News for hackers. Stuff that matters.
Re:GitHub Agentic Workflows by TZubiri on Monday February 09, 2026 @03:32AM (#46942993)
I see a lot of people confused, and it is confusing. Here's my best take at clarifying the issue for you:

It's as if Google sent you an official email from an @gmail address.

Like "[email protected]"

Surely it would look suspicious, and if it turns out it is official, it doesn't somehow mean there's no issue, if anything it's worse because it untrains users' security protocols.

Personally I'd ignore anything that comes out of one of these domains, even if it turns out an actual employee pushed it, if you can't publish something on the main domain, you don't have enough authority to speak for the company, may be skunkworking to avoid an internal protocl, I don't know, I don't care, it's not official, don't need to read it.

Re:GitHub Agentic Workflows by hmokiguess on Thursday February 12, 2026 @03:42PM (#46994846)
I don't think this is the same thing though, in their documentation the subdomain has to be for the owner or organization, so if it's `github.github.io` then it belongs to the `github` organization [1]

Though I guess I do get your point, meaning that this leads to people trusting the domain name if they are uneducated about how GitHub Pages works.

[1] https://docs.github.com/en/pages/getting-started-with-github...