News for hackers. Stuff that matters.

A comment on Anyone can access deleted and private repository data on GitHub. Parent comment

Re:Anyone can access deleted and private repository data on ... by coldtea on Wednesday July 24, 2024 @06:03PM (#41062683)
>It's a bug bounty, not a "only if we have time to fix it" bounty

It's only a bug if it's not intended

[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by ethbr1 on Wednesday July 24, 2024 @08:32PM (#41063651)
Do some companies intend for their platform to feature remote code execution?
[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by jen20 on Wednesday July 24, 2024 @09:33PM (#41063957)
Remote code execution is literally a feature of GitHub…
[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by ethbr1 on Wednesday July 24, 2024 @11:29PM (#41064465)
Sandboxed code execution is a bit different than RCE.
[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by coldtea on Thursday July 25, 2024 @07:26AM (#41067277)
Some might very well do. E.g. a company with a service for training hackers and security researchers.

In this case the question is moot, as this doesn't involve remote code execution.

[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by ethbr1 on Thursday July 25, 2024 @01:59PM (#41071466)
Make a general point, get a general answer.

If the criteria for bug is "not intended", and that's solely judged by the company, then broken auth et al. suddenly become part of their product design.

If it quacks like a bug, it's a bug.

[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by bmitc on Thursday July 25, 2024 @02:07AM (#41065208)
I think a lot of developers and companies interpret "that's the way the code or process works" as intentional behavior, which is not always the case.
[ Parent | on HN ]