Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub’s engineering team has moved to Codespaces

github.blog

Post reply on HN
Print view View original

341–350 of 704 posts

Re: GitHub’s engineering team has moved to Codespaces

#341

Post by jordemort »

marcosdumay wrote: post #297
blueplanet200 wrote: post #221

Earlier quoted context omitted.

I don't think so. Software running on your computer has wholesale access to your filesystem. If those files are accessible only via the web (or if you bother setting up ssh + pubkey, via ssh) that significantly reduces the surface area of possible attacks. Don't hate on "not being impossible" for "being less likely."

"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You can claim it becomes "harder", what it does, a very small bit that doesn't warrant anything like the claims on the GP. All it changes is that the attacker will have to launch the browser or rewrite some part of it (what he can do, because the browser auto-updates with your access level), instead of simply taking the f…

I stand behind the idea that forcing everything through SSH to a VM they control or over HTTPS to a web app they control has meaningful security advantages. Of course you can craft a hostile client for any service, but it adds a barrier (and a place to run countermeasures) that wasn't there before. It definitely lessens the likelihood of getting caught up by some dumb untargeted drive-by malware, at least.

Also, do keep in mind the target audience for Microsoft's enterprise products - if something lets you check off a bunch of boxes on some government or industry compliance checklist, then that thing has value to those customers, regardless of any actual security benefit.

Re: GitHub’s engineering team has moved to Codespaces

#342

Post by nonameiguess »

bko wrote: post #208
msbarnett wrote: post #153

Earlier quoted context omitted.

I've never seen a company collapse because their garbage collector posted an Our Incredible Journey™ blog post and then shut down a week later. I have seen multiple companies collapse because the proprietary Backend-as-a-Service they built their sand castle on top of pulled a vanishing act, however.

There's plenty of companies that wasted a ton of resources trying to roll their own version of things that should be services. Remember when Uber built their own chat solution? [0] > With operations in over 620 cities, it was paramount for us to identify a chat solution that would enable Uber employees to reliably communicate on desktop and mobile regardless of where they were in the world. Did Uber really need their…

Crypto is almost always implemented as a library, and probably ultimately as a kernel module in most cases. There is no reason at all you should need to call out to a remote service to encrypt and decrypt data. That wouldn't even make sense, as it would need to be encrypted before traversing the network to be of any use. And there are plenty of commodity chat applications like Mattermost and RocketChat that you can self-host, again not necessarily needing to use someone else's cloud service but also not need to roll your own application.

Re: GitHub’s engineering team has moved to Codespaces

#343

Post by pydry »

arduinomancer wrote: post #322
cabirum wrote: post #316

It's all fun and games until big corps start adopting cloud-everything approach. There will be no devices left, only thin clients connecting to someones cloud and logging everything you see and do. Imagine your employer watching your every keystroke and getting instant performance metrics. Then some OverseerAI reporting that you didn't type for 10 minutes already, sending a notification to your boss.

How is that different from now? If you work for a big company you already have your laptop controlled by MDM software which can do whatever it wants.

Whatever cloud dev environment you use will shove productivity metrics up your manager's ass.

E.g. Employee A ran the tests 4 times an hour whereas employee B ran the tests twice an hour.

Re: GitHub’s engineering team has moved to Codespaces

#344

Post by [deleted] »

marcosdumay wrote: post #297
blueplanet200 wrote: post #221

Earlier quoted context omitted.

I don't think so. Software running on your computer has wholesale access to your filesystem. If those files are accessible only via the web (or if you bother setting up ssh + pubkey, via ssh) that significantly reduces the surface area of possible attacks. Don't hate on "not being impossible" for "being less likely."

"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You can claim it becomes "harder", what it does, a very small bit that doesn't warrant anything like the claims on the GP. All it changes is that the attacker will have to launch the browser or rewrite some part of it (what he can do, because the browser auto-updates with your access level), instead of simply taking the f…

[deleted]

Re: GitHub’s engineering team has moved to Codespaces

#345

Post by dang »

Some past related threads:

Developing Online with GitHub Codespace - https://news.ycombinator.com/item?id=24565606 - Sept 2020 (54 comments)

First Impressions of GitHub Codespaces - https://news.ycombinator.com/item?id=24339118 - Sept 2020 (93 comments)

GitHub Codespaces - https://news.ycombinator.com/item?id=23092904 - May 2020 (601 comments)

Re: GitHub’s engineering team has moved to Codespaces

#346

Post by ramraj07 »

hbn wrote: post #51
hackthememes wrote: post #31

So you're telling me that the next GitHub outage could take out my dev environment and give me an afternoon off? Time to convince management that we need to switch to Codespaces!

