TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Millions of GitHub repos likely vulnerable to RepoJacking, researchers say

17 点作者 DemiGuru将近 2 年前

4 条评论

ryan29将近 2 年前
The same problem exists, but has less of an impact on other platforms as well. For example, switching to a domain based handle on Bluesky will make your old handle available for re-registration. That makes you vulnerable to impersonation via the old handle.<p>I wonder if some of these platforms could allow aliases, so, using the example in the article, switching from &#x27;MyOrganization&#x27; to &#x27;NewOrganization&#x27; lets you keep &#x27;MyOrganization&#x27; as a permanent alias. Obviously that would invite namespace squatting, but I think you could solve that by charging a one time fee for an alias. If you&#x27;re renaming an organization it&#x27;s likely worth $50+ to keep the old namespace.<p>Ideally, everything should move to domains as namespaces IMO. I&#x27;d rather maintain a single domain vs (hopefully) matching namespaces across a dozen different platforms.
donatj将近 2 年前
I reported this problem 5 years ago. GitHub employed some half fixes and called it a day.<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16343926">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16343926</a><p><a href="https:&#x2F;&#x2F;www.theregister.com&#x2F;2018&#x2F;02&#x2F;10&#x2F;github_account_name_reuse&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.theregister.com&#x2F;2018&#x2F;02&#x2F;10&#x2F;github_account_name_r...</a><p><a href="https:&#x2F;&#x2F;donatstudios.com&#x2F;GithubsTotalSecurityFacepalm" rel="nofollow noreferrer">https:&#x2F;&#x2F;donatstudios.com&#x2F;GithubsTotalSecurityFacepalm</a>
58x14将近 2 年前
So, to mitigate, avoid changing Github organization names if possible, and if not, preserve &#x2F; re-register the former organization name to prevent impersonation?
评论 #36436415 未加载
RadiozRadioz将近 2 年前
This is why it is important to use checksums&#x2F;hashes when automatically pulling stuff from external sources.