{"id":100063,"date":"2021-04-30T10:22:37","date_gmt":"2021-04-30T08:22:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-uzhestochaet-pravila-svyazannye-s-razmeshheniem-rezultatov-issledovanij-bezopasnosti"},"modified":"2021-04-30T10:22:37","modified_gmt":"2021-04-30T08:22:37","slug":"github-uzhestochaet-pravila-svyazannye-s-razmeshheniem-rezultatov-issledovanij-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/github-uzhestochaet-pravila-svyazannye-s-razmeshheniem-rezultatov-issledovanij-bezopasnosti","title":{"rendered":"GitHub tightens rules regarding the publication of security research findings.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub has published changes to the rules defining its policy on the hosting of exploits and malware research findings, as well as compliance with the U.S. Digital Millennium Copyright Act (DMCA). The changes are currently in draft status and available for discussion for 30 days. <\/p>\n
In the DMCA compliance rules, in addition to the previously existing prohibition on the distribution and facilitation of the installation or delivery of active malware and exploits, the following provisions have been added: <\/p>\n
\n
A clear ban on placing technologies in repositories that bypass copyright protection mechanisms, including license keys, as well as programs for generating keys, bypassing key checks, and extending free trial periods.\n
A process for submitting requests to remove such code is introduced. The requester is required to provide technical details, with a declared intention to forward this request for review before blocking.\n
When blocking a repository, it is promised that the ability to export issues and PRs will be provided, along with legal services. <\/ul>\n
The changes made to the rules regarding exploits and malware take into account the criticism that arose after Microsoft removed the prototype exploit for Microsoft Exchange used for carrying out attacks. The new rules attempt a clear separation between content that poses a danger and is used for carrying out active attacks, and code accompanying security research. Changes made: <\/p>\n
\n
It is prohibited not only to attack GitHub users by hosting exploit content on it or to use GitHub as a means to deliver exploits, as was the case before, but also to host malicious code and exploits related to carrying out active attacks. Generally speaking, hosting examples of exploits prepared during security research that involve already patched vulnerabilities is not prohibited, but it will all depend on how the term 'active attacks' is interpreted.\n
For example, publishing the source code of JavaScript that attacks the browser in any form falls under this criterion \u2014 the attacker can easily load the source code into the victim's browser via fetch, automatically patch it if the exploit prototype is published in a non-functional form, and execute it. The same goes for any other code, such as C++ \u2014 nothing prevents it from being compiled on the attacked machine and executed. When a repository with such code is discovered, it is planned not to delete it but to restrict access to it. <\/p>\n
The section prohibiting 'spam,' manipulation, participation in manipulation markets, programs that violate the rules of any websites, phishing, and attempts thereof has been moved up in the text.\n
A provision has been added explaining the option to appeal in case of disagreement with a block.\n
A requirement has been added for repository owners, where potentially dangerous content is placed for security research. Such content must be explicitly mentioned at the beginning of the README.md file, and contact details for communication must be provided in the SECURITY.md file. It is stated that in general, GitHub does not delete exploits published alongside security research for already disclosed vulnerabilities (not 0-day), but reserves the right to limit access if it assesses that there is a risk of using these exploits for real attacks and if complaints about the code usage for attacks are received by GitHub support. <\/ul>\n