise

#71

Post by hanble »

averysmallbird wrote: post #26
hanble wrote: post #22

Earlier quoted context omitted.

That's true, but feels like these are always judgment calls. We can always armchair quarterback their judgment calls, but none of us have the full info. At least GH is sharing this info, which is a good call for trust building IMO.

That's not fully Github's choice to make. They made a judgement call based on seemingly incomplete evidence, and have different incentives that everyone else. Repository owners may well have a different level of acceptable risk or legal obligations over the integrity of their source code. For example, if I was maintaining security software or a popular package, it would be entirely appropriate to stop everything and…

Fair point - I think that's very fair criticism

Re: GitHub waited 3 months to notify about potential compromise

#72

Post by kenbolton »

naikrovek wrote: post #39
kenbolton wrote: post #31

In the same minute that I learned GitHub had been acquired by Microsoft, I cancelled my pro subscription and began moving my critical repositories elsewhere. I'm old enough to remember the MS that tried to choke the life out of GNU/Linux and spread FUD about all FLOSS, the one that engaged in anti-competetive behavior during the "Browser Wars". I'm not suggesting that this blunder of a delay is related to the Microso…

memory of that stuff is just never ever going to die, is it? yet the same people use google, and facebook, and AWS, like those companies sit upon moral high ground. they do not. Linux succeeded and defeated Microsoft in every single way that matters to open source people, and the response is to continue to hate Microsoft for their loss? I do not understand. Just admit your motivation for saying things like this: you…

No. It won't die. In the same way that memory of the Holocaust won't die (hopefully), or that memory of Putin's invasion of Ukraine won't die (hopefully), or that the memory of the corruption of Donald Trump won't die (hopefully), or the memory of the enslavement of Black human beings in the US won't die (hopefully), or the memory of corrupt policing won't die (hopefully).

“Those who cannot remember the past are condemned to repeat it.” – George Santayana

You have no idea of what tools I or anyone else on here use or don't use. You only know that I use git, which I could be using independently of everything. I could be using git to track my personal thoughts every day and nothing more. I make an effort to source everything I use as ethically as possible, though it is ridiculously difficult in the world of modern technology.

Re: GitHub waited 3 months to notify about potential compromise

#73

Post by naikrovek »

vlunkr wrote: post #43
naikrovek wrote: post #39

Earlier quoted context omitted.

memory of that stuff is just never ever going to die, is it? yet the same people use google, and facebook, and AWS, like those companies sit upon moral high ground. they do not. Linux succeeded and defeated Microsoft in every single way that matters to open source people, and the response is to continue to hate Microsoft for their loss? I do not understand. Just admit your motivation for saying things like this: you…

Seems like you’re being just as hostile in the other direction. If this isn’t the appropriate time to complain about Microsoft, then what is? I can’t speak for everyone, but I continue to not like Microsoft because they don’t make a single piece of software that I like, and they’re ruined the ones I did like.

I am just dead tired of Microsoft getting zero credit for the changes they've made since the antitrust verdict.

they haven't done EVERYTHING that EVERYONE wants, so lots and lots and lots of people still shit on them like they're still mad, and it still gives nerd cred to shit on them for any reason. as if we're perfect in comparison...

if the same people speak poorly of Facebook, Google, or Amazon in the same ways, the reactions observed are very different. Very different.

People pick on Microsoft because they once earned it, yet we let so many worse things slide, today, because those things are done by companies which are not Microsoft.

flippin' pick an opinion, and stick to it.

Re: GitHub waited 3 months to notify about potential compromise

#74

Post by naikrovek »

kenbolton wrote: post #72
naikrovek wrote: post #39

Earlier quoted context omitted.

memory of that stuff is just never ever going to die, is it? yet the same people use google, and facebook, and AWS, like those companies sit upon moral high ground. they do not. Linux succeeded and defeated Microsoft in every single way that matters to open source people, and the response is to continue to hate Microsoft for their loss? I do not understand. Just admit your motivation for saying things like this: you…

No. It won't die. In the same way that memory of the Holocaust won't die (hopefully), or that memory of Putin's invasion of Ukraine won't die (hopefully), or that the memory of the corruption of Donald Trump won't die (hopefully), or the memory of the enslavement of Black human beings in the US won't die (hopefully), or the memory of corrupt policing won't die (hopefully). “Those who cannot remember the past are cond…

Microsoft bundling a browser is not the same as the Holocaust. Not the same magnitude, not the same offense, not the same violation of any moral code, at any magnitude.

No one died because Microsoft included IE with Windows. no one was enslaved because Microsoft included IE with their OS.

that you think these are all events of the same magnitude has completely invalidated your opinion, and placed you firmly in crackpot territory.

Re: GitHub waited 3 months to notify about potential compromise

#75

Post by tatersolid »

supermatt wrote: post #64
riffraff wrote: post #53

Earlier quoted context omitted.

> Linux succeeded and defeated Microsoft in every single way that matters to open source people I don't know, hardware still regularly does not support Linux, the Linux desktop has a risible fraction of the world's user base, popular apps still only exist for winmac. It won on the server, sure, but that's hardly every single way that matters, at least from what I remember as an open source user in the '00s.

About 80% of the smartphone market too..

Android is Linux to about the same degree that Chrome is Windows.

Re: GitHub waited 3 months to notify about potential compromise

#76

Post by wahnfrieden »

epistasis wrote: post #45
wahnfrieden wrote: post #34

Earlier quoted context omitted.

