GitHub has published changes to the rules defining its policy on the hosting of exploits and malware research findings, as well as compliance with the U.S. Digital Millennium Copyright Act (DMCA). The changes are currently in draft status and available for discussion for 30 days.
In the DMCA compliance rules, in addition to the previously existing prohibition on the distribution and facilitation of the installation or delivery of active malware and exploits, the following provisions have been added:
- A clear ban on placing technologies in repositories that bypass copyright protection mechanisms, including license keys, as well as programs for generating keys, bypassing key checks, and extending free trial periods.
- A process for submitting requests to remove such code is introduced. The requester is required to provide technical details, with a declared intention to forward this request for review before blocking.
- When blocking a repository, it is promised that the ability to export issues and PRs will be provided, along with legal services.
The changes made to the rules regarding exploits and malware take into account the criticism that arose after Microsoft removed the prototype exploit for Microsoft Exchange used for carrying out attacks. The new rules attempt a clear separation between content that poses a danger and is used for carrying out active attacks, and code accompanying security research. Changes made:
- It is prohibited not only to attack GitHub users by posting content with exploits or using GitHub as a delivery mechanism for exploits as was previously the case, but also to post malicious code and exploits associated with conducting active attacks. In general, posting examples of exploits created during security research that concern already patched vulnerabilities is not prohibited, but it will depend on how the term 'active attacks' is interpreted.
For example, publishing any form of raw JavaScript code that attacks a browser falls under this criterion—nothing stops the attacker from loading the source code into the victim's browser via fetch, automatically patching it if the exploit prototype is published in a non-functional state, and executing it. The same applies to any other code, such as C++; nothing prevents it from being compiled on the targeted machine and executed. When a repository containing such code is found, it is planned to restrict access rather than delete it.
- The section prohibiting 'spam', boosting, participation in boosting markets, programs for violating the rules of any websites, phishing, and attempts thereof has been moved higher in the text.
- A provision has been added explaining the option to appeal in case of disagreement with a block.
- A requirement has been added for repository owners, where potentially dangerous content is placed for security research. Such content must be explicitly mentioned at the beginning of the README.md file, and contact details for communication must be provided in the SECURITY.md file. It is stated that in general, GitHub does not delete exploits published alongside security research for already disclosed vulnerabilities (not 0-day), but reserves the right to limit access if it assesses that there is a risk of using these exploits for real attacks and if complaints about the code usage for attacks are received by GitHub support.
Source: opennet.ru
