Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tencent WeChat is now a GitHub secret scanning partner

github.blog

Post reply on HN
Print view View original

21–30 of 144 posts

Re: Tencent WeChat is now a GitHub secret scanning partner

#21

Post by nottorp »

jasode wrote: post #19
nottorp wrote: post #13

Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.

>, I had no idea they had a program called "secret scanning" and that it's actually beneficial. Fyi... this feature was also previously mentioned in the news for public repos: https://techcrunch.com/2022/12/15/github-brings-free-secret-... >So I obviously assumed they're letting China scan my private repos. To clarify, it's Microsoft/Github doing the scanning of private repos on behalf of the partners. They're just f…

Yeah I read the article and the comments on HN so I know what it's about now. I still think they (not HN) should change the title to include what secret scanning means.

Edit: how about dropping the corporatese and title it "github will now scan public repos for secret WeChat tokens"?

Re: Tencent WeChat is now a GitHub secret scanning partner

#22

Post by dwighttk »

boredhedgehog wrote: post #20
redleader55 wrote: post #16

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

> because there's nothing they can do about it

What makes you think this?

Re: Tencent WeChat is now a GitHub secret scanning partner

#23

Post by blitzar »

rafael09ed wrote: post #18
_jplc wrote: post #4

Earlier quoted context omitted.

> We have partnered with Tencent WeChat to scan for *THEIR* tokens

No one owns random strings. They can claim whatever they want to be "their" tokens

Not your random string not your coins. Not your random string not your monkey picture.

Re: Tencent WeChat is now a GitHub secret scanning partner

#24

Post by mylidlpony »

boredhedgehog wrote: post #20
redleader55 wrote: post #16

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

> because there's nothing they can do about it

Are you talking about the China that bought huge areas in ports around the world? The same one that has secret police stations as well?

Re: Tencent WeChat is now a GitHub secret scanning partner

#25

Post by richardw »

boredhedgehog wrote: post #20
redleader55 wrote: post #16

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

Because if you want to influence the voting patterns of a population, knowing as much as you can is useful. Search history + TikTok + FB would give you unbeatable datasets that you could use for the lifetime of the person. Take a dataset now, add a decade of AI progress and I’m pretty sure a nefarious actor would be leading many people around by the nose. Not all, but 5% would move many elections.

They wouldn’t even need to learn all that much about you as an individual. Just enough to match you with a cluster from their own population that they have infinite data on.

Re: Tencent WeChat is now a GitHub secret scanning partner

#26

Post by justaka »

nottorp wrote: post #21
jasode wrote: post #19

Earlier quoted context omitted.

>, I had no idea they had a program called "secret scanning" and that it's actually beneficial. Fyi... this feature was also previously mentioned in the news for public repos: https://techcrunch.com/2022/12/15/github-brings-free-secret-... >So I obviously assumed they're letting China scan my private repos. To clarify, it's Microsoft/Github doing the scanning of private repos on behalf of the partners. They're just f…

Yeah I read the article and the comments on HN so I know what it's about now. I still think they (not HN) should change the title to include what secret scanning means. Edit: how about dropping the corporatese and title it "github will now scan public repos for secret WeChat tokens"?

This is 100x better than the original!

Re: Tencent WeChat is now a GitHub secret scanning partner

#27

Post by jhugo »

Traubenfuchs wrote: post #14

Why is everyone upset? This is a good thing. Where are you seeing a privacy or security risk?

Tencent provides a list of regexps, and anything matching those regexps is passed to them. As far as I can tell, we don't get to know what those regexps are (and presumably they can be changed at Tencent's whim). Can you not see the issue?

Re: Tencent WeChat is now a GitHub secret scanning partner

#29

Post by netsharc »

nottorp wrote: post #13

Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.

Hmm, 2022 (2023 soon!) and people are jumping and screaming on their first and incorrect reaction to some headline (not you, but scroll down for a comment doing just that). God Bless The Internet! /s

Re: Tencent WeChat is now a GitHub secret scanning partner

#30

Post by wkat4242 »

Traubenfuchs wrote: post #14

Why is everyone upset? This is a good thing. Where are you seeing a privacy or security risk?

> Where are you seeing a privacy or security risk?

Well...

> Tencent

Here.

It's really the combination Tencent and Partnership that I find a problem. These things tend to lead to closer collaboration and WeChat is a huge surveillance tool.

Sure they have access to public info anyway because everyone does. Just let them scan it themselves then.

And yes I'd feel almost the same if it was Facebook.

Post reply on HN