Responsible Disclosure Policy
github.com
Responsible Disclosure Policy
1–10 of 85 posts
Re: Responsible Disclosure Policy
#2[deleted]
Re: Responsible Disclosure Policy
#3Given that:
(1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor,
(2) noted in the blog post [1] describing how Github "detected the attack",
I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning.
It's healthy that they've reversed their suspension but the lack of transparency (not to mention potential dissembling) on the decision process regarding the revocation is still troubling.
[1] https://github.com/blog/1068-public-key-security-vulnerabili...
Re: Responsible Disclosure Policy
#4Impressed by how Github handled this. It's easy to get red-faced and smack down with a hammer, and it's hard to remain level-headed and come to the best decision. This seems like it was, in fact, the best decision.
For those of you who didn't see, they were quick to update people and be on the ball: https://github.com/blog/1068-public-key-security-vulnerabili...
Re: Responsible Disclosure Policy
#5I hate to be the one pointing out this but it's a shame that a company like GitHub will reward responsible disclosures just with a thank you and the promise to not pursue a legal action.
http://help.github.com/responsible-disclosure/
"white hat researchers are always appreciated"
Re: Responsible Disclosure Policy
#6Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…
> (1) the temporary nature of the suspension was not communicated to Egor at the onset of the situation, nor,
Are suspensions not by definition temporary?
Re: Responsible Disclosure Policy
#7Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…
The account was suspended, not deleted. That was made clear to everyone. Suspended does not mean banned, it does not mean canceled, it is impermanent by definition.
Re: Responsible Disclosure Policy
#8Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…
Cut 'em a break. I sympathize with your statement, but I give Github a lot of credit for correcting their error and reinstating his account.
As a general rule, it's extremely hard for organizations to admit their own mistakes.
Re: Responsible Disclosure Policy
#9Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…
I'm inclined to agree with you, but, to play the devil's advocate, "we're temporarily suspending you...oops, no, it's permanent after all" is not a position they want to find themselves in.
Re: Responsible Disclosure Policy
#10Given that: (1) the nature of the suspension was not communicated to Egor at the onset of the situation, nor, (2) noted in the blog post [1] describing how Github "detected the attack", I am inclined to believe that this is a response to the furious reaction to their suspension decision and was not, as this post implies, the game plan from the beginning. It's healthy that they've reversed their suspension but the lac…
> (1) the temporary nature of the suspension was not communicated to Egor at the onset of the situation, nor, Are suspensions not by definition temporary?
Sorry - updated. I was focusing more on the notion of GitHub suspending his account with the intention to re-instate it after clearing uncertainty. Their lack of communication with him is inconsistent with a rational reaction to that assumption.