Notes ·
GitHub Is Still Struggling With Obvious Malware Repositories
The repositories reportedly reuse nearly identical README structures, download headings and archive links. The author says a simple script found 10,000 of them, and GitHub removed that initial list shortly after the issue received public attention. New repositories using the same recognizable pattern allegedly remained online afterward.
The article asks a fair question: why is GitHub responding to individual reports instead of detecting and disrupting the pattern?
GitHub before Microsoft had a deserved reputation for bro culture, misogyny and an unhealthy workplace. I would not trade better treatment of employees for a supposedly better product.
But the product has real pain points now. Pages can be painfully slow, bugs linger, search behaves inconsistently and obvious abuse can remain visible on one of the most important software platforms in the world.
Malware distribution is not a simple moderation problem. GitHub has to avoid automatically deleting legitimate security research, reverse-engineering tools and software that happens to match a crude pattern. Attackers can also create new accounts and alter their templates faster than a basic filter can respond.
Still, when thousands of malicious repositories share obvious traits and can be found through GitHub’s own search, repeatedly removing lists supplied by outsiders is not a sufficient defense.
Hopefully GitHub finds a way to combine automated detection, reputation signals and human review without harming legitimate projects. The platform is too important to remain an easy distribution network for commodity malware.
Read “What does GitHub’s security team even do?” at Orchid Files.