Cybersecurity Community Unhappy With GitHub's Proposed Policy Updates

guest · Apr 30, 2021

Cybersecurity Community Unhappy With GitHub's Proposed Policy Updates
April 30, 2021
https://www.securityweek.com/cybersecurity-community-unhappy-githubs-proposed-policy-updates

The community has been asked to provide feedback until June 1 on proposed clarifications regarding exploits and malware hosted on GitHub.

“Our policy updates focus on the difference between actively harmful content, which is not allowed on the platform, and at-rest code in support of security research, which is welcome and encouraged. These updates also focus on removing ambiguity in how we use terms like ‘exploit,’ ‘malware,’ and ‘delivery’ to promote clarity of both our expectations and intentions,” Mike Hanley, the CSO of GitHub, said in a blog post on Thursday.
Click to expand...

Now, GitHub wants to update its policies around malware and exploits to avoid problems in the future.

“Under no circumstances will users upload, post, host, execute, or transmit any content that: contains or installs malware or exploits that are in support of ongoing and active attacks that are causing harm,” reads the updated policy proposed by GitHub.

A majority of those who provided feedback are not happy with the proposed changes.
Robert Graham of Errata Security noted that the use of wording such as “support of ongoing and active attacks” is “a vague catchall that's impossible to determine if somebody has violated.”

“Hackers have already automated download of my code in their attacks, meaning that I'm violating the new rules technically,” Graham said.
Click to expand...

In response to the criticism, Hanley noted that the feedback received by the company will be taken into account.
Click to expand...

Log in or Sign up

Cybersecurity Community Unhappy With GitHub's Proposed Policy Updates

guest Guest

Log in or Sign up

Cybersecurity Community Unhappy With GitHub's Proposed Policy Updates

guest Guest

Useful Searches