Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

151–160 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#151

Post by numpad0 »

apublicfrog wrote: post #110
tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

It's been pretty common in the past for tech companies to announce outages and quick updates about them on twitter for decades. I'm sure their status page etc will be updated soon, but it's historically been the fastest way to get things out to the wider audience whilst bypassing the "official mail out" review by marketing etc.

It doesn't show live profile pages to logged out users since a while ago. You get cached summary pages, an age gate error, or sometimes a straight up 404.

Most individual permalinks (.com/username/1234...) don't work without logging in, either, and the official client now uses `/i/` in place of usernames for permalinks(bogus usernames always worked; pkey was the timestamp).

This means an organizationally shared Twitter account for announcements is not a viable concept, at least until Twitter is to be transferred again to whoever would be a better keeper of it.

Re: GitHub is investigating unauthorized access to their internal repositories

#152

Post by eloisius »

nullpwr wrote: post #147

I'm not sure if this is related or not. But a few days ago, I saw commits from the "future tense" in some repositories. When you read "committed tomorrow" after a commit, it's not funny at all. I posted a screenshot in the announcement on GitHub.

I think the commit timestamp is just passed through from timestamps in the git repo, not the time at which the commits were pushed to the server. You can probably set your system time to the future, make some commits and push them.

Re: GitHub is investigating unauthorized access to their internal repositories

#153

Post by EDM115 »

Xunjin wrote: post #71

GitHub: " Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far." Oof https://xcancel.com/github/status/2056949169701720157

directionally, how bad is this ?

Re: GitHub is investigating unauthorized access to their internal repositories

#154

Post by Lukas_Skywalker »

nullpwr wrote: post #147

I'm not sure if this is related or not. But a few days ago, I saw commits from the "future tense" in some repositories. When you read "committed tomorrow" after a commit, it's not funny at all. I posted a screenshot in the announcement on GitHub.

That's probably unrelated. The date of a commit in git can be modified to whatever you want. I once backdated commits because my timezone was off, and I wanted the timestamps to match the ticketing system. Github displays the date stored in the commit, since there is not really a way to verify it.

Re: GitHub is investigating unauthorized access to their internal repositories

#155

Post by sph »

avaer wrote: post #150
sph wrote: post #130

Earlier quoted context omitted.

Are you from 2015? Companies have been announcing stuff on Twitter for a decade, and the rest of social media has been regurgitating Twitter posts for almost as long. Newspapers routinely quote Twitter. All that happened before they even renamed it to X. I’m not saying it’s a good idea. I am saying it somehow became the single source of truth for the Internet with all that entails.

You are kind of saying it's a good idea or at least a totally acceptable one. You're saying Twitter is famous for being famous, and looking down at someone who expresses dismay at this for being behind the times.

I do not have a Twitter account. You do. It is the cesspool of humanity and one of the reason the Internet has become so shit.

Please try not to contradict my very words to make a point. That’s very Twitter-like of you.

Re: GitHub is investigating unauthorized access to their internal repositories

#156

Post by jasonkester »

jameson wrote: post #94
lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

Security is often overlooked internally and seen as source of friction. I worked at a popular US social media firm and it wasn't hard to get a permission that allows me to delete the entire company's dataset. Often arguments around "I'm working on org-level initiative and I need to get permission to get it done" would easily get me the permission.

It’s the big advantage that small companies have over big ones.

I’ve ridden startups through the phase where they transition to “responsible adults”, and start putting in policies and locking things down and generally behaving like the giant corporations they expect to be one day (and that the locker downers came from and are used to).

You can feel the deceleration, like taking your foot off the gas on the freeway. I’ve sat through all hands meetings where the ceo asked why we don’t ship as fast anymore, and since by that time most of the fast moving folk have moved on, nobody has an explanation.

Re: GitHub is investigating unauthorized access to their internal repositories

#157

Post by hansmayer »

tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

I mean if you are going to use AI which was trained on code of statistically mediocre average at the best, have outages and major incidents every few days, why not go wild and start publishing incidents to twitter too? It checks out with the rest of the stuff.

Re: GitHub is investigating unauthorized access to their internal repositories

#158

Post by nullpwr »

Lukas_Skywalker wrote: post #154
nullpwr wrote: post #147

I'm not sure if this is related or not. But a few days ago, I saw commits from the "future tense" in some repositories. When you read "committed tomorrow" after a commit, it's not funny at all. I posted a screenshot in the announcement on GitHub.

That's probably unrelated. The date of a commit in git can be modified to whatever you want. I once backdated commits because my timezone was off, and I wanted the timestamps to match the ticketing system. Github displays the date stored in the commit, since there is not really a way to verify it.

Ok. Copy that. tnx

Re: GitHub is investigating unauthorized access to their internal repositories

#159

Post by avaer »

sph wrote: post #155
avaer wrote: post #150

Earlier quoted context omitted.

You are kind of saying it's a good idea or at least a totally acceptable one. You're saying Twitter is famous for being famous, and looking down at someone who expresses dismay at this for being behind the times.

I do not have a Twitter account. You do. It is the cesspool of humanity and one of the reason the Internet has become so shit. Please try not to contradict my very words to make a point. That’s very Twitter-like of you.

Fair enough! Not a fan of Twitter either.

Which is why I wouldn't want to normalize it being the kind of place where company announcements are made. IMO anyone who sees it as worrying is right, and I'm glad they're not desensitized.

Just because it's been going on for a decade doesn't make it any less crazy that Twitter has become a primary source of news.

Re: GitHub is investigating unauthorized access to their internal repositories

#160

Post by roughly »

in_a_society wrote: post #128
jms703 wrote: post #103

Do they know what the attackers were after? Maybe they were just trying to help fix the availability problems.

This comment reminds me of a joke where the punchline is that a person is so poor that burglars break in to their house and leave money. Similarly, I could see ransomware groups hacking in and feeling bad for GH so they improve a few things to help them get to at leave nine fives of uptime.

Many years ago there was an attack that went around that used the server’s BMC as an entry point. Thing is, BMCs are universally shit, so as part of the attack, the attackers also fixed a bunch of bugs so their connection could persist. I was working in hardware management at the time, and when we heard about that, we all gave that one a hard think…
Post reply on HN