The title makes it seem more severe than it is. This only applies to GH forks of public repositories (or repositories that become public). Forks mirror the upstream repo's visibility.
Anyone can access deleted and private repository data on GitHub
161–170 of 394 posts
Re: Anyone can access deleted and private repository data on GitHub
#162How is this more of a vulnerability than the existence of sites like archive.org is? Isn't it just a fact of the Internet that once you make something public, you can't fully take it back later?
Private forks were never public beyond this gotcha
Re: Anyone can access deleted and private repository data on GitHub
#163Can this be used to host illegal content? I.e.: fork a popular repo, commit a pirated book to the fork, delete the fork, use the original repo to access the pirated book? What would github do after receiving a DMCA request in that case?
I think something like this was done when the takedown of yt-dl happened
Re: Anyone can access deleted and private repository data on GitHub
#164Earlier quoted context omitted.
This is more of a problem if you leak private information with a commit by accident. You can't really revoke that.
You can't reach out to any machines that have pulled down that commit and forcibly delete it, either.
But you can prevent anyone from doing so in the future and cross your fingers that no one has done so yet
Re: Anyone can access deleted and private repository data on GitHub
#165Earlier quoted context omitted.
I wouldn't call the parent comment you're responding to an "interrogation" and I'm sorry you perceived it that way. You make a pretty extraordinary claim that local disk is better than a remote repository for storing/updating code for personal work - with no evidence to support this claim - so a followup question seems reasonable. as far as "git is distributed" I don't know if that's the case if you keep it purely lo…
I thought a person of your background (who no doubt has it all figured out) would surmise that I was talking about backing up to an external disk and not to another disk on the same laptop. And would grant another person some good faith and be able to generalize without spelling it all out for them: if the point is to back things up then maybe I can infer that other means of backup are also in the cards, like sneaker…
GitHub, for better or worse, has been one of the easiest ways to backup configuration for ..decades now. It's more secure than sending an email to yourself, Google drive still doesn't have an official linux client, AWS is too enterprisey for a handful of small backup files, and git is incredibly easy to set up + available on so many computers.
I completely get why people would want to use GitHub for a low friction way to store versioned configuration data. It's a natural case for programmers to use the tool they're already using for something else. There's even repos for dotfiles saying stuff like 'hey fork this and make it private' because they know people want to manage dotfiles but might lazily leak some secrets in their own versions
Re: Anyone can access deleted and private repository data on GitHub
#166Earlier quoted context omitted.
> I'll be calling "private" repos "unlisted" The same for “deleted” repos.
"deleted" is just a fancy word "inaccessible to the user"
No, it really isn’t. Anyone who uses that word that way is just factually incorrect, and probably pretty irresponsible depending on the context. Software should not tell lies.
Re: Anyone can access deleted and private repository data on GitHub
#167Earlier quoted context omitted.
Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…
Not defending GH here (their position is indefensible imo) but, as the article notes, they document these behaviors clearly and publicly: https://docs.github.com/en/pull-requests/collaborating-with-... I don't think they're being underhanded exactly... they're just making a terrible decision. Quoting from the article: > The average user views the separation of private and public repositories as a security boundary, a…
From the article:
"We surveyed a few (literally 3) commonly-forked public repositories from a large AI company and easily found 40 valid API keys from deleted forks."
This is how your customers get their entire cloud taken over, because you made a stupid, stupid decision and instead of fixing it when warned (repeatedly!) you instead decide to just blame the customer for not reading page 537 paragraph 3 subsection B about the counter-intuitive security footgun you've left in your product.
This is negligence, pure and simple.
Re: Anyone can access deleted and private repository data on GitHub
#168Earlier quoted context omitted.
It doesn't matter if they knew. If they don't deem it a security vulnerability --- and they have put their money where their mouth is, by documenting it as part of the platform behavior --- it's not eligible for a payout. It can be a bug, but if it's not the kind of bug the bounty program is designed to address, it's not getting paid out. The incentives you create by paying for every random non-vulnerability are real…
I would argue that even if the behaviour was as intended, at least the fact that it was not documented was a bug (and a pretty serious one at that).
Again: you don't generally get bounties for finding "bugs"; you get them exclusively for finding qualified vulnerabilities.
Re: Anyone can access deleted and private repository data on GitHub
#169A serious security issue indeed, if someone knows the hash.
How I manage this is that every time I want to open-source a previously private feature, I take the changeset diff and apply that to the files in the public repository. Same features, but plausibly different hash.
Re: Anyone can access deleted and private repository data on GitHub
#170Earlier quoted context omitted.
"deleted" is just a fancy word "inaccessible to the user"
No, it really isn’t. Anyone who uses that word that way is just factually incorrect, and probably pretty irresponsible depending on the context. Software should not tell lies.
> delete: remove or obliterate (written or printed matter), especially by drawing a line through it or marking it with a delete sign
Which is, indeed, what every modern database does.