Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

251–260 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#251

Post by cebert »

sph wrote: post #228
queenkjuul wrote: post #224

Earlier quoted context omitted.

Much more reasonable to oppose 2026 X as the default platform than it was to oppose 2015 Twitter as the default platform. I mean reasonable both times but you obviously understand why one might have changed their mind in recent years

Asking on behalf of Github’s PR team: what is the suggested alternative to X to post our updates to reach the largest amount of people, companies, as well as promote our brand? I haven’t seen any suggestion in this thread. status.github.com fails many of these criteria.

Just get an X account. They’re free. This is the best way to get updates from AI companies like Anthropic too.

It is unfortunate that they can’t post multiple social media accounts so people can see this news on whatever platform(s) they use.

Re: GitHub is investigating unauthorized access to their internal repositories

#252

Post by edm0nd »

If they do leak it all, these are the first one's im digging into out of curiosity

3329:-rw-r--r-- 1 root root 62971493 May 18 22:52 spam-investigations.tar.gz

3330:-rw-r--r-- 1 root root 7915019 May 18 22:55 spamops.tar.gz

680:-rw-r--r-- 1 root root 306146 May 18 23:14 copilot-abuse-dashboard.tar.gz

681:-rw-r--r-- 1 root root 219637 May 18 23:03 copilot-abuse.tar.gz

2245:-rw-r--r-- 1 root root 55838 May 18 23:14 le-portal-go-admin.tar.gz

3820:-rw-r--r-- 1 root root 2204 May 19 04:25 secret-scanning-password-detection.tar.gz

2223:-rw-r--r-- 1 root root 36777 May 18 23:05 law-enforcement-front-door.tar.gz

2224:-rw-r--r-- 1 root root 56824 May 18 23:12 law-enforcement-portal-go.tar.gz

2225:-rw-r--r-- 1 root root 141825 May 18 23:12 law-enforcement-portal.tar.gz

Re: GitHub is investigating unauthorized access to their internal repositories

#253

Post by auscompgeek »

nomilk wrote: post #139

Pre-AI, having access to code (e.g. if it leaked or even just open source) could allow hackers to more easily discover exploits. I wonder if that threat is now much more severe in the age of AI. Thankfully GitHub have probably themselves run their code through many AI security tools so any vulnerabilities would have already been found and patched. Hopefully.

As a developer or security researcher, you're able to download and run GitHub Enterprise Server. I'm not sure having access to the full source code makes a meaningful difference for most of GitHub's surface area, given it's largely Ruby.

Re: GitHub is investigating unauthorized access to their internal repositories

#254

Post by beng-nl »

Y-bar wrote: post #247
mimsee wrote: post #246

Earlier quoted context omitted.

it's apple maps bad

I’m in a location where Apple Maps is significantly better than Google’s. So I’m unsure if you mean ”it’s Apple Maps meme bad” or if you just mean ”it’s rather meh, could be better, could be worse”.

I think bad: https://youtu.be/tVq1wgIN62E?is=GOTAfXSie70pln-W

Re: GitHub is investigating unauthorized access to their internal repositories

#255

Post by Etheryte »

edm0nd wrote: post #252

If they do leak it all, these are the first one's im digging into out of curiosity 3329:-rw-r--r-- 1 root root 62971493 May 18 22:52 spam-investigations.tar.gz 3330:-rw-r--r-- 1 root root 7915019 May 18 22:55 spamops.tar.gz 680:-rw-r--r-- 1 root root 306146 May 18 23:14 copilot-abuse-dashboard.tar.gz 681:-rw-r--r-- 1 root root 219637 May 18 23:03 copilot-abuse.tar.gz 2245:-rw-r--r-- 1 root root 55838 May 18 23:14 le-…

To be fair, personally I wouldn't think much of the law enforcement ones. We used to have a department for that at one of my previous gigs and it's mostly just uploading files and making sure the contacts line up with official contacts.

Re: GitHub is investigating unauthorized access to their internal repositories

#257

Post by alexfoo »

tom_ wrote: post #48
tptacek wrote: post #31

Earlier quoted context omitted.

There is a 100% chance that people are using LLMs to find vulnerabilities and build exploits. If it was possible for something to be a 101% chance, that's what it would be.

Apologies to all - I am British. The phrase "non-zero" does cover every case other than zero, but the intent is that it covers some cases more than others. What I'm trying to say is: yes. My intent was just to push back on this specific (and slightly bizarre to me) instance of kind-of-vagueposting, to my eyes written to imply that it might be some sort of unnoticed conspiracy, detectable only by the most enlightened…

Indeed. It's similar to a different sliding scale that I've noticed is much more common amongst Brits than it is by other nationalities (in my limited experience):

    Zero number of...
    Insignificant numbers of...
    Not-significant numbers of...
    Not-insignificant numbers of...
    Significant numbers of...
    Very significant numbers of...
Along with the other similar scales (roughly in order):

    None of
    One or two of
    A couple of
    A few of
    Some of
    Many of
    Lots of
    Most of
    Almost all of
    All of

Re: GitHub is investigating unauthorized access to their internal repositories

#259

Post by hootz »

wewewedxfgdf wrote: post #248

If you work at github can you see everyone's private repos?

Well yeah, they need that to do maintenance work. They can see my company's private repos from our enterprise contract, so they can absolutely see your personal ones.

Re: GitHub is investigating unauthorized access to their internal repositories

#260

Post by noir_lord »

filoeleven wrote: post #250
londons_explore wrote: post #195

Earlier quoted context omitted.

How hard would it be to have one installation step to be to have Claude read through all the code to the extension and strip out anything that looks risky (ie. Calls out to external servers).? Do that automatically for all code downloaded from the web and run outside a sandbox. Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.

That's certainly a great way to waste even more resources at a massive scale. Why is the answer for Javascript developers "don't use leftpad" but for the AI crew it's "convert the source code to tokens and attempt to strip out the bad stuff without breaking the rest"?

When you have a hammer every problem looks like a nail.
Post reply on HN