GitHub hands out your repo visitors IP like candy who ask for it politely

Re:GitHub hands out your repo visitors IP like candy who ask... by Beaver117 on Wednesday April 05, 2023 @04:13AM (#35450941)

Last two digits are censored. So country/state are given but not exact location

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by matthews2 on Wednesday April 05, 2023 @04:32AM (#35451062)

Given the partial IP address and request time, the ISP could identify the customer.

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by News-Dog on Wednesday April 05, 2023 @06:13AM (#35451787)

VPN and Tor Browser?

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by jrootabega on Wednesday April 05, 2023 @07:59AM (#35452604)

Let's not get so distracted that we forget the main point of the post: should GitHub be providing this information so readily?

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by chatmasta on Wednesday April 05, 2023 @08:10AM (#35452731)

You can just put a JPG hosted on your server in the readme and get their full IP.

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by jrootabega on Wednesday April 05, 2023 @08:14AM (#35452778)

Yes, and that is something that will always be possible between the author and the reader, but this is about a third party, GitHub, providing this information to a possible fourth party. That's what the Twitter post wanted to get across.

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by chatmasta on Wednesday April 05, 2023 @08:17AM (#35452814)

Oh right, I missed that because the post linked to the middle tweet in the thread.

Still doesn't sound too outrageous. At least, it's not unprecedented and is in line with the existing practices of companies responding to law enforcement requests.

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by rtldg on Wednesday April 05, 2023 @09:01AM (#35453418)

Github proxies images so this shouldn't be possible https://github.blog/2014-01-28-proxying-user-images/

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by chatmasta on Wednesday April 05, 2023 @09:07AM (#35453489)

Oh wow TIL. Very interesting. And since 2014 too? Nice. They must have done that around the same time Google did it for GMail.

I wonder if it's still true. I imagine they have some Content-Security-Policy preventing it so you can't do hacks like embedding an external URL in an SVG.

[ Parent | on HN ]

Re:GitHub hands out your repo visitors IP like candy who ask... by rtldg on Wednesday April 05, 2023 @09:34AM (#35453895)

Their CSP does seem to prevent an svg I threw in a readme from loading a png so that's good to see. And a test png in the readme was proxied too.

content-security-policy: default-src 'none'; img-src data:; style-src 'unsafe-inline'

[ Parent | on HN ]