Isn't this information already public?
Tencent WeChat is now a GitHub secret scanning partner
11–20 of 144 posts
Re: Tencent WeChat is now a GitHub secret scanning partner
#12Optics of this article could be improved.
However, this is already a well established and useful thing. When you publish your AWS (for example) secrets to your public repo, it will scan it and stop it leaking before damage can be done. This is just the same for another service.
Re: Tencent WeChat is now a GitHub secret scanning partner
#13Brilliant title for the article.
Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial.
So I obviously assumed they're letting China scan my private repos.
They really need to work on wording.
Re: Tencent WeChat is now a GitHub secret scanning partner
#14Why is everyone upset? This is a good thing.
Where are you seeing a privacy or security risk?
Re: Tencent WeChat is now a GitHub secret scanning partner
#15Wait, what? So any string (which Github deems an access token) is forwarded to Tencent? Or will Tencent share all their current access tokens with github?
Any string that matches access token regexp provided by Tencent (see https://docs.github.com/en/developers/overview/secret-scanni... ).
.*
Re: Tencent WeChat is now a GitHub secret scanning partner
#16It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.
Re: Tencent WeChat is now a GitHub secret scanning partner
#17It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.
There is a list of partners [0], I thought I had seen regexes at some point but I can no longer find them.
[0]: https://docs.github.com/en/enterprise-cloud@latest/code-secu...
Re: Tencent WeChat is now a GitHub secret scanning partner
#18Earlier quoted context omitted.
No joke. «GitHub will forward access tokens found in public repositories to Tencent WeChat, who will notify affected users.» In other words, Tencent now has access to all of your public repositories. Also, Github now has code recognise Tencent access tokens.
> We have partnered with Tencent WeChat to scan for *THEIR* tokens
No one owns random strings. They can claim whatever they want to be "their" tokens
Re: Tencent WeChat is now a GitHub secret scanning partner
#19Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.
>, I had no idea they had a program called "secret scanning" and that it's actually beneficial.
Fyi... this feature was also previously mentioned in the news for public repos: https://techcrunch.com/2022/12/15/github-brings-free-secret-...
>So I obviously assumed they're letting China scan my private repos.
To clarify, it's Microsoft/Github doing the scanning of private repos on behalf of the partners. They're just forwarding the tokens that match the partners' regexp.
Re: Tencent WeChat is now a GitHub secret scanning partner
#20It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.
Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world.
If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.