Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

91–100 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#91

Post by sham1 »

bpodgursky wrote: post #77
lynndotpy wrote: post #64

Earlier quoted context omitted.

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view…

[flagged]

Maybe we need a cultural shift then, because if one needs to use a platform like X, nowadays owned and operated by fascists, then there's something deeply wrong with the tech world. It'd probably take a lot of effort to do so, but it'd be absolutely worth it.

Besides, even if that wasn't a consideration, only posting the announcement to X is just crazy. As others have said, you'd expect for GitHub to make the announcement on their official website. Any paying client would then just follow that for their announcements.

Re: GitHub is investigating unauthorized access to their internal repositories

#92

Post by daemin »

mstank wrote: post #4

Is it just me or is this happening way more frequently in the last 4 or 5 months? Coincidently around the same time the models got a lot more capable?

Do you mean because more people are vibe coding, trusting the models' output, and putting code directly into production, so there are more security vulnerabilities created?

Or because there are more source code scanners which end up finding more vulnerabilities?

Re: GitHub is investigating unauthorized access to their internal repositories

#93

Post by siwatanejo »

__turbobrew__ wrote: post #88
lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

I think it is pretty common that devs have read only access to all source code. The real question is why github has 3800 internal repos.

It's normal that a dev has *access* to all the code.

But did he clone all the repos into his machine? I doubt it. So, the hacker extracted all the 3800 repos using the employee's machine as a gateway? I doubt it as well, I'm sure they would have detected this huge amount of data much earlier than transferring all of it?

> The real question is why github has 3800 internal repos.

I guess they mean customer's private repos?

Re: GitHub is investigating unauthorized access to their internal repositories

#94

Post by jameson »

lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

Security is often overlooked internally and seen as source of friction. I worked at a popular US social media firm and it wasn't hard to get a permission that allows me to delete the entire company's dataset. Often arguments around "I'm working on org-level initiative and I need to get permission to get it done" would easily get me the permission.

Re: GitHub is investigating unauthorized access to their internal repositories

#95

Post by selcuka »

siwatanejo wrote: post #93
__turbobrew__ wrote: post #88

Earlier quoted context omitted.

I think it is pretty common that devs have read only access to all source code. The real question is why github has 3800 internal repos.

It's normal that a dev has *access* to all the code. But did he clone all the repos into his machine? I doubt it. So, the hacker extracted all the 3800 repos using the employee's machine as a gateway? I doubt it as well, I'm sure they would have detected this huge amount of data much earlier than transferring all of it? > The real question is why github has 3800 internal repos. I guess they mean customer's private re…

> I guess they mean customer's private repos?

I don't think so. It is even worse if a random developer has access to customers' private repos.

Re: GitHub is investigating unauthorized access to their internal repositories

#97

Post by baq »

lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

If you want to move fast, you need access. Unfortunately and obviously this allows threat actors to move fast, too. The tradeoff had a different risk profile a year ago, heck a couple weeks ago.

Re: GitHub is investigating unauthorized access to their internal repositories

#100

Post by skirge »

__turbobrew__ wrote: post #88
lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

I think it is pretty common that devs have read only access to all source code. The real question is why github has 3800 internal repos.

each employee with personal fork of some company microservice
Post reply on HN