News for hackers. Stuff that matters.

A comment on GitLab reinstates list of servers that have malware.

Re:GitLab reinstates list of servers that have malware by nodesocket on Saturday October 15, 2016 @06:07PM (#12715858)
Let's be honest, the people that are reading the list on GitLab are highly unlikely to be end consumers purchasing at those stores. If anything, this list provides a potential target list for other hackers to try and compromise those stores even further. I believe this to be irresponsible and furthermore still a violation of responsible disclosure.
[ Parent | on HN ]
Re:GitLab reinstates list of servers that have malware by sytse on Saturday October 15, 2016 @06:15PM (#12715876)
I agree that it is unlikely that consumers directly use the list themselves. But have you seen https://twitter.com/gwillem/status/786908740838682624 that was linked from the OP? "631 compromised stores have been fixed in the last 4 days". I think publishing the list helped accelerate the fixing process. And companies like Google might use the list to detect malware sites in search results.
[ Parent | on HN ]
Re:GitLab reinstates list of servers that have malware by startling on Saturday October 15, 2016 @06:40PM (#12715948)
The people you're afraid of ("if anything, this list provides a potential target list for other hackers to try and compromise those stores even further") already have access to the data gwillem used as a source.
[ Parent | on HN ]
Re:GitLab reinstates list of servers that have malware by jacalata on Sunday October 16, 2016 @01:19AM (#12717103)
Isn't that true for the vast majority of responsible disclosure instances?
[ Parent | on HN ]
Re:GitLab reinstates list of servers that have malware by nodesocket on Saturday October 15, 2016 @06:54PM (#12715987)
Any by further distributing the list to a greater audience, that makes it ok?
[ Parent | on HN ]
Re:GitLab reinstates list of servers that have malware by startling on Saturday October 15, 2016 @07:28PM (#12716105)
It's a matter of degree. Do the positives of publishing outweigh the negatives? I think so.
[ Parent | on HN ]
Re:GitLab reinstates list of servers that have malware by TheSpiceIsLife on Saturday October 15, 2016 @08:54PM (#12716321)
What's your comprehensive alternative then? Attempt to contact the owners? And where that has proven fruitless? Tell no-one?

At least now I can bring this list to the awareness of tech-savvy friends who might now have an opportunity to talk to their friends and family and so on.

[ Parent | on HN ]