[deleted]
Anyone can access deleted and private repository data on GitHub
41–50 of 394 posts
Re: Anyone can access deleted and private repository data on GitHub
#42Really the only semi-interesting part of this is "if you make a private repo public, data from other private forks might be discoverable", but even that seems pretty minor, and the best practice for taking private repos public is to copy the data into a new repo anyway.
Is that a best practice in hindsight, or because it was known to some, that this issue exists, or for what other reason do you consider it a best practice? Git history?
Re: Anyone can access deleted and private repository data on GitHub
#43Does any variant of this apply to DMCA’d repos in the repo network? For example if the root repo is DMCA’d, or, if repo B forks repo A, then B adds some stuff that causes B to get DMCA’d. Can A still access B?
I believe the entire network is suspended.
A downstream dmca suspends the upstream? That astonishes me. Anyone down to shut down react?
Re: Anyone can access deleted and private repository data on GitHub
#44Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default.
In the meantime I'll be calling "private" repos "unlisted", seems more appropriate
Re: Anyone can access deleted and private repository data on GitHub
#45> The implication here is that any code committed to a public repository may be accessible forever That's exactly how you should treat anything made available to the public (and there's no need for the subsequent qualifier that appears in the article—" as long as there is at least one fork of that repository ").
Sometimes I wonder if all the security features GitHub slathers on top of `git` lull people into a false sense of security when fundamentally they're working in a fully distributed version control system with no centralized authority. If your key is leaked the solution is to invalidate the key not just synthetically alter your version of history to pretend it never happened.
This is more of a problem if you leak private information with a commit by accident. You can't really revoke that.
Re: Anyone can access deleted and private repository data on GitHub
#46To fork private, I always just make a new repo and push to it. Looks like that behaves correctly here.
Re: Anyone can access deleted and private repository data on GitHub
#47Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate
Yep, I see GitHub as "public only" hosting, and if I want to host something private, I will choose another vendor.
Re: Anyone can access deleted and private repository data on GitHub
#48Earlier quoted context omitted.
Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…
Not defending GH here (their position is indefensible imo) but, as the article notes, they document these behaviors clearly and publicly: https://docs.github.com/en/pull-requests/collaborating-with-... I don't think they're being underhanded exactly... they're just making a terrible decision. Quoting from the article: > The average user views the separation of private and public repositories as a security boundary, a…
Based on some (admittedly not very thorough) search, this documentation was posted in 2021, three years after my report.
Re: Anyone can access deleted and private repository data on GitHub
#49IMO, the real vulnerability here is the way the Github Events archive exposes the SHA1 hashes of the vulnerable repositories. It would be easy to trawl the entire network to access these deleted/private repositories, but only because they have a list of them.
Similar (but less concerning) is the ability to use short SHA1 hashes. You'd have to either be targeting a particular repository (for example, one for which a malicious actor can expect users to follow the tutorial and commit API keys or other private data) or be targeting a particular individual with a public repository who you suspect might have linked private repositories. It's not free to guess something like "07f01e", but not hard either.
If these links still worked exactly the same, but (1) you had to guess 07f01e8337c1073d2c45bb12d688170fcd44c637 and (2) there was no events API with which to look up that value, this would be much, much less impactful.
Re: Anyone can access deleted and private repository data on GitHub
#50Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate
Yep, I see GitHub as "public only" hosting, and if I want to host something private, I will choose another vendor.
Which vendors work best for private projects?