GitHub Private Repos Considered Private-Ish • Hacker News Board

Re: GitHub Private Repos Considered Private-Ish

#51

Post by bob1029 » Sun, Jun 04, 2023, 1:57 PM UTC

mikeryan wrote: post #26

I dunno about other people but I’ve always assumed that if we’re giving employees, who we may have to fire someday, access to the code base that repos should be treated as if they could be exposed to the world at any time any way.

I've had to explain to leadership that certain employees don't even need access to the actual codebase to potentially cause harm via a competitor.

The real solution to this is to have a business model that is about more than just some source code in a repository, or "things one person could undo". Concerns like years-long relationships with customers (aka trust), platform-style lock-in patterns, etc. How many times have various parts of AAA game studio or Microsoft codebases been compromised? I am still waiting for that hacker edition of HL3 and my free copy of windows that doesn't suck.

I actually spent a few minutes walking through a hypothetical where 100% of our latest code is lifted and taken to our biggest competitor. I think it would probably cause them more harm than good. Complexity is a hell of a thing. Just having a point-in-time snapshot doesn't really give you an advantage over someone who has been at it continuously for years. Perhaps we can strike a consulting contract with whoever steals our code...

I am not against reasonable measures (i.e. MFA, GH Enterprise, VPNs), but I won't go into paranoid-tier (Citrix-style desktops) over stuff like this ever again. Code is a cheap commodity in 2023. Enshrining your repository as if it is the actual vehicle of business value is indicative of poor leadership. Customers, relationships, execution, etc. are way more challenging and important.

Re: GitHub Private Repos Considered Private-Ish

#52

Post by franciscop » Sun, Jun 04, 2023, 1:58 PM UTC

I'm not sure why in the "Easy Fixes" it doesn't say the thing that is mentioned in the next point "stop putting sensitive data into private repositories". That should _also_ go in "Easy Fixes" IMHO, use environment variables, vaults, etc to not store your keys into your code.

Re: GitHub Private Repos Considered Private-Ish

#53

Post by ghusto » Sun, Jun 04, 2023, 1:59 PM UTC

p-e-w wrote: post #36

This post is mostly FUD. Case in point, the following advice: > So, if you’re worried about it: stop putting sensitive data into private repositories. Most of the issues mentioned in the post (misconfiguration, phishing, mistakes, zero-days) apply to all software, including non-cloud software. So the above advice is equivalent to "stop putting sensitive data into computers". It's run-of-the-mill popular-security nons…

I like to think myself as a pragmatic practitioner of security, and even I would say this isn't "popular-security nonsense". The "cost-benefit analysis" here equals: don't bloody do that, _obviously_.

If your system relies on secrets being present in repos, it is a poorly designed system. There is no scenario where this is necessary, other than one not wanting to put in the effort to inject secrets sensibly.

Yes, "the alternatives come with their own risks", but those risks are where the "cost-benefit analysis" equals "not worth the effort".

Re: GitHub Private Repos Considered Private-Ish

#54

Post by ghusto » Sun, Jun 04, 2023, 2:00 PM UTC

tln wrote: post #27

How about encryption? https://github.com/AGWA/git-crypt has been solid for me

I like this a lot and use it myself. Always have a tough time convincing developers though, because they don't like "all that terminal stuff" :/

Re: GitHub Private Repos Considered Private-Ish

#55

Post by willis936 » Sun, Jun 04, 2023, 2:01 PM UTC

snowwrestler wrote: post #48

It’s right there in the name: GitHub private repos are “private,” not “secure” or “secret”. That name was chosen purposefully. When we moved our code from privately hosted SVN to GitHub 10+ years ago, folks at GitHub were quite clear that we should not trust private repos with secrets like private keys or passwords. So why have private repos at all? It is to allow control of collaborators. GitHub originally allowed e…

When I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human that does the looking, it's still a violation of privacy.

It's not really "private" if the backyard has a one way glass pane on one wall. Github should not be calling repos private if they're not.

