For people that operate near the edges of acceptable (create tools that are VERY easy to misuse) this kind of redundancy should be SOP
I’m pretty sure they only takedown exploit code, not scanner code, but people often choose not to distinguish those conceptually, which makes it quite difficult to have a discussion about it.
Also, see top reply on this post, which references a dual-use policy: https://twitter.com/_mph4/status/1470343429599211528
this whole culture is just freaking ripe for manipulation. it's so easy.
I still find Golang’s module cache mechanism to be bothersome in some regards, but I think they were on the money with their concerns. It’s probably the only way modules can stay “decentralized” with confidence. But, that solution requires at least one central entity that is trusted and can shoulder the costs of such a service; and it only solves a narrow portion of the problem, relevant to the module system of a single programming language.
There’s no easy way out; nothing is truly autonomous. Explicitly organized groups of people running a legitimate business probably have a better long-term outlook than a band of cypherpunks running P2P services, or what have you. (Believe me, it pains me to say it, because I sure wish it wasn’t so.)
In this way, I think it’s obvious why people pick GitHub. It’s because it’s in the best position of the best segment for code hosting. It’s backed by a billion dollar multinational corporation. It’s been around the block a few times and is a robust business of its own.
Even if your concern isn’t longevity, GH is still giving you the best standing as far as network effects go. It’s just hard to blame anyone.
These days for preference I'll use shart (sr.ht) or, even better, the project's own git server.
https://twitter.com/_mph4/status/1470343429599211528
> I just personally looked into this and can confirm we did not take down this repo nor are we actively removing Log4j related content from @github , consistent with our policies re: dual-use
Maybe too early to grab pitchforks?
[1] https://twitter.com/christophetd/status/1470293533416427524?...
(I suggested that people upvote the thread for visibility in the community and to start the discussion. When something reaches HN frontpage, I believe it's the voice of the community, not mine anymore)
https://news.ycombinator.com/newsguidelines.html
(just quoting what seems relevant, don't know if this actually falls under that item in the guidelines)
From what I know there are also other countries that do the same.
So now GitHub would have to implement region availability not to get into trouble with German law.
Let alone this is so fresh that preventing script kiddies from downloading a tool is perfectly valid move.
https://docs.github.com/en/github/site-policy/github-governm...
And fuck github.
/s
/s
AACS encryption key controversy
https://en.m.wikipedia.org/wiki/AACS_encryption_key_controve...
However, it seems that the way GitHub handles forks vs user deletions is that when a user deletes a fork (or it's Done For Them™), it seems that the fork "root owner" is transferred within the chain to someone else. I don't quite get it. Or maybe something else is going on.
In any case, a few minutes ago https://github.com/search?l=&q=filename%3AJNDIExploit.iml&ty... was showing JNDIExploit under "0x727", but now the page is showing the repo "owned" by a different user (with the network graph on the repo page showing everyone else as forking the repo from that new user).
So the above search link is your best bet to finding the repo. It's currently listed as owned by "zzwlpx", but you'll probably see a different user (especially if https://github.com/zzwlpx/JNDIExploit no longer works).
It currently has 245 forks, so good luck, GitHub, keeping this squashed. [Edit: I now see a comment mentioning that GitHub has a policy of trying to squash 0days for the first X days, which is a very understandable reaction given that it's where everyone goes, from the skiddies who just like seeing things burn (and prevent everyone from having nice things, to the researchers trying to respectfully evaluate damage. Sigh.]
---
Some other things I found while playing with GitHub search:
https://github.com/zhuowei/GhidraLog4Shell
https://twitter.com/_mph4/status/1470343429599211528
https://twitter.com/christophetd/status/1470346676053422081
This is surprising, considering what is outlined in a previous comment[1]. I hope GitHub provides more transparency on the takedown actions for "malicious content / exploits" like they do for DCMA notices[2].
Apologies for making wrong assumptions. I removed the original Tweet (see screenshot[3] for the original).
[1] https://news.ycombinator.com/item?id=29538151
This mostly prevents skids from getting hold of it and using it against their school etc
The title as it stands begs the question: Who is "allowing defenders", Github or the tools? Also "defenders" is a weird word to use here.
