61–70 of 150 posts
How about encryption? https://github.com/AGWA/git-crypt has been solid for me
I like this a lot and use it myself. Always have a tough time convincing developers though, because they don't like "all that terminal stuff" :/
Nevermind, I guess they can be web developers :p
I wrote a Bash script to copy our ~25 repositories to a new organization using the GitHub REST API. Turns out that the default when creating a new repository was to make it public. Within a few minutes I was getting emails by third party services who had downloaded and parsed our code, discovering a long abandoned AWS credential hard-coded in an older codebase. (I think GitHub now does this for you)
I was lucky that nothing important was actually compromised (we had done a decent job of keeping secrets out of our repos and the one exception was an account that was long gone), but it was an eye-opening experience. If these services had found and downloaded our code in minutes you can assume any repo made public, even for a few moments, has been downloaded and cataloged by a potential bad actor.
How about encryption? https://github.com/AGWA/git-crypt has been solid for me
Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...
Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.
Just code is not an IP.
Your product or a specific algorithm is.
And in my opinion patent on algorithm should be illegal.
There.is no inherent problem hosting Code on GitHub.
You are not doing a good job if you move companies away from working setups due to this.
And they haven't had high security requirements anyway because everyone else normally hosts GitHub Enterprise or gitlab themselfs
This post is mostly FUD. Case in point, the following advice: > So, if you’re worried about it: stop putting sensitive data into private repositories. Most of the issues mentioned in the post (misconfiguration, phishing, mistakes, zero-days) apply to all software, including non-cloud software. So the above advice is equivalent to "stop putting sensitive data into computers". It's run-of-the-mill popular-security nons…
I like to think myself as a pragmatic practitioner of security, and even I would say this isn't "popular-security nonsense". The "cost-benefit analysis" here equals: don't bloody do that, _obviously_. If your system relies on secrets being present in repos, it is a poorly designed system. There is no scenario where this is necessary, other than one not wanting to put in the effort to inject secrets sensibly. Yes, "th…
Repos are databases that track changes in files, nothing more and nothing less. There are millions of repos on GitHub that don't contain application code.
Some people put their entire home directory in a Git repository. Home directories almost always contain secrets. That doesn't mean it's a bad idea, it just means the repo isn't meant for the eyes of others. In other words, it's a private repository.
On a side note, I'm trying to imagine what "sensitive" code would be read, incorporated into an LLM such as Co-pilot, and somehow have any meaningful impact to me once incorporated?
I dunno about other people but I’ve always assumed that if we’re giving employees, who we may have to fire someday, access to the code base that repos should be treated as if they could be exposed to the world at any time any way.
This is a great baseline, but it is often easier said than done. For example, those repositories contain a lot of privately identifiable information, it is not that easy to get such a baseline ready for that _"should be treated as if they could be exposed to the world at any time any way."_ Depending on jurisdiction this can affect sensitive information that requires much stronger controls in place when you (rightful…
This seems to miss my point - I have no idea why PII is in a code repo.
Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...
Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.
Earlier quoted context omitted.
Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.
> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.
They went on an open source charm offensive a few years ago. "Oh, we've turned over a new leaf" etc.
A lot of people believed that they'd had a legitimate change in heart because of the change in strategy.
More realistically, Linux had driven them into near irrelevance in the server market and just pushed them from "extinguish" or "extend" to "embrace".
Their dubious anti-Linux tactics via leaning on OEMs in the desktop market remained more or less unchanged.
Earlier quoted context omitted.
> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.
I think 90s Microsoft could have something of a claim. It made a lot of sharp business choices in that decade, but it also left a LOT of money on the table for developers, as part of a strategic goal to grow the platform. Then the 00s came, platform growth slowed (because they were already running on everything desktop), and the "vs linux" decisions started coming.