11–20 of 43 posts
I approve of the handling, but this just underscores why you want self-hosted instances.
You don't hear about intrusions into self-hosted source repositories. Not because there are fewer, but because they likely don't have the security infrastructure in place to know that they ever happened.
We received an email from Github yesterday informing us that one of our repositories had been accessed by a third party due to this issue. While it's not a fun notification to receive, it definitely made our general security paranoia feel justified – we're lucky that from the get-go we've held best practices around keeping secrets out of the codebase. Obviously we still dedicated time as a team to prune through our r…
We received an email from Github yesterday informing us that one of our repositories had been accessed by a third party due to this issue. While it's not a fun notification to receive, it definitely made our general security paranoia feel justified – we're lucky that from the get-go we've held best practices around keeping secrets out of the codebase. Obviously we still dedicated time as a team to prune through our r…
I'm curious, how did they calculate entropy? My first thought was to do something with Huffman encoding.
Earlier quoted context omitted.
I'm curious, how did they calculate entropy? My first thought was to do something with Huffman encoding.
I wrote the script in question and actually used a simple shannon entropy value. ( http://codereview.stackexchange.com/questions/868/calculatin... ). It worked well enough help rule out several problem spaces.
It might be a fun thing to open source as part of a "I've inherited a project, what now?" toolkit that helps you decide what to fix.
Earlier quoted context omitted.
I wrote the script in question and actually used a simple shannon entropy value. ( http://codereview.stackexchange.com/questions/868/calculatin... ). It worked well enough help rule out several problem spaces.
Would you mind posting the script? I'd love to run it against our codebase and see what it comes up with. It might be a fun thing to open source as part of a "I've inherited a project, what now?" toolkit that helps you decide what to fix.
https://gist.github.com/jasonmoo/06691c8fea09b62aa35235fc93e...
I approve of the handling, but this just underscores why you want self-hosted instances.
Does it? Except for very sophisticated organizations, I doubt it. You don't hear about intrusions into self-hosted source repositories. Not because there are fewer, but because they likely don't have the security infrastructure in place to know that they ever happened.
Earlier quoted context omitted.
Github Enterprise is on-premise too. I don't know that this would make you necessarily want to make both the change to self-hosting, and the change of platform.
Because there is one critical characteristic in a private repository, and they failed to execute. Moving on-prem doesn't fix that failure, it just mitigates fallout.
Surely they do some end-to-end testing?
I approve of the handling, but this just underscores why you want self-hosted instances.
Does it? Except for very sophisticated organizations, I doubt it. You don't hear about intrusions into self-hosted source repositories. Not because there are fewer, but because they likely don't have the security infrastructure in place to know that they ever happened.
[Edit: Multiple downvotes within moments of each other do not make calling out the above speculation any less justified.]