News for hackers. Stuff that matters.
Re:GitHub sued for aiding hacking in Capital One breach by BoorishBears on Sunday August 04, 2019 @12:04PM (#20607313)
Are you seriously entertaining the idea that Github should pour resources into developing a SSN detection pipeline?

Why don't they also flag repositories with lots of names, those are PII. Too many addresses? That's a red flag.

Why would you even for a second entertain this nonsense? Non-technical people who think this:

https://github.com/Hack-with-Github/Awesome-Hacking

is a smoking gun to prove Github as a company is supporting hackers are the ones putting forth this idea, no one with any technical knowledge should come close to supporting this.

Re:GitHub sued for aiding hacking in Capital One breach by karma20 on Sunday August 04, 2019 @01:41PM (#20608004)
Agree. This kind of DLP-like scanning is totally infeasible at GitHub scale.

In particular, one excerpt from the complaint reads like output from a noisy scanner that has detected “exposed SSNs” in client-side code:

> [...] Social Security numbers are readily identifiable: they are nine digits in the XXX-XX-XXXX sequence.

Re:GitHub sued for aiding hacking in Capital One breach by antpls on Sunday August 04, 2019 @12:32PM (#20607499)
Per EU's GDPR, and maybe the future California Consumer Privacy Act, yes : GitHub should do everything they can to preserve people's privacy. Including maybe flagging and reviewing projects which process PII.

GitHub is popular enough that less technical people also browse it, in particular young people looking to learn.

Re:GitHub sued for aiding hacking in Capital One breach by cljs-js-eval on Sunday August 04, 2019 @01:03PM (#20607746)
If I accept that technical difficulty and infeasibility is no defense, then I want that standard applied to lawyers as well.

Overly litigious firms causing rising legal costs across industries? I don't care if it's hard to solve, the onus for fixing it is on the firms, they figure it out or face penalties. Perhaps in the interests of helping the disenfranchised we could institute something like what real estate has, where banks are required to sell a quota of mortgages in certain areas regardless of the financial viability. Lawyers could be forced to seek out clients they would ordinarily never entertain due to the risk of loss. If would stink for them, but what do I care? That's their problem.

Re:GitHub sued for aiding hacking in Capital One breach by danShumway on Sunday August 04, 2019 @01:10PM (#20607799)
> everything they can

Just the other day my mom texted my address to a friend that wanted to mail me something. I want to know why Verizon didn't stop that from happening!

Verizon should be censoring all addresses from text messages, but I suppose it could allow them after a manual review process.

HN is guilty here as well:

  1600 Pennsylvania Ave NW, Washington, DC 20500
Why isn't the above address automatically censored?
Re:GitHub sued for aiding hacking in Capital One breach by antpls on Sunday August 04, 2019 @02:09PM (#20608200)
The message from your mom is private and isn't supposed to be read by Verizon for Verizon to provide its service.

If you don't want your mom to send PII about you to other people without your consent, and it incurs damage, you can surely sue your own mom.

Re:GitHub sued for aiding hacking in Capital One breach by BoorishBears on Sunday August 04, 2019 @04:57PM (#20609185)
I can't tell if you actually mean what you're saying, or if this is just the time-honored HN tradition of being a contrarian for the sake of being a contrarian.