GitHub Private Repos Considered Private-Ish • Hacker News Board

Re: GitHub Private Repos Considered Private-Ish

#101

Post by sneak » Sun, Jun 04, 2023, 4:38 PM UTC

gumballindie wrote: post #19

waynecochran wrote: post #13

Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...

Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.

Microsoft providing software and services to organizations running concentration camps in Texas is why I stopped using GitHub.

Re: GitHub Private Repos Considered Private-Ish

#102

Post by owl57 » Sun, Jun 04, 2023, 4:42 PM UTC

snowwrestler wrote: post #57

willis936 wrote: post #55

Earlier quoted context omitted.

When I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human that does the looking, it's still a violation of privacy. It's not really "private" if the backyard has a one way glass pane on one wall. Github should not be calling repos private if they're not.

This is one of many instances where developers should not make shallow assumptions without reading the documentation. GitHub is very clear about how private repos should be used. Edit to add: would you store your bank password on a piece of paper you always leave sitting in your backyard? Think carefully about your metaphor.

> would you store your bank password on a piece of paper you always leave sitting in your backyard?

Not that I'm advocating for checking passwords in git repos, Github or otherwise, but you metaphor depends on how rich you are and how bad is your neighborhood, I would think.

My mom has definitely done exactly that — her medical conditions make it very hard to use bank apps without full daylight and also hard to bring the notebook home after every use — and I don't think that her password management choices, however frowned upon they may be here, have ever been a serious problem in practice.

Re: GitHub Private Repos Considered Private-Ish

#103

Post by atq2119 » Sun, Jun 04, 2023, 4:43 PM UTC

simonw wrote: post #98

atq2119 wrote: post #96

Earlier quoted context omitted.

The LLM itself is a form of aggregated data.

Sure, but the raw training data isn't. I think GitHub need to clarify this themselves.

Sure. All aggregated data is ultimately derived from raw, unaggregated data. One can make the argument that training an LLM is "just" an unusually complicated form of aggregation.

Whether that would hold up is another question. But yeah, I agree with the conclusion that they need to clarify this.

Re: GitHub Private Repos Considered Private-Ish

#104

Post by mtlmtlmtlmtl » Sun, Jun 04, 2023, 4:43 PM UTC

simonw wrote: post #98

atq2119 wrote: post #96

Earlier quoted context omitted.

The LLM itself is a form of aggregated data.

Sure, but the raw training data isn't. I think GitHub need to clarify this themselves.

But then the training can surreptitiously be called data aggregation. We don't look at the raw data, we aggregate it and then query the aggregation.

Definitely needs clarification, though somehow I suspect this is all by design.

Re: GitHub Private Repos Considered Private-Ish

#105

Post by aio2 » Sun, Jun 04, 2023, 4:54 PM UTC

ethbr0 wrote: post #43

capableweb wrote: post #22

Earlier quoted context omitted.

> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.

I think 90s Microsoft could have something of a claim. It made a lot of sharp business choices in that decade, but it also left a LOT of money on the table for developers, as part of a strategic goal to grow the platform. Then the 00s came, platform growth slowed (because they were already running on everything desktop), and the "vs linux" decisions started coming.

Okay, maybe 90s MS could've, but I have a feeling that's 30 years ago.

Re: GitHub Private Repos Considered Private-Ish

#106

Post by remram » Sun, Jun 04, 2023, 4:56 PM UTC

tln wrote: post #27

How about encryption? https://github.com/AGWA/git-crypt has been solid for me

Assuming you mean encrypting the secret files specifically and not the whole repo. This could work, but why put the secrets in the repository at all? Either everyone has to replace them with their own secrets before being able to run the code. Or everyone has to have the key to decrypt the actual credentials (developers, interns, deployments, CI, scanners, etc) making it not secret.

Why not inject the credentials at runtime, from a system meant for this, with support for auditing and key rotation etc?

Re: GitHub Private Repos Considered Private-Ish

#107

Post by ghusto » Sun, Jun 04, 2023, 5:05 PM UTC

shrimp_emoji wrote: post #61

ghusto wrote: post #54

Earlier quoted context omitted.

I like this a lot and use it myself. Always have a tough time convincing developers though, because they don't like "all that terminal stuff" :/

Are you sure they're developers? Nevermind, I guess they can be web developers :p

Didn't want to go there, but I think you get it. When your developers are using JavaScript to write backend programs, you know where the bar is.

Re: GitHub Private Repos Considered Private-Ish

#108

Post by ghusto » Sun, Jun 04, 2023, 5:12 PM UTC

p-e-w wrote: post #65

ghusto wrote: post #53

Earlier quoted context omitted.

I like to think myself as a pragmatic practitioner of security, and even I would say this isn't "popular-security nonsense". The "cost-benefit analysis" here equals: don't bloody do that, _obviously_. If your system relies on secrets being present in repos, it is a poorly designed system. There is no scenario where this is necessary, other than one not wanting to put in the effort to inject secrets sensibly. Yes, "th…

> If your system relies on secrets being present in repos, it is a poorly designed system. Repos are databases that track changes in files, nothing more and nothing less. There are millions of repos on GitHub that don't contain application code. Some people put their entire home directory in a Git repository. Home directories almost always contain secrets. That doesn't mean it's a bad idea, it just means the repo isn…

People putting their entire home directory in a repo, on somebody else's shared computer and network, is going to end in a disaster scenario. This sounds like a bad idea.

Re: GitHub Private Repos Considered Private-Ish

#109

Post by edgyquant » Sun, Jun 04, 2023, 5:21 PM UTC

cj wrote: post #94

hedora wrote: post #81

Earlier quoted context omitted.

Of course bypassing the UI means that normal development flows (like force rebasing, or futzing with the CI setup) now are the same set of commands as malicious exfiltration of source code. It also breaks GitHub's normal protection against accidentally creating public forks of private repos (and the feature where it auto-deletes your private forks when you change jobs). There are probably other ways in which disablin…

(Genuine question) what is a use case where an employee needs to fork your company’s repo rather than open a PR? The only one I can think of is what you mentioned (testing CI workflows that match a branch name) but at least at our company that can usually be done in a PR. I don’t see any obvious reason why an employee would ever need to fork a company’s private repo to their personal GitHub account.

For large projects this can happen. Think the Linux forks that AMD etc maintain and then regularly do a series of PRs to integrate them into some staging branch which then makes its way to the kernel if approved.

It’s a typical workflow for inter-org codebase.

Re: GitHub Private Repos Considered Private-Ish

#110

Post by electroly » Sun, Jun 04, 2023, 5:23 PM UTC

justizin wrote: post #2

> We cram our secrets into git Excuse me?!

OP's target audience, judging by all the emojis and the subject matter, seems to be a pretty green junior devs who might not know any better. OP is putting themselves in their shoes as a rhetorical device, the author isn't saying that they themselves put secrets into git.