Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MySQL infrastructure testing automation at GitHub

githubengineering.com

Post reply on HN
Print view View original

11–19 of 19 posts

Re: MySQL infrastructure testing automation at GitHub

#11

Post by philovivero »

andy_ppp wrote: post #10

I take it from this blog that any engineer at GitHub can get a copy of anyone's data. I find this vaguely terrifying, especially because Yahoo! was so careful internally about what an engineer could actually get access to. Most data like this had usernames/names/emails/other sensitive info redacted. Can anyone at GitHub get a copy of my private repo(s) because I'm out if they can. "Move fast and take a copy of the re…

I'm curious: what have you ever seen Github publish that would indicate there was any such security around your private repos within their organisation? I would have assumed there was none myself, but you seem to've assumed they'd treat your private repos like financial data or something.

Legit question, in case someone thinks I'm trolling or whatever.

Re: MySQL infrastructure testing automation at GitHub

#12

Post by andy_ppp »

philovivero wrote: post #11
andy_ppp wrote: post #10

I take it from this blog that any engineer at GitHub can get a copy of anyone's data. I find this vaguely terrifying, especially because Yahoo! was so careful internally about what an engineer could actually get access to. Most data like this had usernames/names/emails/other sensitive info redacted. Can anyone at GitHub get a copy of my private repo(s) because I'm out if they can. "Move fast and take a copy of the re…

I'm curious: what have you ever seen Github publish that would indicate there was any such security around your private repos within their organisation? I would have assumed there was none myself, but you seem to've assumed they'd treat your private repos like financial data or something. Legit question, in case someone thinks I'm trolling or whatever.

I think they'd treat my data as if it's like gold and not any engineer can take a copy because:

a) potentially threaten GitHub's business (blackmail, disgruntled employee, internal threat, security services, concerned comments like this etc.)

b) real companies store their source code on GitHub; their source code is, at least, 50% of their business.

c) GitHub isn't really a startup anymore, they have hundreds of employees, you can't let that many people have unfettered access to data. Someone could loose a laptop...

d) As mentioned, Yahoo! was very careful with customer data

e) It's called a Private Repo

I'm making a big set of assumptions, you are right. I'll move my GitHub to my own server now... installing GitLab which I absolutely hate but it's better than trusting an unknown set of engineers.

I've just realised probably any Digital Ocean engineer can get root on my box if they want to right :-(

Re: MySQL infrastructure testing automation at GitHub

#13

Post by leesalminen »

andy_ppp wrote: post #12
philovivero wrote: post #11

Earlier quoted context omitted.

I'm curious: what have you ever seen Github publish that would indicate there was any such security around your private repos within their organisation? I would have assumed there was none myself, but you seem to've assumed they'd treat your private repos like financial data or something. Legit question, in case someone thinks I'm trolling or whatever.

I think they'd treat my data as if it's like gold and not any engineer can take a copy because: a) potentially threaten GitHub's business (blackmail, disgruntled employee, internal threat, security services, concerned comments like this etc.) b) real companies store their source code on GitHub; their source code is, at least, 50% of their business. c) GitHub isn't really a startup anymore, they have hundreds of emplo…

Why do you hate GitLab? I've had it deployed for nearly a year and some recent releases have resolved many of my concerns.

> I've just realised probably any Digital Ocean engineer can get root on my box if they want to right :-(

I would assume yes.

Re: MySQL infrastructure testing automation at GitHub

#14

Post by andy_ppp »

leesalminen wrote: post #13
andy_ppp wrote: post #12

Earlier quoted context omitted.

I think they'd treat my data as if it's like gold and not any engineer can take a copy because: a) potentially threaten GitHub's business (blackmail, disgruntled employee, internal threat, security services, concerned comments like this etc.) b) real companies store their source code on GitHub; their source code is, at least, 50% of their business. c) GitHub isn't really a startup anymore, they have hundreds of emplo…

Why do you hate GitLab? I've had it deployed for nearly a year and some recent releases have resolved many of my concerns. > I've just realised probably any Digital Ocean engineer can get root on my box if they want to right :-( I would assume yes.

Just can never bloody find the thing I want. It's the same when I drink Pepsi or Burger King; purely psychological...

Re: MySQL infrastructure testing automation at GitHub

#15

Post by Aeyris »

andy_ppp wrote: post #14
leesalminen wrote: post #13

Earlier quoted context omitted.

Why do you hate GitLab? I've had it deployed for nearly a year and some recent releases have resolved many of my concerns. > I've just realised probably any Digital Ocean engineer can get root on my box if they want to right :-( I would assume yes.

