Re:Repositories held for ransom by using valid credentials
by edwinbalani on Saturday May 04, 2019 @06:02AM
(#19825499)
"Gitlab.com was compromised" is a bad title. _Accounts on_ GitLab, and the credentials to access them, were compromised, but the title suggests that the whole platform was affected, which doesn't seem to be the case.
[ Parent
| on HN ]
Re:Repositories held for ransom by using valid credentials
by jjeaff on Saturday May 04, 2019 @10:25AM
(#19826635)
Looks like they changed the title. But I would have to say that the ability to delete a full repo with the credentials is a bit of a vulnerability.
To me, it seems like a good measure would be to mark deleted repos as "delete requested" then notify the users involved and give them a week or two to undo a total delete. Especially if it is an older repo with lots of commits.