News for hackers. Stuff that matters.
Re:GitHub censored my research data by eridius on Saturday October 15, 2016 @03:09AM (#12713066)
This is completely unacceptable. You're treating this as though the author was publishing a list of vulnerabilities about sites. That's not what the author did. The author published a list of sites that are already infected with malware and thus are dangerous for users to visit. This is a public service and there is zero expectation of "responsible disclosure" to the sites. The only thing that disclosing to the sites without telling the public does is protect the reputation of the site, but there's no expectation for anyone to try and protect the reputation of sites that are serving malware.

> We did not feel comfortable hosting information that could be construed as an open invitation for malicious users to exploit.

The sites were already exploited. That's the thing. At best I can see the argument you're making being "we don't want the sites to get exploited a second time", but that really shouldn't be a concern. The sites were already exploited, there's nothing left to protect. And publishing a list saying "this site has malware on it" doesn't actually tell anybody how the site was vulnerable anyway, unlike disclosing security vulnerabilities which by their very nature informs people how to take advantage of them.

Re:GitHub censored my research data by Singletoned on Saturday October 15, 2016 @04:38AM (#12713250)
I agree. GitLab's reputation has taken a pretty big hit in my opinion. I kind of expected GitHub's reaction, but had hoped for something better from GitLab (if nothing else, just to differentiate themselves from their opposition).
Re:GitHub censored my research data by sqldba on Saturday October 15, 2016 @10:55AM (#12714113)
Definitely stuffed my opinion of them. I thought they were for the people and made good decisions.

Nope - corporate suits - and they give us a response which doesn't even make logical sense. Do they think we're idiots?

Re:GitHub censored my research data by PuffinBlue on Saturday October 15, 2016 @03:23AM (#12713092)
Couldn't agree more.

I'm not sure if GL is trying to protect themselves against something and are making up some excuse to justify it but the reasons given for taken down the list don't hold water.

GL would be far better stating the real reason for taking the info down (surely there must be one).

So far what they've done is seemingly to protect the merchants reputation and perhaps protect GL from some imagined legal backlash? The backlash would have no basis is court or other services like Google's own SafeBrowing would not be viable.

Are we to assume the GL cares more about that than users/visitors to these sites?

The statement from GP is frankly pathetic.

Re:GitHub censored my research data by Fej on Saturday October 15, 2016 @04:05AM (#12713193)
The real reason is almost certainly something along the lines of 'it's possible we could get sued for libel' or 'we have been threatened with a libel suit'. Not that such a case would ever go anywhere, but I imagine they figure that it's more trouble than it's worth.
Re:GitHub censored my research data by kevin_thibedeau on Saturday October 15, 2016 @10:05AM (#12713953)
They have safe harbor protection.
Re:GitHub censored my research data by bigiain on Saturday October 15, 2016 @11:14AM (#12714225)
But maybe not any more - since they're now shown to be acting in an editorial capacity...
Re:GitHub censored my research data by monkeycantype on Saturday October 15, 2016 @11:22AM (#12714263)
Is it possible that gitlab's position is that the presence of malware is proof that the site is vulnerable, not that the malware is the vulnerability?
Re:GitHub censored my research data by eridius on Saturday October 15, 2016 @03:58PM (#12715438)
I addressed that in the second half of my comment.