Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

101–110 of 205 posts

Re: GitHub and Rails: You have let us all down.

#101

Post by eropple »

ktizo wrote: post #30
augustl wrote: post #23

Earlier quoted context omitted.

I agree wholeheartedly. I always facepalm when people aren't able to work because the internet is down (read: no github access). Just start an SSH server, netcat some keys around (or use an USB stick), and get back to work again :) Transmitting files via Google's email servers from two computers on the same network in the same office in the same room, especially if you're in europe (ridicilously far away from GMail's…

LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.

We...don't? I mean, if you're reliant on cloud services, yeah, you'll have problems--that's obvious. But if you self-host your important stuff (I run my own redmine instance off a local machine) and know how to use SSH, you should be fine in the majority of cases where the LAN is fine but has no Internet access.

There's nothing "broken" here.

Re: GitHub and Rails: You have let us all down.

#102

Post by mikeash »

ktizo wrote: post #30
augustl wrote: post #23

Earlier quoted context omitted.

I agree wholeheartedly. I always facepalm when people aren't able to work because the internet is down (read: no github access). Just start an SSH server, netcat some keys around (or use an USB stick), and get back to work again :) Transmitting files via Google's email servers from two computers on the same network in the same office in the same room, especially if you're in europe (ridicilously far away from GMail's…

LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.

99.9% of the time, tools which work for communicating over the internet work very well for communicating locally. It's not worthwhile for most people to devote the time to building, maintaining, or learning a second tool for the LAN side for that 0.1% of the time when your internet connection is down.

Re: GitHub and Rails: You have let us all down.

#103

Post by yalogin »

JackDanger wrote: post #55
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

They suspended the account, they didn't cancel it. On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account. On Monday morning you figure out what to do with them.

If the vulnerability is that serious should they have not taken the site down instead?

Re: GitHub and Rails: You have let us all down.

#104

Post by tylermenezes »

MartinMond wrote: post #83
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

Yeah, I think we'll migrate all our private stuff to http://gitlabhq.com/ The way GitHub reacted (blocking @homakov) is just wrong and destroyed all my confidence in them. Even more so when it was pointed out that @zedshaw crashed GitHub and didn't get blocked. http://sheddingbikes.com/posts/1306816425.html Edit: Given that they have now stated that suspending @homakov was only temporary I no longer bear any ill will…

Coincidentally, the incident with Zed was also fueled by the ruby guys being dicks. He just happens to be a higher-profile personality.

Re: GitHub and Rails: You have let us all down.

#105

Post by stdbrouw »

dspillett wrote: post #99
dangrossman wrote: post #52

Earlier quoted context omitted.

I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/ I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan. My open source code is on GH, but it's all also pushed to RH, along with all my…

IMO the best location for private repositories is your own equipment. Or rented equipment but with the private code and data on encrypted block devices or filesystems. I know it can be a faf to setup proper reliable secure backups and so forth (though with git it shouldn't be too hard give the whole thing is designed with wide but efficient distribution in mind), but if you stuff is sensitive enough (in a business se…

"No matter how trustworthy, reliable, and secure they try to be, every one makes mistakes." Which can include you. I get that it'd be pretty hard for anyone else to access code that is just on your own laptop plus encrypted off-site backup storage, but once you get to the point where you need to collaborate with other people and need some sort of a service available on the web, I'd put more trust in the security chops of a trustworthy third party than I would in myself.

Re: GitHub and Rails: You have let us all down.

#106

Post by res0nat0r »

epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

Not to downplay the exploit at all, but for everyone raging that this occurred and are worrying about the integrity of their codebase, we are talking about an SCM for god sakes aren't we? Git is distributed and all most users would need to do who are freaking out right now about evil commits is to go back and audit your git commit history no?

Re: GitHub and Rails: You have let us all down.

#107

Post by tylermenezes »

technoweenie wrote: post #94
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.

> he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly

If he was, he wouldn't have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.

I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new "white hat" policy thing is kind of silly, because that's clearly not what this was about.

Re: GitHub and Rails: You have let us all down.

#108

Post by batista »

dangrossman wrote: post #74
zalew wrote: post #65

Earlier quoted context omitted.

You should check out http://bitbucket.org

I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops. It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; i…

I prefer to pay someone to host the private repos.

Yeah, and people payed GitHub to host their private repos --how did that go?

Re: GitHub and Rails: You have let us all down.

#109

Post by technoweenie »

niyazpk wrote: post #96
technoweenie wrote: post #94

Earlier quoted context omitted.

We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.

The sad part is that the guy was your biggest fan: http://homakov.blogspot.in/2011/07/octocat-tattoo.html

It's a fake.
Post reply on HN