Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anyone can access deleted and private repository data on GitHub

trufflesecurity.com

Post reply on HN
Print view View original

201–210 of 394 posts

Re: Anyone can access deleted and private repository data on GitHub

#201

Post by ndriscoll »

jiggawatts wrote: post #167
jonahx wrote: post #35

Earlier quoted context omitted.

Not defending GH here (their position is indefensible imo) but, as the article notes, they document these behaviors clearly and publicly: https://docs.github.com/en/pull-requests/collaborating-with-... I don't think they're being underhanded exactly... they're just making a terrible decision. Quoting from the article: > The average user views the separation of private and public repositories as a security boundary, a…

From the article: "We surveyed a few (literally 3) commonly-forked public repositories from a large AI company and easily found 40 valid API keys from deleted forks." This is how your customers get their entire cloud taken over, because you made a stupid, stupid decision and instead of fixing it when warned (repeatedly!) you instead decide to just blame the customer for not reading page 537 paragraph 3 subsection B a…

If you published a key, you must assume someone copied it and that deleting references to it is not sufficient. You must rotate that key now, and should check whether it was used improperly. This is pretty basic incident response.

The thing about exposing commits that were only ever in a private repo is pretty indefensible, but not garbage collecting public commits on delete shouldn't matter.

Re: Anyone can access deleted and private repository data on GitHub

#202

Post by CGamesPlay »

hackerbirds wrote: post #44

Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate

Specifically about the feature called "private", the only gotcha seems to be that when the upstream transitions from private to public, it may unexpectedly take more data public than desired, right? The other discussed gotchas were all about deleting public data not actually being deleted or inaccessible.

Re: Anyone can access deleted and private repository data on GitHub

#203

Post by [deleted] »

sgc wrote: post #189

This walks like a dark pattern and quacks like a dark pattern. People's entire livelihoods are at stake and they don't care. Most likely because plausible deniability and obscure TOS rights of how and when the code is used is more valuable to them than the reputation hit. It is hard to imagine this is very hard to fix.

[deleted]

Re: Anyone can access deleted and private repository data on GitHub

#204

Post by neongreen »

haneul wrote: post #43
richbell wrote: post #30

Earlier quoted context omitted.

I believe the entire network is suspended.

A downstream dmca suspends the upstream? That astonishes me. Anyone down to shut down react?

According to https://docs.github.com/en/site-policy/content-removal-polic..., even an upstream dmca doesn’t suspend downstream by default (unless the copyright owner claims they believe all forks violate copyright) — so I would be surprised if downstream dmca suspended upstream.

NB: according to https://www.gtlaw.com/-/media/files/webinars/ian-ballon-may-..., page 4-470, it’s possible that failing to process a DMCA notice may only lead to losing safe harbor for the material identified in the notice, not for the entire service.

So GitHub might just choose to ignore the notice for React, get sued, and win, all without losing the safe harbor.

For less popular repos, I would not be surprised if you could take down any repo literally by submitting a completely bogus notice.

But honestly I still don’t know how much leeway - legally - service providers have in applying their own technical/legal expertise when evaluating DMCA notices. I’d appreciate any sources (court decisions, textbooks, whitepapers, descriptions of actual industry practices, etc) on the topic.

Re: Anyone can access deleted and private repository data on GitHub

#205

Post by jen20 »

ethbr1 wrote: post #191
coldtea wrote: post #130

Earlier quoted context omitted.

> It's a bug bounty, not a "only if we have time to fix it" bounty It's only a bug if it's not intended

Do some companies intend for their platform to feature remote code execution?

Remote code execution is literally a feature of GitHub…

Re: Anyone can access deleted and private repository data on GitHub

#206

Post by Osiris »

So does that mean that forked repos don't do garbage collection of unreferenced commits?

If I force push and orphan a commit, I expect that will get garbage collected and be gone forever.

Or if I commit a file I shouldn't have and rewrite my repo history and push up a whole new history, is the old history still hanging out forever?

If true, then it seems that there is no way to delete any commits at all from any repo that has any forks?

Re: Anyone can access deleted and private repository data on GitHub

#207

Post by Osiris »

est wrote: post #199
hackerbirds wrote: post #44

Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate

> It's disappointing to see GitHub calling it a feature instead of a bug git is a "distributed" version control software afterall. It means a peer can't control everything.

Anyone at your company and just push to a public git repository at any time. Nothing stopping them except threat of consequences.

Re: Anyone can access deleted and private repository data on GitHub

#209

Post by fortran77 »

swozey wrote: post #70
fortran77 wrote: post #51

This is why for private and business projects, we don't use GitHub, we use Amazon CodeCommit.

Because of literally this issue? I'm not sure if you're doing a generic "I don't like github" or know for a fact that CodeCommit doesn't have issues like this. This seems like a terrible security vector but I'm not sure migrating thousands of repos out of github vs. training engineers to keep public and private repos completely separated makes sense and you haven't explained why you use CodeCommit. Unless it is this…

I use and like github for open source and publically shared projects.

Re: Anyone can access deleted and private repository data on GitHub

#210

Post by dwaite »

majorchord wrote: post #173
TazeTSchnitzel wrote: post #3

This is not new. Many people have noticed this before, e.g. https://hikari.noyu.me/blog/2020-05-05-github-private-repos-...

No but I think attention should still be raised to it in the hopes they will fix it. The squeaky wheel gets the grease. https://xkcd.com/1053

First step would be to have them acknowledge a documented behavior which was part of their original design 16 years ago, is something that needs to be fixed.

As someone who has used git and GitHub extensively over that time, none of what the author documented was a surprise to me.

However, I also remember when people were trained to do a "Save As" when preparing a final Word document or Powerpoint for sharing with a third party. That certainly bit enough business users that Microsoft eventually changed the default behavior.

Post reply on HN