Re: GitHub Private Repos Considered Private-Ish

#56

Post by satya71 » Sun, Jun 04, 2023, 2:01 PM UTC

I wonder, how do Azure DevOps and AWS CodeCommit compare in this regard?

Re: GitHub Private Repos Considered Private-Ish

#57

Post by snowwrestler » Sun, Jun 04, 2023, 2:03 PM UTC

willis936 wrote: post #55

snowwrestler wrote: post #48

It’s right there in the name: GitHub private repos are “private,” not “secure” or “secret”. That name was chosen purposefully. When we moved our code from privately hosted SVN to GitHub 10+ years ago, folks at GitHub were quite clear that we should not trust private repos with secrets like private keys or passwords. So why have private repos at all? It is to allow control of collaborators. GitHub originally allowed e…

When I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human that does the looking, it's still a violation of privacy. It's not really "private" if the backyard has a one way glass pane on one wall. Github should not be calling repos private if they're not.

This is one of many instances where developers should not make shallow assumptions without reading the documentation. GitHub is very clear about how private repos should be used.

Edit to add: would you store your bank password on a piece of paper you always leave sitting in your backyard? Think carefully about your metaphor.

Re: GitHub Private Repos Considered Private-Ish

#58

Post by mikeryan » Sun, Jun 04, 2023, 2:05 PM UTC

mtlmtlmtlmtl wrote: post #23

paddw wrote: post #17

Earlier quoted context omitted.

iirc, they said they wouldn't do this? so this could just refer to secret scanning

Clearly they lied, if their policy says otherwise.

Their policy, if you scroll up from this link, is to scan only “aggregate metadata” and only if you opt in.

GitHub aggregates metadata and parses content patterns for the purposes of delivering generalized insights within the product. It uses data from public repositories, and also uses metadata and aggregate data from private repositories when a repository's owner has chosen to share the data with GitHub by enabling the dependency graph. If you enable the dependency graph for a private repository, then GitHub will perform read-only analysis of that specific private repository.

If you enable data use for a private repository, we will continue to treat your private data, source code, or trade secrets as confidential and private consistent with our Terms of Service. The information we learn only comes from aggregated data. For more information, see "Managing data use settings for your private repository."

Re: GitHub Private Repos Considered Private-Ish

#59

Post by kgermino » Sun, Jun 04, 2023, 2:06 PM UTC

willis936 wrote: post #55

snowwrestler wrote: post #48

It’s right there in the name: GitHub private repos are “private,” not “secure” or “secret”. That name was chosen purposefully. When we moved our code from privately hosted SVN to GitHub 10+ years ago, folks at GitHub were quite clear that we should not trust private repos with secrets like private keys or passwords. So why have private repos at all? It is to allow control of collaborators. GitHub originally allowed e…

When I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human that does the looking, it's still a violation of privacy. It's not really "private" if the backyard has a one way glass pane on one wall. Github should not be calling repos private if they're not.

Did you read the article? They’re not saying that GitHub is reading your repos, they’re saying that mistakes happen and you shouldn’t assume that private repos are secure.

Go out in your fenced yard and assume you won’t be seen, but if you forget to close the gate someone might come back there anyway

Re: GitHub Private Repos Considered Private-Ish

#60

Post by floof » Sun, Jun 04, 2023, 2:08 PM UTC

willis936 wrote: post #55

snowwrestler wrote: post #48

It’s right there in the name: GitHub private repos are “private,” not “secure” or “secret”. That name was chosen purposefully. When we moved our code from privately hosted SVN to GitHub 10+ years ago, folks at GitHub were quite clear that we should not trust private repos with secrets like private keys or passwords. So why have private repos at all? It is to allow control of collaborators. GitHub originally allowed e…

When I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human that does the looking, it's still a violation of privacy. It's not really "private" if the backyard has a one way glass pane on one wall. Github should not be calling repos private if they're not.

I agree with the original comment -- github has secrets storage. There are also other secrets storage services that can be used out there. It's never a good idea to check in secrets in your code. Maybe the word "private" means different things to different users, but the fact that GitHub has a whole other set of features dedicated to "secrets" should be a giveaway to users that there is a distinction between "private" and "secret".