31–40 of 150 posts
Don’t forget OpenAI and Microsoft using your github data for training GPT. Their privacy statement says your content will not be read by “human eyes.” https://docs.github.com/en/get-started/privacy-on-github/abo...
Recommendations missing from the article: - Enable mandatory 2fa within your Github organization (if you don't use an organization, you probably should) - Disable the ability to fork repos in your organization - Configure and enable mandatory SAML authentication. In combination with mandatory 2fa, this makes phishing and even key leakage less likely (specific keys need to be double authorized for SAML, so that random…
Your other points are useful but I find the below questionable and counterproductive: > - Disable the ability to fork repos in your organization If someone can read it, they can trivially fork it (clone locally, then republish as new repo). The only thing you're preventing with this advice is the free discoverability and tracking of forks which you get with forks created with the GitHub "fork" button. The forks are s…
Importantly when this is discovered you can fire the person who did it, and they can't say it's was an accident, while the fork button to the wrong place is potentially an accident.
Recommendations missing from the article: - Enable mandatory 2fa within your Github organization (if you don't use an organization, you probably should) - Disable the ability to fork repos in your organization - Configure and enable mandatory SAML authentication. In combination with mandatory 2fa, this makes phishing and even key leakage less likely (specific keys need to be double authorized for SAML, so that random…
Your other points are useful but I find the below questionable and counterproductive: > - Disable the ability to fork repos in your organization If someone can read it, they can trivially fork it (clone locally, then republish as new repo). The only thing you're preventing with this advice is the free discoverability and tracking of forks which you get with forks created with the GitHub "fork" button. The forks are s…
> We cram our secrets into git Excuse me?!
If source code isn't public, it's a secret by the traditional definition of the word.
Sure, but in computer programming “secrets” is also industry jargon for small strings of characters that enable authentication, like passwords or private keys, which have much higher standard of secrecy than the rest of the codebase.
Attempting to transfer ownership of a repository to another user was aborted if the user had a repository of the same name—even if it was private.
Public GitHub doesn’t seem to have this issue with the transfer request system, though. Maybe it did at some point?
> So, if you’re worried about it: stop putting sensitive data into private repositories.
Most of the issues mentioned in the post (misconfiguration, phishing, mistakes, zero-days) apply to all software, including non-cloud software. So the above advice is equivalent to "stop putting sensitive data into computers". It's run-of-the-mill popular-security nonsense that conveniently ignores that the alternatives come with their own risks, including security risks, and doesn't even attempt to perform a cost-benefit analysis.
Less of this stuff, please.
I dunno about other people but I’ve always assumed that if we’re giving employees, who we may have to fire someday, access to the code base that repos should be treated as if they could be exposed to the world at any time any way.
For example, those repositories contain a lot of privately identifiable information, it is not that easy to get such a baseline ready for that _"should be treated as if they could be exposed to the world at any time any way."_
Depending on jurisdiction this can affect sensitive information that requires much stronger controls in place when you (rightfully!) expect the repository to become public despite it is a private one.
Earlier quoted context omitted.
> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.
A cooperation is never reputable. It is easier to reason with a dog than with a cooperation. However, me thinks this relates to the times before Github became an offering by Microsoft. But the deal was just too hard to miss, getting this massive army of minion coders who all pray to the octocat and now do the Balmers dance. Oh so much fun, now it turns out, that all feed the new AI overlords.