Re:GitHub waited 3 months to notify about potential compromise
by hanble on Thursday June 16, 2022 @05:31PM
(#31771234)
That's true, but feels like these are always judgment calls. We can always armchair quarterback their judgment calls, but none of us have the full info. At least GH is sharing this info, which is a good call for trust building IMO.
Re:GitHub waited 3 months to notify about potential compromise
by averysmallbird on Thursday June 16, 2022 @06:05PM
(#31771590)
That's not fully Github's choice to make. They made a judgement call based on seemingly incomplete evidence, and have different incentives that everyone else.
Repository owners may well have a different level of acceptable risk or legal obligations over the integrity of their source code. For example, if I was maintaining security software or a popular package, it would be entirely appropriate to stop everything and look for abuse. Waiting three months makes that harder.
I'm not sure that's trust building.
Re:GitHub waited 3 months to notify about potential compromise
by hanble on Friday June 17, 2022 @12:44PM
(#31780857)
Fair point - I think that's very fair criticism
Re:GitHub waited 3 months to notify about potential compromise
by remram on Friday June 17, 2022 @12:08AM
(#31774028)
This is only a judgment call because they have no idea. The fact that they have no idea whether your organization's data was leaked is exactly what people here are complaining about.
> ...
> Due to the variety of GitHub Apps, their possible scopes, and the repositories they may have been given access to, we are unable to advise on any potential impacts as each customer's situation will be unique.
Absence of evidence is not evidence of absence.