The answer is most likely like any other security team: they are understaffed and underfunded.
But also, when it comes to large platforms, you generally cannot just go after the obvious, it's a cat and mouse game, and your opponents outnumber you 10:1.
If you delete based on wording, they can just change the wording. What you want to do is use the easy, obvious indicator to find the less obvious indicators. Bot networks have infrastructure, you want to deduce it and use that as your indicator. Do the bots use the same residential proxy provider? Do they use a real browser, or just pretend to be one?
Once you have enough information to confidently be able to identity the bots, you then also need to be careful with applying it. You want to issue removals in waves, and keep them spaced enough that the operators cannot quickly find a way around your detection, but also often enough that it doesn't cause undue harm.
If you know how game developers handle cheating, this will sound familiar, it's basically the same playbook.
I work in gamedev (formerly AAA online stuff) and this is exactly right.
One caveat for readers though: it’s frustrating for users to ban in waves, because there is some non-zero time when cheating/bots are able to be rampant, and even if you make it unpredictable, after a wave there is always a concerted effort to active other accounts.
At least games have something of a barrier to entry (unless it’s free to play?)- but github accounts are free and you “win” bandwidth and storage which are pricey. I wouldn’t want to be in their shoes.
FFXIV has a fairly expansive f2p trial in terms of how far you can progress but prevents you from doing a lot of social things (can't use the player marketboard, can't form parties but can be invited, can't use most forms of in game chat other than party chat) for this reason.
I’ve never worked at a large company. And I can’t imagine how decisions are made specifically at GitHub, or what bureaucratic nightmare managers have to go through to start combating malicious repositories.
If it's not someone's specific responsibility to handle it, it probably won't get done. That's the big company way. There's probably no team responsible for this type of thing there since it hasn't been a big enough problem for them to care yet.
At the scale at which GitHub operates, it's essentially a social network. The basic Section 230 protection applies - the responsibility of content uploaded to GH resides with the uploader, not GH itself.
Thus, the only reason GH has to proactively remove malicious repositories is whether there is bad press for them.
(Whether GH should be treated as a content distributor according to section 230 is maybe a matter of debate, but with the caveat of not being a lawyer nor studying GH's T&Cs exhaustively, I'm pretty sure they rely on them).
You don’t have to make excuses for shitty behaviour by corporations.
the only reason GH has to proactively remove malicious repositories is whether there is bad press for them
There are plenty more reasons. You realise the law only forbids egregious violations of ethics and morality? It sets a lower limit, and it is not the case that everything that is not forbidden is good.
You don’t have to make excuses for shitty behaviour by corporations.
That was uncalled for. The message you are responding to provided a reasonable explanation, in good faith, that helps to understand why a certain company (in this case Microsoft) would do the obviously wrong thing. The message was not justifying that behavior, but was providing a rationale for why a company would knowingly do the wrong thing that has many downstream negative externalities.
Two things can be simultaneously true: We can discuss and explain why Microsoft is doing the obviously wrong (not to mention stupid) thing, and we can also make a lot of noise to shame Microsoft into doing what Microsoft knows that Microsoft should have already done to help protect the companies that Microsoft is busy making buckets-full of money from.
Did I mention that Microsoft is making a conscious choice to expose its users and customers to malware via Github? And that Microsoft is choosing to host that malware itself on Github?
DustyFuzzy | 10 hours ago
The answer is most likely like any other security team: they are understaffed and underfunded.
But also, when it comes to large platforms, you generally cannot just go after the obvious, it's a cat and mouse game, and your opponents outnumber you 10:1.
If you delete based on wording, they can just change the wording. What you want to do is use the easy, obvious indicator to find the less obvious indicators. Bot networks have infrastructure, you want to deduce it and use that as your indicator. Do the bots use the same residential proxy provider? Do they use a real browser, or just pretend to be one?
Once you have enough information to confidently be able to identity the bots, you then also need to be careful with applying it. You want to issue removals in waves, and keep them spaced enough that the operators cannot quickly find a way around your detection, but also often enough that it doesn't cause undue harm.
If you know how game developers handle cheating, this will sound familiar, it's basically the same playbook.
dijit | 7 hours ago
I work in gamedev (formerly AAA online stuff) and this is exactly right.
One caveat for readers though: it’s frustrating for users to ban in waves, because there is some non-zero time when cheating/bots are able to be rampant, and even if you make it unpredictable, after a wave there is always a concerted effort to active other accounts.
At least games have something of a barrier to entry (unless it’s free to play?)- but github accounts are free and you “win” bandwidth and storage which are pricey. I wouldn’t want to be in their shoes.
quasi_qua_quasi | 3 hours ago
FFXIV has a fairly expansive f2p trial in terms of how far you can progress but prevents you from doing a lot of social things (can't use the player marketboard, can't form parties but can be invited, can't use most forms of in game chat other than party chat) for this reason.
alandekok | 4 hours ago
Prioritizing reports of issues would help. From what I've seen, there are repos which have been reported, and stay up for a long time.
lyall | 14 hours ago
If it's not someone's specific responsibility to handle it, it probably won't get done. That's the big company way. There's probably no team responsible for this type of thing there since it hasn't been a big enough problem for them to care yet.
strongoose | 12 hours ago
I assume most of GitHub has been fired and replaced by a chatbot.
gerikson | 12 hours ago
At the scale at which GitHub operates, it's essentially a social network. The basic Section 230 protection applies - the responsibility of content uploaded to GH resides with the uploader, not GH itself.
Thus, the only reason GH has to proactively remove malicious repositories is whether there is bad press for them.
(Whether GH should be treated as a content distributor according to section 230 is maybe a matter of debate, but with the caveat of not being a lawyer nor studying GH's T&Cs exhaustively, I'm pretty sure they rely on them).
fanf | 11 hours ago
You don’t have to make excuses for shitty behaviour by corporations.
There are plenty more reasons. You realise the law only forbids egregious violations of ethics and morality? It sets a lower limit, and it is not the case that everything that is not forbidden is good.
cpurdy | 5 hours ago
That was uncalled for. The message you are responding to provided a reasonable explanation, in good faith, that helps to understand why a certain company (in this case Microsoft) would do the obviously wrong thing. The message was not justifying that behavior, but was providing a rationale for why a company would knowingly do the wrong thing that has many downstream negative externalities.
Two things can be simultaneously true: We can discuss and explain why Microsoft is doing the obviously wrong (not to mention stupid) thing, and we can also make a lot of noise to shame Microsoft into doing what Microsoft knows that Microsoft should have already done to help protect the companies that Microsoft is busy making buckets-full of money from.
Did I mention that Microsoft is making a conscious choice to expose its users and customers to malware via Github? And that Microsoft is choosing to host that malware itself on Github?
gerikson | 10 hours ago
I'm am not making excuses for GitHub's behavior, merely providing my explanation for why they're not more aggressive in removing content like this.