Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anyone can access deleted and private repository data on GitHub

trufflesecurity.com

Post reply on HN
Print view View original

151–160 of 394 posts

Re: Anyone can access deleted and private repository data on GitHub

#151

Post by shkkmo »

Manuel_D wrote: post #138
SnowflakeOnIce wrote: post #131

Earlier quoted context omitted.

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork. [1] https://docs.github.com/en/pull-requests/collaborating-with-...

Not through the GitHub interface, no. But you can copy all files in a repository and create a new repository. IIRC there's a way to retain the history via this process as well.

All you should have to do is just clone the repo locally and then create a blank GitHub repository, set it as the/a remote and push to it.

Re: Anyone can access deleted and private repository data on GitHub

#152

Post by arccy »

lnrd wrote: post #128
thih9 wrote: post #99

Can this be used to host illegal content? I.e.: fork a popular repo, commit a pirated book to the fork, delete the fork, use the original repo to access the pirated book? What would github do after receiving a DMCA request in that case?

That looks like the kind of loophole that could get GH to do something about this.

they have the ability to do essentially git gc and drop unreachable commits

Re: Anyone can access deleted and private repository data on GitHub

#153

Post by cycomanic »

tptacek wrote: post #115
berdario wrote: post #109

Earlier quoted context omitted.

I can see this argument making a bit of sense, but if they documented this 3 years after the issue was reported, they don't have a way to demonstrate that they truly already knew. At the end it boils down to: is Github being honest and fair in answering the bug bounty reports? If you think it is, cool. If you don't, maybe it's not worth playing ball with Github's bug bounty process

It doesn't matter if they knew. If they don't deem it a security vulnerability --- and they have put their money where their mouth is, by documenting it as part of the platform behavior --- it's not eligible for a payout. It can be a bug, but if it's not the kind of bug the bounty program is designed to address, it's not getting paid out. The incentives you create by paying for every random non-vulnerability are real…

I would argue that even if the behaviour was as intended, at least the fact that it was not documented was a bug (and a pretty serious one at that).

Re: Anyone can access deleted and private repository data on GitHub

#154

Post by dheera »

chrisandchris wrote: post #47
hackerbirds wrote: post #44

Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate

Yep, I see GitHub as "public only" hosting, and if I want to host something private, I will choose another vendor.

Or commit an ecryptfs.

Clone and mount, unmount and commit

Re: Anyone can access deleted and private repository data on GitHub

#155

Post by HL33tibCe7 »

lilyball wrote: post #10

Really the only semi-interesting part of this is "if you make a private repo public, data from other private forks might be discoverable", but even that seems pretty minor, and the best practice for taking private repos public is to copy the data into a new repo anyway.

You’ve completely missed the most dangerous thing mentioned, namely that private forks are not private.

Re: Anyone can access deleted and private repository data on GitHub

#156

Post by NullPrefix »

layer8 wrote: post #65
hackerbirds wrote: post #44

Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate

> I'll be calling "private" repos "unlisted" The same for “deleted” repos.

"deleted" is just a fancy word "inaccessible to the user"

Re: Anyone can access deleted and private repository data on GitHub

#157

Post by JyB »

Manuel_D wrote: post #138
SnowflakeOnIce wrote: post #131

Earlier quoted context omitted.

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork. [1] https://docs.github.com/en/pull-requests/collaborating-with-...

Not through the GitHub interface, no. But you can copy all files in a repository and create a new repository. IIRC there's a way to retain the history via this process as well.

That’s beside the point. The article is specifically about « GitHub forks » and their shortcomings. It’s unrelated to pushing to distinct repositories not magically ´linked’ by the GH « fork feature ».

Re: Anyone can access deleted and private repository data on GitHub

#158

Post by ahpook »

Hubber here (same username on github.com). We in GitHub's OSPO have been working on an open source GitHub App to address the use case where organizations want to keep a private mirror of an upstream public fork so they can review code and remove IP/secrets/keys that get committed and squash history before any of those changes are made public. Getting a beta release this week, in fact - check it out, I'm curious what yall think about the approach

https://github.com/github-community-projects/private-mirrors

Re: Anyone can access deleted and private repository data on GitHub

#159

Post by prepend »

jonahx wrote: post #126
hyperpape wrote: post #97

Earlier quoted context omitted.

Even if it wasn't forked, it could be cloned. Should that be part of the warning? I wouldn't mind a disclaimer when you delete a repository that any information that repository ever contained is likely to have already been downloaded and stored. Per the comment I added, I'm not sure it would really help that much, but it would not be harmful.

> Should that be part of the warning? It couldn't hurt, but that isn't the misunderstanding I'm worried about. As described in the first example of the article, you can make a fork, commit to it, delete your entire fork , and yet the data will still be accessible via the parent repo, even though no one ever forked or cloned or saw your fork. That is not intuitive at all. You can say "Well just consider any data that…

> It couldn't hurt, but that isn't the misunderstanding I'm worried about.

I think lots of warnings lead to people ignoring the warnings. So it could hurt by making people less aware of other warnings.

Re: Anyone can access deleted and private repository data on GitHub

#160

Post by NavinF »

>Commit hashes can be brute forced through GitHub’s UI, particularly because the git protocol permits the use of short SHA-1 values when referencing a commit. A short SHA-1 value is the minimum number of characters required to avoid a collision with another commit hash, with an absolute minimum of 4. The keyspace of all 4 character SHA-1 values is 65,536 (16^4). Brute forcing all possible values can be achieved relatively easily.

>But what’s more interesting; GitHub exposes a public events API endpoint. You can also query for commit hashes in the events archive which is managed by a 3rd party, and saves all GitHub events for the past decade outside of GitHub, even after the repos get deleted.

Oof

Post reply on HN