Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub sued for aiding hacking in Capital One breach

zdnet.com

Post reply on HN
Print view View original

91–100 of 104 posts

Re: GitHub sued for aiding hacking in Capital One breach

#91

Post by throwawaywego »

bufferoverflow wrote: post #30
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

You missed the whole point of the comment you replied to. You can detect the format of the SSN, but you can't reliably tell that it actually is a SSN, and not some other type of identifier.

Can you yourself reliably detect if something is a list of SSN's or some other type of identifier?

I think you can. Now when we have neural nets capable of distinguishing 100s of different dog breeds, we still have to trip on the most basic and structured type of entity extraction? No. A simple regex, combined with heuristics, and a linear model on top can reliably detect SSN's.

Just that there will be a few false positives (no matter if you automate this, or do this manually) does not mean it is a Herculean technical challenge to do this.

Re: GitHub sued for aiding hacking in Capital One breach

#92

Post by throwawaywego »

cgb223 wrote: post #29
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Wait... Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs? Because that could be really really bad

Worse. You can make the ML model spit out the SSNs it was trained on. That's a problem when you can't manually curate billions of documents. If you didn't look, you wouldn't even know they were there.

Re: GitHub sued for aiding hacking in Capital One breach

#94

Post by Nevermindmine »

ilkkao wrote: post #71
wolf550e wrote: post #44

Earlier quoted context omitted.

SSNs don't have a checksum like credit card numbers do (or like national identity card numbers do), because the SSN is not meant to be used the way it is used. https://www.youtube.com/watch?v=Erp8IAUouus

In many countries they have. Which leads me wonder if github is expected to detect all formats there are around the globe

But do many countries treat them as secrets? Where I live, my number is a unique identifier for me but it's not secret. Because, you know, sharing secrets isn't smart and leads to the recurring issues we see in the US.

Re: GitHub sued for aiding hacking in Capital One breach

#95

Post by BoorishBears »

antpls wrote: post #85
danShumway wrote: post #67

Earlier quoted context omitted.

> everything they can Just the other day my mom texted my address to a friend that wanted to mail me something. I want to know why Verizon didn't stop that from happening! Verizon should be censoring all addresses from text messages, but I suppose it could allow them after a manual review process. HN is guilty here as well: 1600 Pennsylvania Ave NW, Washington, DC 20500 Why isn't the above address automatically censo…

The message from your mom is private and isn't supposed to be read by Verizon for Verizon to provide its service. If you don't want your mom to send PII about you to other people without your consent, and it incurs damage, you can surely sue your own mom.

I can't tell if you actually mean what you're saying, or if this is just the time-honored HN tradition of being a contrarian for the sake of being a contrarian.

Re: GitHub sued for aiding hacking in Capital One breach

#96

Post by dahfizz »

ForHackernews wrote: post #55
dahfizz wrote: post #51

Earlier quoted context omitted.

Legally, what's the difference between all the distributed, load balanced servers running a "centralized" database and the computers which host the same data in a "distributed" platform? This doesn't solve the problem. If anything, it amplifies it. We have to either protect platforms or hold platforms liable, but making everyone a platform doesn't help much.

Are you being facetious? Are you genuinely asking me to explain the difference between SMTP and Facebook.com? If you make everyone an individual actor, then there is no "platform". Visa can ban a merchant; you can't ban a merchant from the concept of accepting a cash payment.

> Are you genuinely asking me to explain the difference between SMTP and Facebook.com?

Of course not. I'm asking you what the legal difference is between the GitHub we have today and your desktop running a hypothetical distributed federated GitHub.

If your computer takes part in the hosting of some illegal content, wouldn't you be held liable like GitHub is here?

Re: GitHub sued for aiding hacking in Capital One breach

#97

Post by ForHackernews »

dahfizz wrote: post #96
ForHackernews wrote: post #55

Earlier quoted context omitted.

Are you being facetious? Are you genuinely asking me to explain the difference between SMTP and Facebook.com? If you make everyone an individual actor, then there is no "platform". Visa can ban a merchant; you can't ban a merchant from the concept of accepting a cash payment.

