Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anyone can access deleted and private repository data on GitHub

trufflesecurity.com

Post reply on HN
Print view View original

141–150 of 394 posts

Re: Anyone can access deleted and private repository data on GitHub

#141

Post by hyperpape »

jonahx wrote: post #126
hyperpape wrote: post #97

Earlier quoted context omitted.

Even if it wasn't forked, it could be cloned. Should that be part of the warning? I wouldn't mind a disclaimer when you delete a repository that any information that repository ever contained is likely to have already been downloaded and stored. Per the comment I added, I'm not sure it would really help that much, but it would not be harmful.

> Should that be part of the warning? It couldn't hurt, but that isn't the misunderstanding I'm worried about. As described in the first example of the article, you can make a fork, commit to it, delete your entire fork , and yet the data will still be accessible via the parent repo, even though no one ever forked or cloned or saw your fork. That is not intuitive at all. You can say "Well just consider any data that…

> As described in the first example of the article, you can make a fork, commit to it, delete your entire fork, and yet the data will still be accessible via the parent repo, even though no one ever forked or cloned or saw your fork. That is not intuitive at all.

But isn't that only the third vulnerability, that private forks are implicitly made public?

As I said, I won't defend that decision.

Re: Anyone can access deleted and private repository data on GitHub

#142

Post by tptacek »

Cpoll wrote: post #139
tptacek wrote: post #117

Earlier quoted context omitted.

The problem with this line of argument is that the fundamental workings of git are also surprising to people, such that they routinely attempt to address mistaken hazmat commits by simple reverts. If at bottom this whole story is just that git is treacherous, well, yeah, but not news. There's a deeper problem here, which is that making the UX on hosting sites less surprising doesn't fix the underlying problem. There…

Is "git" relevant here? Forking isn't a git concept, and none of this behaviour has much to do with git; it's all GitHub. Also, you can revoke an API key, but you can't revoke a company-proprietary algorithm that you implemented into a fork of a public project.

Like I said: if you can't revoke the thing you committed, you need to get in touch with Github and have them remove it. That's a thing they do.

Re: Anyone can access deleted and private repository data on GitHub

#143

Post by bogwog »

josephcsible wrote: post #132

How is this more of a vulnerability than the existence of sites like archive.org is? Isn't it just a fact of the Internet that once you make something public, you can't fully take it back later?

Because private forks are not meant to be public

Re: Anyone can access deleted and private repository data on GitHub

#144

Post by lilyball »

zelphirkalt wrote: post #42
lilyball wrote: post #10

Really the only semi-interesting part of this is "if you make a private repo public, data from other private forks might be discoverable", but even that seems pretty minor, and the best practice for taking private repos public is to copy the data into a new repo anyway.

Is that a best practice in hindsight, or because it was known to some, that this issue exists, or for what other reason do you consider it a best practice? Git history?

When making a private repo public, there's a high chance that there was stuff in the private repo that isn't necessarily ok to make public. It's a lot easier to just create a new public repo containing all the data you want to make public than it is to reliably scrub a private repo of any data that shouldn't be there.

More generally, you probably want to construct a new history for the public repo anyway, so you'll want a brand new repo to ensure none of the scrubbed history is accessible.

Re: Anyone can access deleted and private repository data on GitHub

#145

Post by make3 »

Manuel_D wrote: post #138
SnowflakeOnIce wrote: post #131

Earlier quoted context omitted.

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork. [1] https://docs.github.com/en/pull-requests/collaborating-with-...

Not through the GitHub interface, no. But you can copy all files in a repository and create a new repository. IIRC there's a way to retain the history via this process as well.

That's not the GitHub concept / almost trademark of "fork" anymore though, which is what your parent was talking about

Re: Anyone can access deleted and private repository data on GitHub

#146

Post by a1o »

Manuel_D wrote: post #138
SnowflakeOnIce wrote: post #131

Earlier quoted context omitted.

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork. [1] https://docs.github.com/en/pull-requests/collaborating-with-...

Not through the GitHub interface, no. But you can copy all files in a repository and create a new repository. IIRC there's a way to retain the history via this process as well.

I mean it's git, just git init, git remote add for origin and upstream, origin pointing to your private, git fetch upstream, git push to origin.

Re: Anyone can access deleted and private repository data on GitHub

#147

Post by prepend »

andrewinardeer wrote: post #110
madeofpalk wrote: post #101

Earlier quoted context omitted.

The point of a bug bounty is for companies to find new security problems. If the (class of) problem is already known, it’s not worth rewarding.

If a renown company won't pay a bug bounty, a foreign government often will.

Good luck selling this to a foreign (or domestic) government. It doesn’t seem valuable to me, but who knows, maybe someone finds it worth payout.

Re: Anyone can access deleted and private repository data on GitHub

#148

Post by mckn1ght »

Manuel_D wrote: post #138
SnowflakeOnIce wrote: post #131

Earlier quoted context omitted.

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork. [1] https://docs.github.com/en/pull-requests/collaborating-with-...

Not through the GitHub interface, no. But you can copy all files in a repository and create a new repository. IIRC there's a way to retain the history via this process as well.

You can create a private repository on GitHub, clone it locally, add the repo being "forked" from as a separate git remote (I usually call this one "upstream" and my "fork", well, "fork"), fetch and pull from upstream, then push to fork.

Re: Anyone can access deleted and private repository data on GitHub

#149

Post by riedel »

madewulf wrote: post #108

In fact, there is a process to request complete removal of data, but it involves sending an email that will be reviewed by github staff: https://docs.github.com/en/site-policy/content-removal-polic... On the other hand, once an API key or password has been published somewhere, you should rotate it anyway.

I was wondering, how they can otherwise comply with legislation. Makes sense there is a way to do this e.g. in case of valid GDPR, DMCA, etc. cases.

Re: Anyone can access deleted and private repository data on GitHub

#150

Post by debugnik »

josephcsible wrote: post #132

How is this more of a vulnerability than the existence of sites like archive.org is? Isn't it just a fact of the Internet that once you make something public, you can't fully take it back later?

The third case in the article shows private forks being leaked publicly when the upstream goes public.

The other two cases are indeed not worse than third-party archival, but they're still socially concerning. When you ask your own host to delete something you uploaded, you don't expect them to ignore you just because someone could have already archived it maybe. Making it harder to find can still be valuable; not all archives stay available forever, if any.

Post reply on HN