Hacker News Reader

I'll give you another set of sites which are whitelisted by browsers: github, bitbucket, gitlab, sourceforge

If you want to trick someone into running an executable, you need to put it on a whitelisted site, otherwise they will have to slog through 5 different very scary warnings before they are allowed to run it.

The funny thing: most of HN is against this kind of browser protection, I wouldn't be surprised if they disable uncommon software warnings.

View on HN

While that's true, I do get at least a little suspicious if the repository only contains binaries on a site which is designed to host source. Same if it's a little-known repository. Besides, what is some one going to do, encourage me to "download the update to adobe reader" on github? Source hosting sites would certainly be valuable in a highly-targeted attack, but it is often the case that such actors will simply find another way.

> I'll give you another set of sites which are whitelisted by browsers: github, bitbucket, gitlab, sourceforge

I might expect them to be whitelisted by firewalls, but why browsers?

Browsers do a has-this-site-ever-been-known-to-host-malware URL check.

https://en.wikipedia.org/wiki/Google_Safe_Browsing

Reply on news.ycombinator.com