Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

111–120 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#111

Post by stavros »

siwatanejo wrote: post #93
__turbobrew__ wrote: post #88

Earlier quoted context omitted.

I think it is pretty common that devs have read only access to all source code. The real question is why github has 3800 internal repos.

It's normal that a dev has *access* to all the code. But did he clone all the repos into his machine? I doubt it. So, the hacker extracted all the 3800 repos using the employee's machine as a gateway? I doubt it as well, I'm sure they would have detected this huge amount of data much earlier than transferring all of it? > The real question is why github has 3800 internal repos. I guess they mean customer's private re…

All the attackers need to do is steal an SSH key and they'd be able to clone everything, no?

Re: GitHub is investigating unauthorized access to their internal repositories

#112

Post by wutwutwat »

tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

watch it turn out to be that their twitter account is what was hacked, and github.com is actually fine

Re: GitHub is investigating unauthorized access to their internal repositories

#113

Post by [deleted] »

bpodgursky wrote: post #77
lynndotpy wrote: post #64

Earlier quoted context omitted.

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view…

[flagged]

[deleted]

Re: GitHub is investigating unauthorized access to their internal repositories

#114

Post by fulafel »

tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

Even if it's a wingnut dense place, there's good arguments for using a channel independent of your infra in a case like this. You (or Github themselves) don't know if their status page is pwned.

Re: GitHub is investigating unauthorized access to their internal repositories

#116

Post by mgrund »

lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

Read-only access to all non-sensitive code is how things should be. Huge engineering culture and productivity booster. It’s also very useful to keep each other honest (I’ve found so many “interesting” things hidden away in organizations with tight read access restrictions).

Re: GitHub is investigating unauthorized access to their internal repositories

#117

Post by Shank »

I would say, first and foremost, the era where a developer machine with source code access also has access to meaningful security systems should be over. Internal repository access should mean nothing. It's just text files. It does look like this is the case here, where there aren't actually meaningful outcomes from this, but this should be the case everywhere. Isolate these systems from each other. GitHub compromise could happen at any time, even from GitHub themselves.

Re: GitHub is investigating unauthorized access to their internal repositories

#118

Post by mcintyre1994 »

apublicfrog wrote: post #110
tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

It's been pretty common in the past for tech companies to announce outages and quick updates about them on twitter for decades. I'm sure their status page etc will be updated soon, but it's historically been the fastest way to get things out to the wider audience whilst bypassing the "official mail out" review by marketing etc.

I think that was a lot more justifiable when Twitter reliably let logged out users read tweets. X seem to tweak it all the time, or maybe it’s just broken a lot, but sometimes I can’t even load a tweet in a browser that isn’t logged in.

Re: GitHub is investigating unauthorized access to their internal repositories

#119

Post by bostik »

keyle wrote: post #23

This is bad. If they came out announcing this, without a long winded explanation and further details, it's because they're staring at a bottomless pit and they haven't put the lid on it yet. For a Fortune 100, to go out of your way to spook investors is the least desirable approach.

Part of this is likely driven by regulations. Github has plenty of clients that fall under DORA, NIS2 or both.

I don't remember the exact wording about what qualifies as "incident" or "major incident" but the TL;DR is that the regulated entities are required to notify their regulators of impactful supplier incidents within 24h with initial information and within 72h with more complete details.

Which in turn means that Github will have signed contracts that bind them to accommodating timelines.

Post reply on HN