Oddly, I don't feel that GitHub is being upfront with everything that's going on here. It appears to be a very complicated story, but it was presented in an entirely different manner. I recognize that it's difficult to present a coherent story when everything is playing out in real time on the web, but the blog posts seem to have shared just the wrong amount of information.

The sad part is that the guy was your biggest fan: http://homakov.blogspot.in/2011/07/octocat-tattoo.html

It's a fake.

Citation needed

Not sure if technoweenie was trolling or not, but Homakov said on Twitter "That tattoo is kind of fake made with henna".

http://twitter.com/#!/homakov/status/176476394455437312

"Thank you all,sweethearts! For support, and shit too. One more thing to clarify. That tattoo is kind of fake made with henna. eat vegetables"

> he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly

If he was, he wouldn't have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.

I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new "white hat" policy thing is kind of silly, because that's clearly not what this was about.

Well, you should have just stated that in the first place instead of name calling and acting immature. A simple "we have suspended his account while we carry out further investigations, this is practice" would have gone a long way to ease people's minds and kind of reactions you got. Instead, Github just came across as massive douches.

EDIT: On second thoughts, I think I am being overly critical on all parties. Instead, I think I hands up "we messed up, but we are learning" approach would be better, and we see how both sides act if/when this happens again, lessons learnt and all that!