> Are you genuinely asking me to explain the difference between SMTP and Facebook.com? Of course not. I'm asking you what the legal difference is between the GitHub we have today and your desktop running a hypothetical distributed federated GitHub. If your computer takes part in the hosting of some illegal content, wouldn't you be held liable like GitHub is here?

> a hypothetical distributed federated GitHub.

God this is depressing to read. Git (not "GitHub") is already a distributed VCS. This isn't hypothetical!

If you're a random individual hosting a git repo containing illegal content, you might get sued, but much much more likely, you'd just get an angry email demanding you take it down.

Re: GitHub sued for aiding hacking in Capital One breach

#98

Post by nickjj »

Nevermindmine wrote: post #94
ilkkao wrote: post #71

Earlier quoted context omitted.

In many countries they have. Which leads me wonder if github is expected to detect all formats there are around the globe

But do many countries treat them as secrets? Where I live, my number is a unique identifier for me but it's not secret. Because, you know, sharing secrets isn't smart and leads to the recurring issues we see in the US.

I'm from the US and I remember about 20 years ago I registered for a Blockbluster card (a way to rent DVDs from Blockbuster) and the form required putting my full social security number on it. In the US it's supposed to be secret but lots of places want access to it. Blockbuster never got my SSN and they did let me sign up without providing it. It's crazy they would even ask.

Re: GitHub sued for aiding hacking in Capital One breach

#99

Post by dahfizz »

ForHackernews wrote: post #97
dahfizz wrote: post #96

Earlier quoted context omitted.

> Are you genuinely asking me to explain the difference between SMTP and Facebook.com? Of course not. I'm asking you what the legal difference is between the GitHub we have today and your desktop running a hypothetical distributed federated GitHub. If your computer takes part in the hosting of some illegal content, wouldn't you be held liable like GitHub is here?

> a hypothetical distributed federated GitHub. God this is depressing to read. Git (not "GitHub") is already a distributed VCS. This isn't hypothetical! If you're a random individual hosting a git repo containing illegal content, you might get sued, but much much more likely, you'd just get an angry email demanding you take it down.

> God this is depressing to read. Git (not "GitHub") is already a distributed VCS. This isn't hypothetical!

I feel like you're missing the context in this thread. My parent was giving federated protocols as as alternative to centralized platforms, and my question is what are the legal implications for me if I end up hosting illegal content because of a network sync of some federated git.

Maybe social media is a less distracting example for you. Currently, Facebook is liable if they host e.g. child porn to their site. If some federated social media platform takes off where every user's computer takes part in also hosting, what happens when a child porn photo ends up on the platform?

My point is that federated vs centralized is not a magic bullet for this issue. In either case, there is some platform which can be held liable for content. People seem to think "use open source distributed protocols" solves this legal issue, but it does not.

> Ifyou're a random individual hosting a git repo containing illegal content, you might get sued, but much much more likely, you'd just get an angry email demanding you take it down.

Is this true? I'm genuinely asking. Can I commit the same "crime" as GitHub or Facebook but be treated so differently by the legal system? What's the actual rules here that differentiates us?

Re: GitHub sued for aiding hacking in Capital One breach

#100

Post by BoorishBears »

antpls wrote: post #84
danShumway wrote: post #57

Earlier quoted context omitted.

In regards to your edit 1, cost benefit analysis isn't just about a company's bottom line, it's also about the types of architecture and services that are allowed to exist online. Github is not the primary way that PII is leaked online, you're thinking of Pastebin. Should Pastebin be allowed to exist? Should the Open Source developers behind Wordpress and Ghostery be liable for not scrubbing PII off of websites? The…

> Should Pastebin be allowed to exist? Yes, because as far as I know, Pastebin doesn't process sent data to provide its service. They just store it, they could simply store it encrypted and say they can't access data. On the other hand, GitHub process repositories to provide further services. They already read the sent data. > The "cost" here isn't really money, it's a social cost. It's regular people's access to ser…

>Yes, because as far as I know, Pastebin doesn't process sent data to provide its service. [...] Github already read the sent data.

Pastebin is literally already scanning pastes:

https://pastebin.com/doc_privacy_statement

> In addition, while we do not generally search for content in your pastes, we may scan our servers for certain tokens or security signatures.

Post reply on HN