if it is in the cloud, it will be eventually hacked
Why?
Because of C! Rust good, C bad.
Microsoft's GitHub account allegedly hacked, 500GB stolen
31–40 of 126 posts
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#32Sounds sketchy given what the employee from Microsoft commented. The article is also not completely up to date with their “interesting” findings. For example, while a language projection for the Windows Runtime to Rust is interesting, it is also a public repository: https://github.com/microsoft/winrt-rs I’d take this article with a grain of salt until we hear more.
I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#33Sounds sketchy given what the employee from Microsoft commented. The article is also not completely up to date with their “interesting” findings. For example, while a language projection for the Windows Runtime to Rust is interesting, it is also a public repository: https://github.com/microsoft/winrt-rs I’d take this article with a grain of salt until we hear more.
I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.
Considering Microsoft owns GitHub, there's no reasons their internal teams aren't choosing to host more code on there.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#34> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…
The most likely explanation is they phished an employee. How does self-hosting prevent that?
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#35if it is in the cloud, it will be eventually hacked
Why?
because cloud security (and cloud configuration in general) is hard.
people check in sensitive stuff to github repos all the time, misconfigure IAM policies just so that it works (capitalone).
It is a new and ever changing field, there are many cloud vendors and their product line and configurations change all the time - meaning it will take a lot of time until majority of IT specialists become familiar with configuring secure cloud and majority of users of those cloud services will not make security mistakes.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#36Microsoft stands to benefit from getting their private code exposed, because they can use it to claim that open source competitors are ripping it off. https://en.wikipedia.org/wiki/ReactOS#Internal_audit https://www.theregister.co.uk/2019/07/03/reactos_windows_res...
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#37> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…
This got me thinking.
How many companies, in terms of Market Cap are currently relying on GitHub Private Repo for their source code?
And how does very large enterprise, or financial institution ( Which is like the foundation of modern day society ) handle their source code? I presume they wont use Github for anything important?
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#38> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…
The most likely explanation is they phished an employee. How does self-hosting prevent that?
[deleted]
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#39Earlier quoted context omitted.
Why?
because cloud security (and cloud configuration in general) is hard. people check in sensitive stuff to github repos all the time, misconfigure IAM policies just so that it works (capitalone). It is a new and ever changing field, there are many cloud vendors and their product line and configurations change all the time - meaning it will take a lot of time until majority of IT specialists become familiar with configur…
That only covers some cases, not the absolute of everything in the cloud eventually being hacked. Plenty of people are competent at secure cloud based systems. Your claim and your support don't match. I expected this to go more in the direction of: cloud providers are such big juicy targets they'll just be infiltrated by advanced persistent threats who in turn gain illicit access to everything hosted.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#40> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…
Private github repositories are private the same way that facebok messages are private - private from your roommate, not from the people who own the platform or determined attackers.
Would be nice if git could store encrypted data and decrypt files on checkout. Repositories could be truly private that way.