That’s a pretty neoliberal attitude to effecting systemic change, do you think that’s enough to mitigate those behaviors considering they crop up elsewhere and ongoing

If refusing to do business with a company whose business practices you don't like is "neoliberal" then the term has officially been stripped of any meaning, significance, or usefulness.

Thank you for your input but I am not commenting on the decision to stop purchasing. I'm responding specifically to the final demand: "Vote at the ballot box and with your dollars." The OP is encouraging us to take action against this behavior specifically via choosing how they allocate their dollars as consumers (and also voting), which is core to the neoliberal mission. They're not just saying it's worthwhile to stop purchasing, they're saying that this is the solution

Re: GitHub waited 3 months to notify about potential compromise

#77

Post by epistasis »

wahnfrieden wrote: post #76
epistasis wrote: post #45

Earlier quoted context omitted.

If refusing to do business with a company whose business practices you don't like is "neoliberal" then the term has officially been stripped of any meaning, significance, or usefulness.

Thank you for your input but I am not commenting on the decision to stop purchasing. I'm responding specifically to the final demand: "Vote at the ballot box and with your dollars." The OP is encouraging us to take action against this behavior specifically via choosing how they allocate their dollars as consumers (and also voting), which is core to the neoliberal mission. They're not just saying it's worthwhile to st…

"Voting with your dollars" is not only a neoliberal attitude, it's also a liberal attitude, but moreover it is also very common for leftists. Unless you're buying the rope from capitalists to hang them, realizing how power flows in our current economic system is essential for all.

Re: GitHub waited 3 months to notify about potential compromise

#78

Post by wahnfrieden »

epistasis wrote: post #77
wahnfrieden wrote: post #76

Earlier quoted context omitted.

Thank you for your input but I am not commenting on the decision to stop purchasing. I'm responding specifically to the final demand: "Vote at the ballot box and with your dollars." The OP is encouraging us to take action against this behavior specifically via choosing how they allocate their dollars as consumers (and also voting), which is core to the neoliberal mission. They're not just saying it's worthwhile to st…

"Voting with your dollars" is not only a neoliberal attitude, it's also a liberal attitude, but moreover it is also very common for leftists. Unless you're buying the rope from capitalists to hang them, realizing how power flows in our current economic system is essential for all.

Waiting for bad corporate behavior to punish individual actors for individual behaviors with dollars requires such an extreme level of widespread activity that you might as well be talking about something more radical and mass-organized than promoting care over simple purchasing decisions, to be meaningful at a systemic scale. These negative behaviors are a feature of capitalism not aberrant fringe behavior to course correct. It’s fine but leaving such a strong command to, paraphrasing, “fix this world by choosing between democrat and republican, and through carefully considering your purchases” (not even a clear call for organized boycott, just the individualized ethics) does not satisfy me

Re: GitHub waited 3 months to notify about potential compromise

#79

Post by kenbolton »

naikrovek wrote: post #74
kenbolton wrote: post #72

Earlier quoted context omitted.

No. It won't die. In the same way that memory of the Holocaust won't die (hopefully), or that memory of Putin's invasion of Ukraine won't die (hopefully), or that the memory of the corruption of Donald Trump won't die (hopefully), or the memory of the enslavement of Black human beings in the US won't die (hopefully), or the memory of corrupt policing won't die (hopefully). “Those who cannot remember the past are cond…

Microsoft bundling a browser is not the same as the Holocaust. Not the same magnitude, not the same offense, not the same violation of any moral code, at any magnitude. No one died because Microsoft included IE with Windows. no one was enslaved because Microsoft included IE with their OS. that you think these are all events of the same magnitude has completely invalidated your opinion, and placed you firmly in crackp…

I'm not at all saying that they are equivalent, just that they should not be forgotten.

Re: GitHub waited 3 months to notify about potential compromise

#80

Post by kenbolton »

naikrovek wrote: post #73
vlunkr wrote: post #43

Earlier quoted context omitted.

Seems like you’re being just as hostile in the other direction. If this isn’t the appropriate time to complain about Microsoft, then what is? I can’t speak for everyone, but I continue to not like Microsoft because they don’t make a single piece of software that I like, and they’re ruined the ones I did like.

I am just dead tired of Microsoft getting zero credit for the changes they've made since the antitrust verdict. they haven't done EVERYTHING that EVERYONE wants, so lots and lots and lots of people still shit on them like they're still mad, and it still gives nerd cred to shit on them for any reason. as if we're perfect in comparison... if the same people speak poorly of Facebook, Google, or Amazon in the same ways,…

Happily picking an opinion: I won't use phone apps; I won't buy new computers or devices, though I infrequently buy refurbished; I won't buy new cars; I carefully vet all vendors for quality, politics, and ethics (and have largely automated the process); I won't buy new kayaks; I eat a plant-based diet and try to source it locally/ethically; I won't knowingly vote for or endorse rapists or murderers and do my best to vet candidates.

I abhor Google, loathe Facebook, have considerable contempt for Musk (as a person) and the products his companies offer, use Amazon sparingly and grudgingly, and only started shopping at Walmart during the Great Recession when a) they became the employer of the majority of my neighbors and b) other vendors in my area closed.

@naikrovek may not now be aware of what happens when one makes assumptions about other people and their actions, beliefs, etc.

Post reply on HN