It's funny timing to announce this the day after a major outage that took down practically the entire platform

It’s very likely them doing pre rollout operations for this feature is actually what caused that outage though.

Re: GitHub’s engineering team has moved to Codespaces

#347

Post by jordemort »

jordemort wrote: post #341
marcosdumay wrote: post #297

Earlier quoted context omitted.

"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You can claim it becomes "harder", what it does, a very small bit that doesn't warrant anything like the claims on the GP. All it changes is that the attacker will have to launch the browser or rewrite some part of it (what he can do, because the browser auto-updates with your access level), instead of simply taking the f…

I stand behind the idea that forcing everything through SSH to a VM they control or over HTTPS to a web app they control has meaningful security advantages. Of course you can craft a hostile client for any service, but it adds a barrier (and a place to run countermeasures) that wasn't there before. It definitely lessens the likelihood of getting caught up by some dumb untargeted drive-by malware, at least. Also, do k…

The idea w/ the VM being that you could run all sorts of heavy anti-malware and pattern detection and file access analysis type of stuff ala CarbonBlack w/o having to manage deploying it to all your workstations and making sure it stays updated and functional there.

Re: GitHub’s engineering team has moved to Codespaces

#348

Post by blueplanet200 »

marcosdumay wrote: post #297
blueplanet200 wrote: post #221

Earlier quoted context omitted.

I don't think so. Software running on your computer has wholesale access to your filesystem. If those files are accessible only via the web (or if you bother setting up ssh + pubkey, via ssh) that significantly reduces the surface area of possible attacks. Don't hate on "not being impossible" for "being less likely."

"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You can claim it becomes "harder", what it does, a very small bit that doesn't warrant anything like the claims on the GP. All it changes is that the attacker will have to launch the browser or rewrite some part of it (what he can do, because the browser auto-updates with your access level), instead of simply taking the f…

>"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it.

You have N machines, M developers, with access to the internet and development environment E. What are the chances of someone stealing your code given N, M, and E.

Changes to N, M, and E change your expectation on the frequency and severity of attacks.

Re: GitHub’s engineering team has moved to Codespaces

#349

Post by soheil »

mbreese wrote: post #267
soheil wrote: post #259

Earlier quoted context omitted.

If you work from a park how do you manage your latency/connectivity to a remote server? It must get annoying fast when a pigeon flies over causing your hotspot to cut out.

I think the point is that a small random drop in latency affects the local connection, but not the remote server. So, if your SSH connection is a little flakey for a minute, that’s fine. The remote server is itself stable. It is also likely connected to a much bigger pipe, so pulling in a remote container is much faster than if you were doing the same thing from your laptop in the park. If you’re worried about your S…

If latency is high/nondeterministic every time you hit refresh in your browser to see your dev changes the delay gets compounded, productivity suffers and frustration intensifies.

Re: GitHub’s engineering team has moved to Codespaces

#350

Post by sngz »

BiteCode_dev wrote: post #212
gosukiwi wrote: post #91

Ugh, now not only you don't own your code ( ahem copilot cough ) you also don't own the tools to develop code. The direction the web is taking is worrisome. The issue is not so much senior devs, but new devs. If they start off with things like that, there' so much magic under the hood, they won't understand how anything works. They don't understand they don't own shit until it's too late. I remember when I first saw…

It's funny because we told people not to trust big companies, they tell us we are paranoid, they do it, they pay the price for it, then they say we were right, then they do it again. MS changed. Google changed. Apple changed. Why do one expect github to never turn evil ? Haven't learned enough from history ? Don't let them control your entire stack! Don't let anybody control the entire of anything. There is a differe…

github was already turning evil. and being bought by microsoft sealed the deal
Post reply on HN