<http://schema.org/articleBody>
"GitHub, a popular software development service, announced on Friday that it migrated all developer Pages hosted on its servers to a new domain because of security concerns it had regarding malicious websites.\r\n\r\nIn essence, the company felt that users who came to github.com would feel that Pages hosted on there were automatically secure since it was under the GitHub domain -- this wasn't necessarily true. To separate itself from any issues, GitHub has migrated Pages to github.io.\r\n\r\nWhile it has 3 million users, GitHub is perhaps visited daily by many more. Its GitHub Pages offering was created to offer developers a resource so that they could create webpages for their projects in a manner that would be appealing to potential users, companies, and maybe even investors. The company not only offered developers free hosting, but also a page generator with specific themes.\r\nTrust GitHub, but don't put 100% trust in Pages\r\nAccording to GitHub's Ryan Tomayko, this migration was a security measure aimed at &amp;quot;removing potential vectors for cross domain attacks targeting the main github.com session as well as vectors for phishing attacks relying on the presence of the &amp;quot;github.com&amp;quot; domain to build a false sense of trust in malicious websites.&amp;quot;\r\n\r\nTranslated simply as: because you visited a GitHub.com page, you assumed that everything was secure, when it wasn't necessarily 100 percent of the time, so to avoid any confusion, all Pages are on a .io domain while the GitHub you trust is still at its .com domain.\r\nBrowser and phishing attacks\r\nTomayko says that this change was brought about because of two broad categories of vulnerabilities. The first one centered around session fixation and CSRF vulnerabilities from a browser security issue called &amp;quot;Related Domain Cookies&amp;quot;. Through this, an attacker could create a piece of code that could deny access to GitHub.com.\r\n\r\nAdditionally, GitHub is worried about phishing attacks that it says rely on the fact that there's a github.com domain to create a &amp;quot;false sense of trust in malicious websites.&amp;quot; It cites an example in which an attacker could set up a Page site at account-security.github.com and ask users to input passwords, billing information, or anything else confidential.\r\n\r\nBut even with these concerns, GitHub says that it does not have any evidence of any account being compromised as a result of either vulnerability.\r\nPrecedent of malicious intent\r\nThis change definitely is needed, especially following its most recent battle with online criminals who pushed randomware hosted on GitHub's Pages last February. In that episode, malware was served through GitHub Pages that infected computers using the Stamp EK exploit kit. As we reported back then, using legitimate websites for hosting malware reduces the chance that victims will become suspicious.\r\nWhat GitHub did\r\nFor those developers who have a GitHub Page (with a domain username.github.com), it has automatically been redirected to the new location (username.github.io) and the company says no links will need to be changed. If a custom domain has been set of for a Page, then you need not worry as this change does not affect you.\r\n\r\nIf you're interested in the technical details, GitHub has provided some more tidbits of information:\r\n\r\n\r\n\tAll\u00A0User, Organization, and Project Pages\u00A0not configured with a\u00A0custom domain\u00A0are now hosted on\u00A0github.io\u00A0instead of\u00A0github.com. For instance,username.github.com\u00A0is now served canonically from\u00A0username.github.io.\r\n\tAn\u00A0HTTP 301 Moved Permanently\u00A0redirect has been added for all\u00A0*.github.comsites to their new\u00A0*.github.io\u00A0locations.\r\n\tPages sites configured with a\u00A0custom domain\u00A0are not affected.\r\n\tThe Pages IP address has not changed. Existing A records pointing to the Pages IP are not affected.\r\n\r\n\r\nSo if you see a GitHub.com web address now, it's most likely going to be comprised of content produced by the company instead of from a third-party developer. If you need to see Pages, there's the .io domain, but while the Pages have been migrated, there is no added guarantee that they are safe and without any malicious intent.\r\n\r\nPhoto credit:\u00A0Sean Gallup/Getty Images"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/insider/2013/04/07/github-moves-pages-from-domain-over-security-concerns/>