Microsoft's GitHub account allegedly hacked, 500GB stolen • Hacker News Board

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#111

Post by cptskippy » Thu, May 07, 2020, 8:42 PM UTC

DiabloD3 wrote: post #48

giancarlostoro wrote: post #32

Earlier quoted context omitted.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

Microsoft moved from VSTS Source Control to Git over 3 years ago.

VSS hasn't been used in a decade or more.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#112

Post by aksss » Thu, May 07, 2020, 9:05 PM UTC

DiabloD3 wrote: post #101

ShakataGaNai wrote: post #82

Earlier quoted context omitted.

Ah source code at MS. Always amusing to me. VSS [1] (Visual Source Safe) was terrible and I always wondered how "real" companies could use it. From what I heard, MS never did use it, they bought it and sold licenses. That's it. That being said, Microsoft actually moved Windows to Git [2] years and years ago. Presumably they did the same with everything else. Team Foundation Server (TFS) supports Git, so they probably…

They moved to Git, from what I can tell as an outsider, as part of the "Balmer fucked Microsoft" clean up duty that produced a toxic and soon-to-be-fatal culture over there. Github ended up being the final piece they needed after years of effort. Most of what I said in the earlier comment was what I pieced together from multiple (ex-)Microsoft people who chose to talk about it, over years. TFS afiact started as just…

> Lync is still Lync

mmm.. I know what you're saying but the change to Teams from a VOIP perspective substantially changed some of the under-the-hood stuff. They stood up a facade to offer luke-warm integration from SfB/Lync IP phones (authentication and basic calling, but that's about it). AFAIK this wasn't just a breaking change but a re-arch of some of the backend. Point being, they may be evolutions but the move to Teams is not just a new front-end. Substantial evolution has happened since we first installed server stacks to support Lync, even though we still see Lync fingerprints and junk dna everywhere.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#113

Post by aksss » Thu, May 07, 2020, 9:15 PM UTC

cptskippy wrote: post #111

DiabloD3 wrote: post #48

Earlier quoted context omitted.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

Microsoft moved from VSTS Source Control to Git over 3 years ago. VSS hasn't been used in a decade or more.

Right, I last used VSS in like 2008 or so and it was a pretty tired old tool by then. I mean, it worked, especially in the world it was built for in late 90's (corporate on-premise LAN stuff) - I can't remember any big complaints with it, although I do remember an occasional corruption, but was never f'd over by it. Unsuitable to the distributed and scaled world of today for sure.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#114

Post by aksss » Thu, May 07, 2020, 9:28 PM UTC

algol10 wrote: post #91

nova22033 wrote: post #71

Earlier quoted context omitted.

I have already made the case to privately self-host What makes you think you can do a better job than Microsoft or github?

Could this stop? Every time some heretic evades the "cloud" and self-hosts, people (whose income presumably depends on the "cloud") spread FUD. Here's the security of the "cloud": https://arstechnica.com/information-technology/2012/03/hacke... Why on earth should a maintained server that just runs git over ssh be less secure?

It's an overused and abused argument but it's not a null argument (e.g. just FUD). It has enough validity not to overcorrect the other way. As a general rule, organizations at least need to carefully consider the true cost commitments of providing even near-par level of security with their own internal resources as they could get 'out-of-the-box' from a cloud provider. It's easy for organizations to imagine they will, quite another for most to actually pull it off in an auditable fashion. The minute an org starts opening holes in their firewalls to accommodate remote access or using cloud-based tools for remote access, I start to get skeptical (e.g. how well is that network segregated, anyway?). The shear volume of internal process and policy dependencies that need to be managed and maintained to "do it right" is a supremely tough burden for SMBs, for instance.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#115

Post by wwwigham » Thu, May 07, 2020, 9:50 PM UTC

orta wrote: post #100

factorialboy wrote: post #83

From the article: > Microsoft employee Sam Smith replied to Under the Breach’s tweet stating that he thought the leak was fake as “Msft has a “rule” that GitHub repos must be public within 30 days.” Does that mean MS bans the use of GitHub for permanently storing private repos?

We (the TypeScript team) have a bunch of private repos (blog post drafts, planning docs, reproduction repos, rando internal tooling ) on GitHub that are many years old. I'm pretty sure that Sam was mistaken here.