Just can never bloody find the thing I want. It's the same when I drink Pepsi or Burger King; purely psychological...

You want to at least have some control over the hardware. Disk encryption on a dedicated server or (even more ideally) a caged, locked, colocated rack.

The system administrators of anything multi-tenant can access your data. The problem is they probably don't care. It's up to you where to draw that line, though.

"Administering a mail host is sort of like being a nurse; there's a brief period at the start when the thought of seeing people's privates might be vaguely titillating in a theoretical sense, but that sort of thing doesn't last long when it's up against the daily reality of mess. Now that I think about it, administering a mail host is exactly like being a nurse, only people die slightly less often."

Re: MySQL infrastructure testing automation at GitHub

#16

Post by danso »

philovivero wrote: post #11
andy_ppp wrote: post #10

I take it from this blog that any engineer at GitHub can get a copy of anyone's data. I find this vaguely terrifying, especially because Yahoo! was so careful internally about what an engineer could actually get access to. Most data like this had usernames/names/emails/other sensitive info redacted. Can anyone at GitHub get a copy of my private repo(s) because I'm out if they can. "Move fast and take a copy of the re…

I'm curious: what have you ever seen Github publish that would indicate there was any such security around your private repos within their organisation? I would have assumed there was none myself, but you seem to've assumed they'd treat your private repos like financial data or something. Legit question, in case someone thinks I'm trolling or whatever.

I don't run a company myself but I would think that the enterprise offering would have some security assurances. Does Github say that its services aren't appropriate for purposes other than open-source development?

By security, though, I wouldn't expect the guarantees of financial data or whatever, but internal audit and access controls, i.e. not the scenario of "any engineer at Github" that the GP has inferred. IIRC, for example, at Google only specific engineers, such as SREs, are given uber-access to user data as part of their duties: https://techcrunch.com/2010/09/14/google-engineer-spying-fir...

Re: MySQL infrastructure testing automation at GitHub

#17

Post by mnutt »

andy_ppp wrote: post #12
philovivero wrote: post #11

Earlier quoted context omitted.

I'm curious: what have you ever seen Github publish that would indicate there was any such security around your private repos within their organisation? I would have assumed there was none myself, but you seem to've assumed they'd treat your private repos like financial data or something. Legit question, in case someone thinks I'm trolling or whatever.

I think they'd treat my data as if it's like gold and not any engineer can take a copy because: a) potentially threaten GitHub's business (blackmail, disgruntled employee, internal threat, security services, concerned comments like this etc.) b) real companies store their source code on GitHub; their source code is, at least, 50% of their business. c) GitHub isn't really a startup anymore, they have hundreds of emplo…

_Someone could loose a laptop..._

Your overall point is valid, but employee losing a laptop is a much narrower problem to solve for: set JAMF policies that enforce full-disk encryption and reasonably strong passwords, write off any machines that are lost/stolen. Figuring out employee trust models is a much broader/harder problem.

Re: MySQL infrastructure testing automation at GitHub

#18

Post by romanovcode »

andy_ppp wrote: post #10

I take it from this blog that any engineer at GitHub can get a copy of anyone's data. I find this vaguely terrifying, especially because Yahoo! was so careful internally about what an engineer could actually get access to. Most data like this had usernames/names/emails/other sensitive info redacted. Can anyone at GitHub get a copy of my private repo(s) because I'm out if they can. "Move fast and take a copy of the re…

Of course they can. So can any other git srvice. If you want to own your data then only option you have is to host it yourself.

Re: MySQL infrastructure testing automation at GitHub

#19

Post by ethomson »

romanovcode wrote: post #18
andy_ppp wrote: post #10

I take it from this blog that any engineer at GitHub can get a copy of anyone's data. I find this vaguely terrifying, especially because Yahoo! was so careful internally about what an engineer could actually get access to. Most data like this had usernames/names/emails/other sensitive info redacted. Can anyone at GitHub get a copy of my private repo(s) because I'm out if they can. "Move fast and take a copy of the re…

Of course they can. So can any other git srvice. If you want to own your data then only option you have is to host it yourself.

You're technically correct, which is of course the best kind of correct. But it's not quite so easy.

I can't speak for any other Git hosting service, of course, but if you have a private repository in Microsoft Visual Studio Team Services then:

- all engineers are given a background check before being hired - very few engineers have access to production servers or databases, only those who have an operational neccesity - engineers that do have production access are given a still stricter background check

Certainly we don't have private repository just lying around, and yes we do treat them like they're your financial data.

Microsoft hosts all of its source code in VSTS, including Windows. This is data that we absolutely want to protect. Our customers' data is no different.

Post reply on HN