221–230 of 394 posts
1) Never store secrets in any repo ever! As soon as you discover that its happened, rotate the key/credential/secret asap!!
2) Enterprises that rely on forking so that devs can colab are fucked! Protecting IP by way of private repos is now essentially broken on GH!
3) what the actual fuck github!!??
Earlier quoted context omitted.
No, it really isn’t. Anyone who uses that word that way is just factually incorrect, and probably pretty irresponsible depending on the context. Software should not tell lies.
> delete: remove or obliterate (written or printed matter), especially by drawing a line through it or marking it with a delete sign Which is, indeed, what every modern database does.
Or when its encryption key is overwritten.
But it probably is a good idea to stop returning deleted data from web APIs.
Earlier quoted context omitted.
Any time you make a private repo public it’s best to just copy that code into a new public repo and leave the private repo private. Otherwise have to audit every previous commit and every commit on every fork of your private code.
If I understand the issue correctly if you make the original repo public any private forks from other users are also effectively public. Right?
Earlier quoted context omitted.
No, it really isn’t. Anyone who uses that word that way is just factually incorrect, and probably pretty irresponsible depending on the context. Software should not tell lies.
> delete: remove or obliterate (written or printed matter), especially by drawing a line through it or marking it with a delete sign Which is, indeed, what every modern database does.
*obviously doesn't apply to soft deletes.
That, unfortunately, sounds like the result of publishing something on the Internet. Not GitHubs fault.
Really the only semi-interesting part of this is "if you make a private repo public, data from other private forks might be discoverable", but even that seems pretty minor, and the best practice for taking private repos public is to copy the data into a new repo anyway.
Is that a best practice in hindsight, or because it was known to some, that this issue exists, or for what other reason do you consider it a best practice? Git history?
I always started a new repository without git history. I can’t imagine trying to audit every single commit.
all your private photos on gdrive have publically accessable urls too. most ppl dont know all their private photos are exposed to the world.
Surprised at the comments minimizing this. I've used github for a long time, would not have expected these results, and was unnerved by them. I'd recommend reading the article yourself. It does a good job explaining the vulnerabilities.
I'm not so sure about the "forever" part as git gc is a thing, and at least in 2013 they ran it regularly: https://stackoverflow.com/a/56020315
No idea about nowadays though. There is this blog post:
https://github.blog/engineering/scaling-gits-garbage-collect...
> We have used this idea at GitHub with great success, and now treat garbage collection as a hands-off process from start to finish.