Live data from Hacker News

Microsoft's GitHub account allegedly hacked, 500GB stolen

bleepingcomputer.com

81–90 of 126 posts

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#81

Earlier quoted context omitted.

I have already made the case to privately self-host What makes you think you can do a better job than Microsoft or github?

Smaller target?

Exactly. Same reason you shouldn't upload your private keys to a popular, centralized entity.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#82

Earlier quoted context omitted.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

Ah source code at MS. Always amusing to me. VSS [1] (Visual Source Safe) was terrible and I always wondered how "real" companies could use it. From what I heard, MS never did use it, they bought it and sold licenses. That's it.

That being said, Microsoft actually moved Windows to Git [2] years and years ago. Presumably they did the same with everything else. Team Foundation Server (TFS) supports Git, so they probably have the critical stuff on that TFS still, rather than GitHub. Especially since those repo's are huge.

[1] https://en.wikipedia.org/wiki/Microsoft_Visual_SourceSafe [2] https://arstechnica.com/information-technology/2017/02/micro...

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#83
From the article:

> Microsoft employee Sam Smith replied to Under the Breach’s tweet stating that he thought the leak was fake as “Msft has a “rule” that GitHub repos must be public within 30 days.”

Does that mean MS bans the use of GitHub for permanently storing private repos?

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#84

Earlier quoted context omitted.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

> some VSS-based thing I think

It was Source Depot, a fork of Perforce.

However, IIRC they moved to a git based Git Virtual File System for windows development a few years back..

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#85

Earlier quoted context omitted.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

> some VSS-based thing I think It was Source Depot, a fork of Perforce. However, IIRC they moved to a git based Git Virtual File System for windows development a few years back..

>Git Virtual File System

Hows that coming along, I wonder.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#86

From the article: > Microsoft employee Sam Smith replied to Under the Breach’s tweet stating that he thought the leak was fake as “Msft has a “rule” that GitHub repos must be public within 30 days.” Does that mean MS bans the use of GitHub for permanently storing private repos?

Comment above says their private stuff is on azure devops

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#87

Gentle reminder that any private repository is sensitive, because the people pushing to them might not be as careful with what they push, because it's private. There are hundreds of different kinds of credentials that can be hidden all throughout the history of a Git repo (in code, in logs, in comments, binary blobs, etc). If you don't have a very robust credential scanner operating continuously, and you have a large…

Considering these repos are meant to be made public within 30 days, I'd hope Microsoft employees would be more careful when pushing. Leaving it to a last minute cleanup sounds like a recipe for disaster.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#88
post #85

Earlier quoted context omitted.

> some VSS-based thing I think It was Source Depot, a fork of Perforce. However, IIRC they moved to a git based Git Virtual File System for windows development a few years back..

>Git Virtual File System Hows that coming along, I wonder.

It was released, and was used for the Windows repo. Search "vfs for git" - it's open source.

Then macOS removed kernel extensions, so they came up with a different approach and released that too. Search "scalar" to see it.

Post reply on HN