Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anyone can access deleted and private repository data on GitHub

trufflesecurity.com

Post reply on HN
Print view View original

241–250 of 394 posts

Re: Anyone can access deleted and private repository data on GitHub

#241

Post by rkagerer »

SnowflakeOnIce wrote: post #131
andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork. [1] https://docs.github.com/en/pull-requests/collaborating-with-...

Am I the only one who finds this conceptually confusing?

Re: Anyone can access deleted and private repository data on GitHub

#242

Post by jonahx »

beardedwizard wrote: post #239

Truffle is practically famous for clickbait like this. They have a YouTube channel full of it. Their behavior in the security industry steered us far away from them as a vendor.

This is not clickbait.

It's well-explained and fairly presents the facts and GH's position. Based on the reaction here, it's clear many people are not aware of these footguns. If anything, the article is a public service.

Re: Anyone can access deleted and private repository data on GitHub

#243

Post by t-writescode »

stvltvs wrote: post #50
chrisandchris wrote: post #47

Earlier quoted context omitted.

Yep, I see GitHub as "public only" hosting, and if I want to host something private, I will choose another vendor.

Which vendors work best for private projects?

I've been happy with Jetbrains Space (now Space Code); but I'm using it for private, professional work and paying for it, so perhaps that isn't what you mean.

Re: Anyone can access deleted and private repository data on GitHub

#244

Post by b800h »

hughesjj wrote: post #164
kemitche wrote: post #124

Earlier quoted context omitted.

You can't reach out to any machines that have pulled down that commit and forcibly delete it, either.

But you can prevent anyone from doing so in the future and cross your fingers that no one has done so yet

As per this post, if a lot of people have forked your repo in the past, then you're stuffed.

Re: Anyone can access deleted and private repository data on GitHub

#245

Post by Dylan16807 »

HeatrayEnjoyer wrote: post #240
dwaite wrote: post #210

Earlier quoted context omitted.

First step would be to have them acknowledge a documented behavior which was part of their original design 16 years ago, is something that needs to be fixed. As someone who has used git and GitHub extensively over that time, none of what the author documented was a surprise to me. However, I also remember when people were trained to do a "Save As" when preparing a final Word document or Powerpoint for sharing with a…

What about Save As bit people?

It's not doing Save As that bit people. Think of a .doc file as a bad database format. It gets lots of in-place overwrites, and fragments of old versions stick around.

I can't find a lot that discusses it, but here's one mention: https://news.ycombinator.com/item?id=35252331

Re: Anyone can access deleted and private repository data on GitHub

#246

Post by haneul »

neongreen wrote: post #204
haneul wrote: post #43

Earlier quoted context omitted.

A downstream dmca suspends the upstream? That astonishes me. Anyone down to shut down react?

According to https://docs.github.com/en/site-policy/content-removal-polic... , even an upstream dmca doesn’t suspend downstream by default (unless the copyright owner claims they believe all forks violate copyright) — so I would be surprised if downstream dmca suspended upstream. NB: according to https://www.gtlaw.com/-/media/files/webinars/ian-ballon-may-... , page 4-470, it’s possible that failing to process a DMCA…

> So GitHub might just choose to ignore the notice for React, get sued, and win, all without losing the safe harbor.

It wouldn't be React getting the notice. It would be say, someone forking React, then adding a pull request with some clearly DMCA-violating material.

Then, if downstream B DMCA shutdown doesn't affect upstream A's availability, there's still the question of A normally still having access to B's non-merged commits even in the case of B's deletion. So, A should still be access the DMCA-violating material.

And, if A's access to B's non-merged, DMCA-violating commit is truly revoked without affecting A otherwise... why can't we have a "Strong Delete" button on GitHub? Would seem they'd have to have "Strong Delete" functionality to comply with downstream B hitting DMCA.

Basically, I'm feeling either a violation of principle of least astonishment, or a violation of "strong-DMCA".

Unless this is to support a feature in Git/GitHub that I am too noob to understand. :shrug:

Re: Anyone can access deleted and private repository data on GitHub

#247

Post by dumbo-octopus »

8organicbits wrote: post #197
dumbo-octopus wrote: post #170

Earlier quoted context omitted.

> delete: remove or obliterate (written or printed matter), especially by drawing a line through it or marking it with a delete sign Which is, indeed, what every modern database does.

I think you are referring to tombstoning. That's usually a temporary process that may immediately delete the underlying data, keeping a tombstone to ensure the deletion propagates to all storage nodes. A compaction process purges the underlying data (if still present) and the tombstones after a suitable delay. It's a fancy delete that takes some time to process, but the data is eventually gone. You could turn off the…

If you run a DELETE FROM in any modern sql engine, which is the absolute best you could expect when asking for a delete in the UI^, the data is nowhere near gone. It’s still in all the backups, all the WALs, all the transactions that started before yours, etc. It’s marked for eventual removal, and that’s it. Just as the definition of delete I provided says.

^ (more likely they’ll just update the table to set a deleted flag)

Re: Anyone can access deleted and private repository data on GitHub

#248

Post by beardedwizard »

jonahx wrote: post #242
beardedwizard wrote: post #239

Truffle is practically famous for clickbait like this. They have a YouTube channel full of it. Their behavior in the security industry steered us far away from them as a vendor.

This is not clickbait. It's well-explained and fairly presents the facts and GH's position. Based on the reaction here, it's clear many people are not aware of these footguns. If anything, the article is a public service.

Based on the comments, many have known since 2018. GitHub has made multiple statements about it.

It's been written about multiple times, and now truffle is reposting old content with a name like IDOR to try to invent a new vuln class that doesn't exist.

The title of the post is misleading, a specific set of repos leak data under specific circumstances - not every repo. The first two sentences of the post immediately downscope the claim made by the title.

Im guessing you didn't bother to check out thier YouTube.

This post is the only thing the OP has ever posted in 8 months, probably because it's truffle themselves. I stand by my statement, it's clickbait.

Re: Anyone can access deleted and private repository data on GitHub

#249

Post by Dylan16807 »

HL33tibCe7 wrote: post #155
lilyball wrote: post #10

Really the only semi-interesting part of this is "if you make a private repo public, data from other private forks might be discoverable", but even that seems pretty minor, and the best practice for taking private repos public is to copy the data into a new repo anyway.

You’ve completely missed the most dangerous thing mentioned, namely that private forks are not private.

> You’ve completely missed the most dangerous thing mentioned, namely that private forks are not private.

What do you mean "missed"? They described the situation where data is leaked from a private fork, which is when you make the original repo public.

There's no other time when data leaks. A public repo can't have ongoing private forks.

Re: Anyone can access deleted and private repository data on GitHub

#250

Post by Dylan16807 »

NullPrefix wrote: post #156
layer8 wrote: post #65

Earlier quoted context omitted.

> I'll be calling "private" repos "unlisted" The same for “deleted” repos.

"deleted" is just a fancy word "inaccessible to the user"

It's tolerated for there to be temporary inaccessible copies sticking around when something is deleted.

What GitHub is doing here is neither temporary nor inaccessible.

Post reply on HN