To be fair, we had to file for exceptions to the 30 day policy for a lot those. Not that any of them are terribly important to be private; a private GitHub repo is just a convenient discussion form for collaboratively composing blog posts and such (change tracking and reviews are so nice). The blog post one, in particular, probably gets a pass because everything composed on it is eventually published in the open anyway (albeit without the discussion and editorial history).

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#116

Post by Drip33 » Thu, May 07, 2020, 9:59 PM UTC

jacquesm wrote: post #106

Drip33 wrote: post #77

Earlier quoted context omitted.

Not a crime to possess information, not property, that was illegally obtained in either USA or my own country provided you didn't counsel or encourage the original theft.

The fact that you did not commit the initial theft does not put you in the clear. Source: a lawsuit that I won with exactly that theme. I don't know where you are but the bulk of the jurisdictions would not look favorable upon you. I agree that your loose interpretation of the law might work out in your favor. But just like downloading copyrighted material is illegal so is downloading copyrighted data from a source t…

>The fact that you did not commit the initial theft does not put you in the clear. Source: a lawsuit that I won with exactly that theme.

In terms of criminal law, it is favorable to me. Source: I was criminally accused and have a court judgement clearing me of wrongdoing for possessing information that was stolen by 3rd parties and published online before I obtained it.

>So from one aspect of the law you are in the clear, from another this is an open-and-shut case of copyright violation

I am satisfied that merely possessing stolen information and not distributing or profiting from it is not a copyright violation if the source code can even be copyrighted.

>But just like downloading copyrighted material is illegal so is downloading copyrighted data from a source that you know does not have the option to legally give you a license to copy or use that data

I have not agreed to be bound by any licenses from Cisco before downloading the data nor did I necessarily know what it was before downloading a zip from a file sharing site.

I'm happy to discuss this over email if you want me to reach out for debate.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#117

Post by myko » Thu, May 07, 2020, 10:10 PM UTC

outside1234 wrote: post #107

input_sh wrote: post #46

Earlier quoted context omitted.

They also have a competing service: Azure DevOps (formerly Team Foundation Server, Visual Studio Team System), which somehow has barely anything to do with Azure. I believe that the stuff they're open sourcing go on GitHub, while the internal tools go on Azure DevOps. They also have their own VCS (Git alternative) called Team Foundation Version Control (TFVC), though I have no clue why they keep that thing around. Th…

Azure Devops is increasingly based on the same code as Github. Github Actions and Azure Devops Pipelines, for example, utilize the same infrastructure in my understanding.

It's a lot nicer to use on the GitHub side, and more organized (.github/workflows/foo.yaml vs a yaml in the root of the project for all "Actions")

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#118

Post by kyuudou » Thu, May 07, 2020, 10:47 PM UTC

capableweb wrote: post #15

6c696e7578 wrote: post #4

So a closed source software company buys an open source tool company, and inadvertently make closed source open source! Or, in other words, if you want to keep something private, don't put it in the "cloud"!

Me and a friend were having coffee and were discussing secrets something like 10 years ago. The conclusion of our conversation was "Everything always comes out" (translated from Swedish [context was some gossip that eventually leaked about our common friend]) which boils down to that the only way you can really ensure something stays secret forever, is by only having it in your mind and not sharing it. As soon as you…

>"Everything always comes out" (translated from Swedish)

"What's done in darkness will come to light" is an oft-used adage in English of Biblical origin. Many variations. I agree with it, too.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#119

Post by WorldMaker » Thu, May 07, 2020, 10:57 PM UTC

noahl wrote: post #88

jayd16 wrote: post #85

Earlier quoted context omitted.

>Git Virtual File System Hows that coming along, I wonder.

It was released, and was used for the Windows repo. Search "vfs for git" - it's open source. Then macOS removed kernel extensions, so they came up with a different approach and released that too. Search "scalar" to see it.

It may be useful to note that "scalar" is mostly (albeit not entirely) a git (auto) configuration tool using (now) built-in tools like sparse checkouts and sparse checkout "cones", it shows how much of Microsoft's improvements have made it upstream into git itself. (And it is a stated goal of "scalar" that everything eventually should be.)

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#120

Post by dependenttypes » Fri, May 08, 2020, 12:21 AM UTC

jlgaddis wrote: post #93

dependenttypes wrote: post #80

Earlier quoted context omitted.

Having openpgp-signed commits would prevent such an issue.

Would it? Couldn't the "hacker" have simply generated a new GPG key and added it to the account he had control of?

The users would have specific keys trusted.