Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

131–140 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#131

Post by seb1204 »

bpodgursky wrote: post #77
lynndotpy wrote: post #64

Earlier quoted context omitted.

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view…

[flagged]

Company news really should be posted on a company website first, other platforms secondly in my opinion.

Re: GitHub is investigating unauthorized access to their internal repositories

#132

Post by novok »

jameson wrote: post #94
lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

Security is often overlooked internally and seen as source of friction. I worked at a popular US social media firm and it wasn't hard to get a permission that allows me to delete the entire company's dataset. Often arguments around "I'm working on org-level initiative and I need to get permission to get it done" would easily get me the permission.

Security is often an excuse to block other teams to do legitimate work and so often it's fairly braindead. Security IMO needs to get it's act together, passkeys is a great example of security gone wrong from a UX design perspective because you can't hold them to the same standards as product or infra teams, they have the special privilege of breaking things and it increasing their metrics.

Tell them to make a better UX and they lose their minds in a huffy puff of fake crisis mode or get avoidant with stonewalling 'secret security stuff' that you can't hold them to account for. Or eat 50% of developer machine performance for "endpoint security" and the carnival of sadness goes on and on.

Signal is an example of security as a product that was actually designed for user UX in mind to give one example.

Re: GitHub is investigating unauthorized access to their internal repositories

#134

Post by seb1204 »

worthless-trash wrote: post #102
sham1 wrote: post #91

Earlier quoted context omitted.

Maybe we need a cultural shift then, because if one needs to use a platform like X, nowadays owned and operated by fascists, then there's something deeply wrong with the tech world. It'd probably take a lot of effort to do so, but it'd be absolutely worth it. Besides, even if that wasn't a consideration, only posting the announcement to X is just crazy. As others have said, you'd expect for GitHub to make the announc…

I just spent a few minutes trying to think of a better place, I can't think of one, there is no professional social network, and linkedin doesn't qualify.

You don't need a professional network. This is a company informing customers about a security issue. It should be on their website. Anyone can subscribe to the RSS feed if they are a customer. Remember RSS? There is no need to add a social network element.

Re: GitHub is investigating unauthorized access to their internal repositories

#136

Post by jurgenburgen »

bulbar wrote: post #73
lynndotpy wrote: post #64

Earlier quoted context omitted.

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view…

> Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. I think that's panic mode from some decision maker (i.e. head of marketing or head of security).

It’s not like they have a choice as a public company. I wonder if this low visibility post meets SEC requirements though.

Re: GitHub is investigating unauthorized access to their internal repositories

#138

Post by seb1204 »

uzyn wrote: post #18

The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like. I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an obser…

As a stock listed company is GitHub or Microsoft not required to disclose such security breaches to their shareholders? As in a stock market communication?

Re: GitHub is investigating unauthorized access to their internal repositories

#139

Post by nomilk »

Pre-AI, having access to code (e.g. if it leaked or even just open source) could allow hackers to more easily discover exploits. I wonder if that threat is now much more severe in the age of AI. Thankfully GitHub have probably themselves run their code through many AI security tools so any vulnerabilities would have already been found and patched. Hopefully.

Re: GitHub is investigating unauthorized access to their internal repositories

#140

Post by alkonaut »

lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

Devs not having read access to all code seems like a massive org smell. What’s worse, in many cases not having access doesn’t just prevent you from seeing it it also prevents you from knowing it exists. Now you don’t know what to ask for, who to ask, or what to not implement again.

There is no security risk that you could use to convince me that ”devs should only have access to code they need to modify”.

Post reply on HN