GitHub Private Repos Considered Private-Ish • Hacker News Board

Re: GitHub Private Repos Considered Private-Ish

#21

Post by cj » Sun, Jun 04, 2023, 1:28 PM UTC

flerchin wrote: post #14

cj wrote: post #9

Recommendations missing from the article: - Enable mandatory 2fa within your Github organization (if you don't use an organization, you probably should) - Disable the ability to fork repos in your organization - Configure and enable mandatory SAML authentication. In combination with mandatory 2fa, this makes phishing and even key leakage less likely (specific keys need to be double authorized for SAML, so that random…

What does "Disable the ability to fork repos in your organization" do? Isn't that entirely defeated by users changing the origin?

It prevents it from happening in the GitHub UI.

Of course it’s still possible to download the code and upload it to a separate repo (but then it’s not a fork).

Re: GitHub Private Repos Considered Private-Ish

#22

Post by capableweb » Sun, Jun 04, 2023, 1:30 PM UTC

gumballindie wrote: post #19

waynecochran wrote: post #13

Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...

Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.

> formerly reputable corporations

I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.

Re: GitHub Private Repos Considered Private-Ish

#23

Post by mtlmtlmtlmtl » Sun, Jun 04, 2023, 1:30 PM UTC

paddw wrote: post #17

waynecochran wrote: post #13

Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...

iirc, they said they wouldn't do this? so this could just refer to secret scanning

Clearly they lied, if their policy says otherwise.

Re: GitHub Private Repos Considered Private-Ish

#24

Post by quickthrower2 » Sun, Jun 04, 2023, 1:31 PM UTC

Avoid having secrets if you can. Use authentication methods that don’t require them. When they are required rotate them often - ideally automated. Keep them out of password managers. They are like condoms: cheap enough to use once, unpleasant if used twice. Hence the common UX where you get to see the key once encourages using once.

Give those tokens the minimum permissions possible. Make sure the impact of needing to rotate that secret doesn’t mean other secrets are exposed (looking at you: azure storage account primary access key!) Automated rotations make keeping them up to date in git untenable anyway.

Some services like Vercel and Firebase encourage bad practices in this regard. Firebase requires you to download a plaintext JSON of kingdom keys in order to do anything useful! Vercel KV storage encourages you to run an SDK command to download prod secrets into a local env file.

Re: GitHub Private Repos Considered Private-Ish

#25

Post by falcor84 » Sun, Jun 04, 2023, 1:31 PM UTC

cobbal wrote: post #11

justizin wrote: post #2

> We cram our secrets into git Excuse me?!

If source code isn't public, it's a secret by the traditional definition of the word.

A secret is something that you go out of your way to keep private. But there are a lot of other things that are private by default, but aren't really secrets, like "the brand of toilet paper I use".

Re: GitHub Private Repos Considered Private-Ish

#26

Post by mikeryan » Sun, Jun 04, 2023, 1:31 PM UTC

I dunno about other people but I’ve always assumed that if we’re giving employees, who we may have to fire someday, access to the code base that repos should be treated as if they could be exposed to the world at any time any way.

Re: GitHub Private Repos Considered Private-Ish

#27

Post by tln » Sun, Jun 04, 2023, 1:33 PM UTC

How about encryption?

https://github.com/AGWA/git-crypt has been solid for me

Re: GitHub Private Repos Considered Private-Ish

#28

Post by blackoil » Sun, Jun 04, 2023, 1:38 PM UTC

Does the article has anything Github specific? All softwares can have bug so moving from Github to anything else is useless. VPN only self-hosted provides some additional protection but that's true for all cloud services like Jira, CI/CD and not a novel issue.

Re: GitHub Private Repos Considered Private-Ish

#29

Post by blackoil » Sun, Jun 04, 2023, 1:40 PM UTC

mtlmtlmtlmtl wrote: post #23

paddw wrote: post #17

Earlier quoted context omitted.

iirc, they said they wouldn't do this? so this could just refer to secret scanning

Clearly they lied, if their policy says otherwise.

Policy says nothing about ChatGPT or LLM/AI models.

Re: GitHub Private Repos Considered Private-Ish

#30

Post by hakre » Sun, Jun 04, 2023, 1:41 PM UTC

capableweb wrote: post #22

gumballindie wrote: post #19

Earlier quoted context omitted.

Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.

> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.

A cooperation is never reputable. It is easier to reason with a dog than with a cooperation.

However, me thinks this relates to the times before Github became an offering by Microsoft. But the deal was just too hard to miss, getting this massive army of minion coders who all pray to the octocat and now do the Balmers dance.

Oh so much fun, now it turns out, that all feed the new AI overlords.