GitHub comments used to distribute malware (BleepingComputer)

Posted Apr 25, 2024 2:07 UTC (Thu) by Heretic_Blacksheep (guest, #169992)
Parent article: GitHub comments used to distribute malware (BleepingComputer)

I haven't used Github since I graduated a couple of years ago, and I only used it then because profs were kinda expecting us to use it. I never particularly cared for using the service so I only used it in very general terms...

I realize this isn't a good answer for people that are actively using Github to encourage project communication or cooperation, but for the average person that may only be using it casually, can comments be completely turned off to prevent this kind of thing when you have no wish to engage in this way?

GitHub comments used to distribute malware (BleepingComputer)

Posted Apr 25, 2024 6:42 UTC (Thu) by taladar (subscriber, #68407) [Link] (3 responses)

What do you expect turning off comments achieve in this case?

The problem isn't comments, the problem is file uploads for comments being made accessible outside of the comment context.

GitHub comments used to distribute malware (BleepingComputer)

Posted Apr 25, 2024 9:02 UTC (Thu) by Karellen (subscriber, #67644) [Link] (2 responses)

If people can't access the "post a comment" UI for a repo, how are they going to upload a file associated with a comment to it?

GitHub comments used to distribute malware (BleepingComputer)

Posted Apr 25, 2024 9:08 UTC (Thu) by NAR (subscriber, #1313) [Link]

Exactly, how are they going to upload e.g. a screenshot for a comment? Which is really useful for GUIs...

GitHub comments used to distribute malware (BleepingComputer)

Posted Apr 25, 2024 10:00 UTC (Thu) by sidcha (subscriber, #153938) [Link]

They (attacker) would just use another project that allows comments.

GitHub comments used to distribute malware (BleepingComputer)

Posted Apr 25, 2024 12:37 UTC (Thu) by daroc (editor, #160859) [Link]

It is in fact possible to disable issues, but only for a limited amount of time. And, of course, it prevents anyone from filing issues, which many projects have a use for.

GitHub comments used to distribute malware (BleepingComputer)

Posted Apr 25, 2024 12:43 UTC (Thu) by bluss (guest, #47454) [Link]

Users can comment on any commit in a github repo, not just in issues and PRs. To turn that off I think you have to go to the 'Limit to repository collaborators' setting for 6 months, it doesn't have an indefinite setting.