Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

301–310 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#301

Post by hirako2000 »

uzyn wrote: post #18

The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like. I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an obser…

Likely because they don't know enough to make an official announcement. it makes sense to update a social threads rather than keep updating a static page.

Status is for availability.

Re: GitHub is investigating unauthorized access to their internal repositories

#302

Post by OptionOfT »

sleples wrote: post #299
queenkjuul wrote: post #229

Earlier quoted context omitted.

This really feels like what's happening where i work. Management wants everything done yesterday. Juniors and seniors alike are giving me pure slop PRs to review. I point out an issue and the next draft from Claude has two more. It's extremely exhausting, and it's not like I'm reviewing every PR or catching every issue.

I was trying to go against the tide for the longest time by providing detailed reviews, understanding every line of code, leave meaningful comments, improve architecture, etc.. Then management started pushing AI more and more and explicitly called out PR reviews as a bottleneck, timelines shortened, and more and more slop got pushed. I gave up and I'm now a happy "AI enthusiast" at my company, handing out AI slop rev…

> I was trying to go against the tide for the longest time by providing detailed reviews, understanding every line of code, leave meaningful comments, improve architecture, etc..

I tried that too, until I realized the people I was supposed to mentor take my comment, feed it to the LLM, and let it make the fix.

And in the meantime they learned nothing.

Re: GitHub is investigating unauthorized access to their internal repositories

#303

Post by bugeats »

nomilk wrote: post #139

Pre-AI, having access to code (e.g. if it leaked or even just open source) could allow hackers to more easily discover exploits. I wonder if that threat is now much more severe in the age of AI. Thankfully GitHub have probably themselves run their code through many AI security tools so any vulnerabilities would have already been found and patched. Hopefully.

I just had a disturbing thought. What if the LLM providers start blocklisting certain codebases?

“I’m sorry Dave, I can’t do that. This codebase has been identified as proprietary.”

Re: GitHub is investigating unauthorized access to their internal repositories

#304

Post by okoddcat »

nelox wrote: post #278
znnajdla wrote: post #270

I’ve been telling people recently: get the fuck off cloud services, self-host your own servers, and learn how to do sysadmin/netadmin stuff like it’s 1990 because I assume all centralized cloud service providers will be infiltrated. AI vibe coding has made security a nightmare - secrets are in logs everywhere, developer machines are all pwned by npm attacks, and if you’re on the cloud you’re paying 10x the cost of se…

Gitea is good too

Try this lightweight one https://github.com/gisiahq/gisia

Re: GitHub is investigating unauthorized access to their internal repositories

#305

Post by Yiin »

DanielHB wrote: post #274
auscompgeek wrote: post #253

Earlier quoted context omitted.

As a developer or security researcher, you're able to download and run GitHub Enterprise Server. I'm not sure having access to the full source code makes a meaningful difference for most of GitHub's surface area, given it's largely Ruby.

LLMs can't really parse compiled code to find exploits, maybe code in scripting languages (python, js, etc) even if minified. So I don't quite agree with you, having access to the source can definitely help find exploits even in pre-LLM days.

how to say you haven't tried llms since 2023 without saying it, that's quite literally one of the things they excel at

Re: GitHub is investigating unauthorized access to their internal repositories

#306

Post by abustamam »

uzyn wrote: post #18

The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like. I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an obser…

As much as I dislike X, perhaps the solution is to provide a widget of sorts that can be embedded into the status page (or whatever page). This widget would not require Auth and anyone can see the thread in-situ.

This doesn't need to be X, BTW, but if everyone's gonna use X may as well meet people where they are.

Re: GitHub is investigating unauthorized access to their internal repositories

#307

Post by inquirerGeneral »

StableAlkyne wrote: post #300
sph wrote: post #228

Earlier quoted context omitted.

Asking on behalf of Github’s PR team: what is the suggested alternative to X to post our updates to reach the largest amount of people, companies, as well as promote our brand? I haven’t seen any suggestion in this thread. status.github.com fails many of these criteria.

Bluesky is much better for this type of thing. It functions like X did 10 years ago: anyone can read the posts and subsequent thread, even if they don't have a Bluesky account. The main non-political issue with X is that those without an account (or who are unable to login) may not be able to access it, which isn't ideal for a backup communications channel. Best of both worlds is to set up mirroring where you post to…

[dead]

Re: GitHub is investigating unauthorized access to their internal repositories

#308

Post by techknowlogick »

worksonmine wrote: post #143
Khaine wrote: post #90

Earlier quoted context omitted.

I currently use Gitea. I am interested in your opinion on why you prefer Forgejo to Gitea

I'm not OP but probably the licensing drama. Gitea is now open core if I remember correctly. Some details are available here[1]. I also used to run Gitea, but I don't any more. The open-source churn is getting tedious and difficult to keep up with. [1]: https://blog.codeberg.org/codeberg-launches-forgejo.html

I'm a project lead of Gitea, and former elected board member of Codeberg. Gitea remains opensource (feel free to check out the repo and you can see that the license remiains as is), and maintains yearly community elections. The codeberg board was informed a full year prior to their "we just found out blog post", and so "catching the whole community by surprise" is very much not accurate since they very much knew. As well, we (the company) were very public with our activities prior to our blog post announcing things, including working to support other open source projects migrate, and posting about it through various channels (social media, chat, etc..).

Re: GitHub is investigating unauthorized access to their internal repositories

#309

Post by techknowlogick »

nelox wrote: post #278
znnajdla wrote: post #270

I’ve been telling people recently: get the fuck off cloud services, self-host your own servers, and learn how to do sysadmin/netadmin stuff like it’s 1990 because I assume all centralized cloud service providers will be infiltrated. AI vibe coding has made security a nightmare - secrets are in logs everywhere, developer machines are all pwned by npm attacks, and if you’re on the cloud you’re paying 10x the cost of se…

Gitea is good too

Thanks for saying so <3 If you ever run into any issues with it please feel free to report an issue or hop into chat.
Post reply on HN