Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

I mean, in this case what difference does the Project Zero disclosure make? I've been getting alerts about my Actions build, GitHub has released the functionality necessary to implement the change, and GitHub has had a website explaining the vulnerability for weeks now. This isn't a case where disclosure actually disclosed anything new.

Edit: For reference, this was announced on the GitHub blog a month ago: https://github.blog/changelog/2020-10-01-github-actions-depr...

View on HN

I would say it seems Github thought it would make a difference, based on their request for 48 more hours.

Why do you think it won't make a difference to them in light of them specifically requesting 48 more hours?

Because of that 2nd to last point:

> Github responds and mentions that they won't be disabling the vulnerable commands by 2020-11-02. They request an additional 48 hours, not to fix the issue, but to notify customers and determine a "hard date" at some point in the future.

The issue isn't really with GitHub not making the fix available, but the issue is that if they turn it off now they will break legions of builds. I think the Project Zero disclosure issue for them then is more for pointy haired manager appearances ("Oh no! Github has a disclosed Project Zero vuln!") than for any real difference in security.

Then break the legion of builds in the name of security.

That seems along the lines of "I can just turn off the ability to log in to prevent account hacking!" level of security thinking.

For some accounts you do exactly that if you have to.

If your choices are "disable all logins" or "anybody can log into my bank account and make whatever transfers they want", the correct choice is the former. (Obviously I would prefer a third option, where the company actually fixed the login bug sometime during the 104-day lead-up, but that's not the point.)

What if we could have both, just by sending an email? Hit compose underlying!

Well there could hurt their pride to miss the deadline. They might have an internal metric for this too.

Seem a bit inflexible from Project Zero, given that Github has already disclosed it anyway. Why didnt they disclose earlier even? Seems like program part could need some updates, a few things don't make sense here.

> 2020-10-30 Due to no response and the deadline closing in, Project Zero reaches out to other informal Github contacts. The response is that the issue is considered fixed and that we are clear to go public on 2020-11-02 as planned.

> 2020-11-01 Github responds and mentions that they won't be disabling the vulnerable commands by 2020-11-02. They request an additional 48 hours, not to fix the issue, but to notify customers and determine a "hard date" at some point in the future.

Suggests to me that GitHub has no clue whether it's resolved or not. Project Zero were following GitHub's lead. Asked them if the problem was resolved or not, didn't get anything, had to reach out to internal contacts, and then got a conflicting message saying "NO WAIT!"

To be fair thats a one sided view of the issue. Will be interesting to see Githubs take.

I think it kinda doesn't matter. Project Zero had already given them an extra 14 days; GH should have made better use of it. If you're constantly making exceptions to your rules for people, the rules end up being more flimsy and less respected.

Regardless, GH had already disclosed this a month before, so their desire for 2 more days was unnecessary: the cat was already out of the bag, through their own actions.

Reply on news.ycombinator.com