> We cram our secrets into git Excuse me?!
If source code isn't public, it's a secret by the traditional definition of the word.
GitHub Private Repos Considered Private-Ish
11–20 of 150 posts
Re: GitHub Private Repos Considered Private-Ish
#12This indirectly outlines one of the primary reasons organizations (like mine) prefer using GitHub Enterprise - we get the collaboration benefits of GitHub, but our data is entirely controlled and hosted by us. It's extra work and more costly overall, but it's a small price to pay for the data security.
I think you mean GitHub Enterprise Server. GitHub Enterprise is still a cloud / SaaS product.
Re: GitHub Private Repos Considered Private-Ish
#13Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.”
https://docs.github.com/en/get-started/privacy-on-github/abo...
Re: GitHub Private Repos Considered Private-Ish
#14Recommendations missing from the article: - Enable mandatory 2fa within your Github organization (if you don't use an organization, you probably should) - Disable the ability to fork repos in your organization - Configure and enable mandatory SAML authentication. In combination with mandatory 2fa, this makes phishing and even key leakage less likely (specific keys need to be double authorized for SAML, so that random…
What does "Disable the ability to fork repos in your organization" do? Isn't that entirely defeated by users changing the origin?
Re: GitHub Private Repos Considered Private-Ish
#15Silly and HN hand-crafted. Too many noobs nowadays around lol
Re: GitHub Private Repos Considered Private-Ish
#16Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...
I never read that before but you are right and based on that wording looks like private repos are open to having LLMs trained upon them.
I assumed up to this point they could only use public ones but this wording suggests otherwise.
Re: GitHub Private Repos Considered Private-Ish
#17Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...
iirc, they said they wouldn't do this? so this could just refer to secret scanning
Re: GitHub Private Repos Considered Private-Ish
#18Recommendations missing from the article: - Enable mandatory 2fa within your Github organization (if you don't use an organization, you probably should) - Disable the ability to fork repos in your organization - Configure and enable mandatory SAML authentication. In combination with mandatory 2fa, this makes phishing and even key leakage less likely (specific keys need to be double authorized for SAML, so that random…
Your other points are useful but I find the below questionable and counterproductive:
> - Disable the ability to fork repos in your organization
If someone can read it, they can trivially fork it (clone locally, then republish as new repo). The only thing you're preventing with this advice is the free discoverability and tracking of forks which you get with forks created with the GitHub "fork" button. The forks are still there but now you have a harder time finding them.
Re: GitHub Private Repos Considered Private-Ish
#19Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...
Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.
Re: GitHub Private Repos Considered Private-Ish
#20Recommendations missing from the article: - Enable mandatory 2fa within your Github organization (if you don't use an organization, you probably should) - Disable the ability to fork repos in your organization - Configure and enable mandatory SAML authentication. In combination with mandatory 2fa, this makes phishing and even key leakage less likely (specific keys need to be double authorized for SAML, so that random…
What does "Disable the ability to fork repos in your organization" do? Isn't that entirely defeated by users changing the origin?
Yes, it's just lip service. The moment you've cloned a repo to your computer, you have "forked" it. It's simply the nature of decentralized version control.