Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's GitHub account allegedly hacked, 500GB stolen

bleepingcomputer.com

Post reply on HN
Print view View original

101–110 of 126 posts

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#101

Post by DiabloD3 »

ShakataGaNai wrote: post #82
DiabloD3 wrote: post #48

Earlier quoted context omitted.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

Ah source code at MS. Always amusing to me. VSS [1] (Visual Source Safe) was terrible and I always wondered how "real" companies could use it. From what I heard, MS never did use it, they bought it and sold licenses. That's it. That being said, Microsoft actually moved Windows to Git [2] years and years ago. Presumably they did the same with everything else. Team Foundation Server (TFS) supports Git, so they probably…

They moved to Git, from what I can tell as an outsider, as part of the "Balmer fucked Microsoft" clean up duty that produced a toxic and soon-to-be-fatal culture over there.

Github ended up being the final piece they needed after years of effort. Most of what I said in the earlier comment was what I pieced together from multiple (ex-)Microsoft people who chose to talk about it, over years.

TFS afiact started as just a repo manager (in the sense, does what Github does) for VSS and Perforce, with more modern support for other things, including Microsoft's gargantuan Git monorepo... but a lot of people at Microsoft still like Github Enterprise better.

I imagine given this, whatever TFS does better, Github Enterprise will learn to do over the next few years. Microsoft is big on eating their own dogfood now, but they don't seem to want to do Google sillyness where they have 20 products that do the same thing and let them fight it out in FFA arena combat (even Lync is still Lync underneath, it just keeps getting new frontends).

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#102

Post by pyramid07 »

rvz wrote: post #7

> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…

This sucks :(

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#103

Post by sproketboy »

jug wrote: post #3

Sounds sketchy given what the employee from Microsoft commented. The article is also not completely up to date with their “interesting” findings. For example, while a language projection for the Windows Runtime to Rust is interesting, it is also a public repository: https://github.com/microsoft/winrt-rs I’d take this article with a grain of salt until we hear more.

> I’d take this article with a grain of salt until

Until you M$ shills have more time to cover this up. Fuck you shill.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#105

Post by RandallBrown »

ShakataGaNai wrote: post #82
DiabloD3 wrote: post #48

Earlier quoted context omitted.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

Ah source code at MS. Always amusing to me. VSS [1] (Visual Source Safe) was terrible and I always wondered how "real" companies could use it. From what I heard, MS never did use it, they bought it and sold licenses. That's it. That being said, Microsoft actually moved Windows to Git [2] years and years ago. Presumably they did the same with everything else. Team Foundation Server (TFS) supports Git, so they probably…

I left Microsoft around 2013 when the transition to Git was announced.

At the time, most teams (that I encountered) used something called Source Depot. I was told that back in the day, MS licensed the source code from Perforce, forked it, and that became Source Depot. I do know there were some teams using TFS and I'm sure there were some smaller teams using Git too.

I'm not sure how the transition went, since I left before it started, but I would bet it's still at least somewhat ongoing. Some of the people on my team that had been at MS for awhile were EXTREMELY skeptical of change.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#106

Post by jacquesm »

Drip33 wrote: post #77
jacquesm wrote: post #63

Earlier quoted context omitted.

You probably shouldn't readily confess to hoarding stolen property in an online forum.

Not a crime to possess information, not property, that was illegally obtained in either USA or my own country provided you didn't counsel or encourage the original theft.

The fact that you did not commit the initial theft does not put you in the clear. Source: a lawsuit that I won with exactly that theme.

I don't know where you are but the bulk of the jurisdictions would not look favorable upon you. I agree that your loose interpretation of the law might work out in your favor. But just like downloading copyrighted material is illegal so is downloading copyrighted data from a source that you know does not have the option to legally give you a license to copy or use that data. So from one aspect of the law you are in the clear, from another this is an open-and-shut case of copyright violation and on top of that you will have to work real hard to prove that you weren't the one to steal it in the first place using the 'upload to someplace anonymous, then download it again' trick to whitewash the data.

Some risks are worth taking, this particular one I'd think long and hard about it if the counterparty is the proverbial 800 pound gorilla.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#107

Post by outside1234 »

input_sh wrote: post #46
cameronbrown wrote: post #33

Earlier quoted context omitted.

Considering Microsoft owns GitHub, there's no reasons their internal teams aren't choosing to host more code on there.

They also have a competing service: Azure DevOps (formerly Team Foundation Server, Visual Studio Team System), which somehow has barely anything to do with Azure. I believe that the stuff they're open sourcing go on GitHub, while the internal tools go on Azure DevOps. They also have their own VCS (Git alternative) called Team Foundation Version Control (TFVC), though I have no clue why they keep that thing around. Th…

Azure Devops is increasingly based on the same code as Github.

Github Actions and Azure Devops Pipelines, for example, utilize the same infrastructure in my understanding.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#108

Post by [deleted] »

algol10 wrote: post #91
nova22033 wrote: post #71

Earlier quoted context omitted.

I have already made the case to privately self-host What makes you think you can do a better job than Microsoft or github?

Could this stop? Every time some heretic evades the "cloud" and self-hosts, people (whose income presumably depends on the "cloud") spread FUD. Here's the security of the "cloud": https://arstechnica.com/information-technology/2012/03/hacke... Why on earth should a maintained server that just runs git over ssh be less secure?

[deleted]

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#110

Post by cptskippy »

giancarlostoro wrote: post #32
jug wrote: post #3

Sounds sketchy given what the employee from Microsoft commented. The article is also not completely up to date with their “interesting” findings. For example, while a language projection for the Windows Runtime to Rust is interesting, it is also a public repository: https://github.com/microsoft/winrt-rs I’d take this article with a grain of salt until we hear more.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Microsoft is moving everything to GitHub. We were at a MS training center recently for Azure DevOps training and the trainer said they were porting DevOps features without equivalent to GitHub and bringing a few things like YAML to DevOps in preparation for the transition.
Post reply on HN