<story><title>GitHub and Rails: You have let us all down.</title><url>http://chrisacky.posterous.com/github-you-have-let-us-all-down</url></story><parent_chain><item><author>technoweenie</author><text>We suspended it after fixing the bug to make sure he didn&apos;t retain access to something he shouldn&apos;t.  We rarely do this, but he wasn&apos;t upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.</text></item><item><author>epistasis</author><text>I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov&apos;s account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won&apos;t be the first to know about the next vulnerability (and there&apos;s always another).&lt;p&gt;I&apos;ve downgraded my paid account to a free account, and won&apos;t keep any non-public data on GitHub in the future. I had a similar response with my (non-paid) DropBox account. I guess I didn&apos;t rationally evaluate cloud resources, and have trusted far too many people.</text></item></parent_chain><comment><author>epistasis</author><text>Oddly, I don&apos;t feel that GitHub is being upfront with everything that&apos;s going on here. It appears to be a very complicated story, but it was presented in an entirely different manner. I recognize that it&apos;s difficult to present a coherent story when everything is playing out in real time on the web, but the blog posts seem to have shared just the wrong amount of information.</text></comment>
<story><title>GitHub and Rails: You have let us all down.</title><url>http://chrisacky.posterous.com/github-you-have-let-us-all-down</url></story><parent_chain><item><author>technoweenie</author><text>We suspended it after fixing the bug to make sure he didn&apos;t retain access to something he shouldn&apos;t.  We rarely do this, but he wasn&apos;t upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.</text></item><item><author>epistasis</author><text>I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov&apos;s account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won&apos;t be the first to know about the next vulnerability (and there&apos;s always another).&lt;p&gt;I&apos;ve downgraded my paid account to a free account, and won&apos;t keep any non-public data on GitHub in the future. I had a similar response with my (non-paid) DropBox account. I guess I didn&apos;t rationally evaluate cloud resources, and have trusted far too many people.</text></item></parent_chain><comment><author>tylermenezes</author><text>&amp;#62; he wasn&apos;t upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly&lt;p&gt;If he was, he wouldn&apos;t have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.&lt;p&gt;I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new &quot;white hat&quot; policy thing is kind of silly, because that&apos;s clearly not what this was about.</text></comment>