Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Private Repos Considered Private-­Ish

tylercipriani.com

Post reply on HN
Print view View original

121–130 of 150 posts

Re: GitHub Private Repos Considered Private-­Ish

#121

Post by tester756 »

capableweb wrote: post #22
gumballindie wrote: post #19

Earlier quoted context omitted.

Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.

> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.

Define reputable.

They're still probably the most indirectly trusted company on the earth

Why? because almost all enterprises do run some non-trivial amount of MS code

Either Windows, Azure / Azure AD or AD at all, Teams/Outlook, VS Code, or anything else.

And please, let's do not start arguing that some startup made of 30 people uses Macs only.

Re: GitHub Private Repos Considered Private-­Ish

#122

Post by waynecochran »

tester756 wrote: post #121
capableweb wrote: post #22

Earlier quoted context omitted.

> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.

Define reputable. They're still probably the most indirectly trusted company on the earth Why? because almost all enterprises do run some non-trivial amount of MS code Either Windows, Azure / Azure AD or AD at all, Teams/Outlook, VS Code, or anything else. And please, let's do not start arguing that some startup made of 30 people uses Macs only.

Anybody who was a programmer through the 1980's knows the anti-competitive practices that MS used to destroy many up-and-comers. They essentially were a dam on technological progress by coercing the world to use a non-protected single-tasking OS when we could have easily been using pre-emptive multitasking OSes on the hardware of the day.

Re: GitHub Private Repos Considered Private-­Ish

#123

Post by waynecochran »

simonw wrote: post #85
waynecochran wrote: post #13

Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...

I don't think it's right to conclude "your private repo data will be used to train GPT" based on the text you linked to there.

Yes, not conclusive, but the cynic in me is usually right esp. when there are large sums of money and power on the line. OpenAI was originally suppose to be open, but power corrupts.

Re: GitHub Private Repos Considered Private-­Ish

#124

Post by [deleted] »

mikeryan wrote: post #58
mtlmtlmtlmtl wrote: post #23

Earlier quoted context omitted.

Clearly they lied, if their policy says otherwise.

Their policy, if you scroll up from this link, is to scan only “aggregate metadata” and only if you opt in. GitHub aggregates metadata and parses content patterns for the purposes of delivering generalized insights within the product. It uses data from public repositories, and also uses metadata and aggregate data from private repositories when a repository's owner has chosen to share the data with GitHub by enabling…

[deleted]

Re: GitHub Private Repos Considered Private-­Ish

#125

Post by waynecochran »

SpaghettiX wrote: post #68
gumballindie wrote: post #19

Earlier quoted context omitted.

Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.

What alternatives do you recommend, and why?

A private instance of gitlab on a private server works.

Re: GitHub Private Repos Considered Private-­Ish

#126

Post by waynecochran »

sneak wrote: post #101
gumballindie wrote: post #19

Earlier quoted context omitted.

Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.

Microsoft providing software and services to organizations running concentration camps in Texas is why I stopped using GitHub.

Care to elaborate?

Re: GitHub Private Repos Considered Private-­Ish

#127

Post by waynecochran »

simonw wrote: post #86
hedora wrote: post #74

Earlier quoted context omitted.

> The information we learn only comes from aggregated data It seems pretty clear to me that this means they're allowed to use private repos to train copilot, etc. I wonder if any researchers have tried putting fingerprinted source code into a private repo, and then (after it is retrained) getting copilot to suggest stuff that could only have come from the injected supposedly-private source code. That would make a nic…

I genuinely don't see how "The information we learn only comes from aggregated data" relates to training LLMs, which need raw data, not aggregated data, as their input. Maybe we have different definitions of the term "aggregated"? This suggests to me that GitHub need to extend that text to explain what they mean by "aggregated".

Enter lawyers.

Re: GitHub Private Repos Considered Private-­Ish

#128

Post by cratermoon »

_joel wrote: post #7
justizin wrote: post #2

> We cram our secrets into git Excuse me?!

This. Every CI platform under the sun has support for secrets and config that should never live in git. It's worth ensuring people know this, of course, but I'm not sure storing secrets in git is all that prevelant. Many platforms also have secrets scanning to ensure you don't accidentally do this too.

> Many platforms also have secrets scanning to ensure you don't accidentally do this too.

The reason secrets scanning even became a thing is because of how often secrets get committed to git. Some of them even lead to intrusions.

Uber (2016) – Attackers gained unrestricted access to Uber’s private Github repositories, found exposed secrets in the source code, and used them to access millions of records in Amazon S3 buckets.

Scotiabank (2019) – Login credentials and access keys were left exposed in a public GitHub repo.

Amazon (2020) – Credentials including AWS private keys were accidentally posted to a public GitHub repository by an AWS engineer.

Symantec – Looking at hardcoded AWS keys in mobile apps, discovered they had a much wider permissions scope and led to a significant data leakage.

GitHub – Over 100K public repositories on GitHub were found to contain access tokens.

I've worked at companies with developers who didn't know that once committed, the secret remains in the history even if a subsequent commit removes it. It's not trivial, and involves rewriting the history[1]. There's also no way to fix clones of the repo, and there are a handful of other ways secrets can still leak.

The most secure way to deal with secrets accidentally committed to git is to rotate the secret.

1 https://docs.github.com/en/authentication/keeping-your-accou...

Re: GitHub Private Repos Considered Private-­Ish

#129

Post by themoonisachees »

As the person on call for exactly that sort of problem, it saddens me that people still push secrets to git at all.

Every gitops platform on the planet supports not pushing secrets to version control. There is no valid reason to have credentials inside a git repo ever. If the repo itself is what's secret, you should have known the risk when you pushed it to someone else's server. There is no excuse when gitlab is free and a docker container away.

Re: GitHub Private Repos Considered Private-­Ish

#130

Post by hedora »

cj wrote: post #115
flerchin wrote: post #113

Earlier quoted context omitted.

Every single clone is a fork. I feel like you're missing the fundamental concept of git as a DVCS.

GitHub support disagrees: https://github.com/orgs/community/discussions/35849 Clone = copy of code that you can sync with the remote on GitHub Fork = copy of code that isn’t connected to the original remote. Of course, every fork involves a clone. But not every clone is a fork. I could be wrong, but “fork” isn’t really a concept native to Git. https://en.m.wikipedia.org/wiki/Fork_(software_development)

Forks in git are connected by the fact that they contain identical sha’s.
Post reply on HN