Hacker News Reader

Comment by philwelch | Hacker News Reader

Playing nice with a hacker who just broke into your service shouldn't take priority over:

1. Making sure he doesn't continue breaking into your service (by suspending his account)

2. Fixing the security flaw he used to break into your service

3. Appraising your users to the situation.

I feel for the kid--he's just 18, and if he gets some good judgment to go along with his technical skill he'll go far. But I don't understand the nerdrage at Github. People trust Github's service and their software to protect proprietary code; their response has been everything you could hope for in the interests of 100%-1 of Github stakeholders, at the expense of not communicating well to Egor why and how long they were suspending him for breaking into their service.

View on HN

I agree with you up to a point; those certainly should be their priorities. However, suspending his account didn't help them accomplish any of those goals.

I think we can all agree that it certainly didn't help them fix the vulnerability or communicate with users, right? (Actually, it arguably did the reverse...) But it also did absolutely nothing to stop him from breaking into the service; the exploit works for any user, and Github allows anyone to create an account instantly and for free. Until the exploit was fixed, anyone including him could have created an account and exploited their service.

A better defence of Github would be that they couldn't have been expected to know that, and so they shouldn't be slammed for doing something unproductive and pointless that distracted them from the three core priorities you list above. And I agree! If something looks fishy, banning everyone involved, and sorting it out later is actually a pretty decent idea...even if (as here) it proves to be a complete waste of time in retrospect.

How does suspending his account ensure he doesn't continue breaking into your service?

Because it's trivial for him to set up another account and break the service from there. His ability to do this exploit wasn't tied to his specific account. His point was that anyone could be doing this.

=edit= Sorry, I am apparently agreeing with the comment I replied to.

In retrospect, it wasn't that helpful unless they also suspended new account creation, or at least kept an eye on it. But they didn't have that information at that time.

During a security breach, is suspending a malicious user who's currently attacking you really something you sit around and discuss beforehand? Or do you just do it?

Reply on news.ycombinator.com