Just make sure your secret doesn’t look like a WeChat secret
Tencent WeChat is now a GitHub secret scanning partner
41–50 of 144 posts
Re: Tencent WeChat is now a GitHub secret scanning partner
#42Earlier quoted context omitted.
> We have partnered with Tencent WeChat to scan for *THEIR* tokens
No one owns random strings. They can claim whatever they want to be "their" tokens
Tencent isn't claiming ownership of these strings, it's claiming that strings with a particular format have special meaning wrt. Tencent's APIs. It has told Github about that format.
This is fundamentally similar to how UPS, DHL etc. document how to recognise their tracking numbers.
"Their" and genitive in general doesn't necessarily mean ownership. It's often used for various sorts of connection. For example, "my address" doesn't claim ownership of either the street or the house, "my age", "my wife", all connected to me somehow but not owned by me.
Re: Tencent WeChat is now a GitHub secret scanning partner
#43Earlier quoted context omitted.
Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.
> because there's nothing they can do about it Are you talking about the China that bought huge areas in ports around the world? The same one that has secret police stations as well?
So, basically... nothing? You should go into China to get a real threat. On the other hand, there is global cooperation with intelligence agencies of USA and many European countries.
Re: Tencent WeChat is now a GitHub secret scanning partner
#44It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.
Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.
I agree. For most people here, it is their own government (or allied governments) which are the ones to be most cautious about. They're the ones most likely to ruin your life if they don't agree with what you're up to - elected or not.
Re: Tencent WeChat is now a GitHub secret scanning partner
#45Earlier quoted context omitted.
>, I had no idea they had a program called "secret scanning" and that it's actually beneficial. Fyi... this feature was also previously mentioned in the news for public repos: https://techcrunch.com/2022/12/15/github-brings-free-secret-... >So I obviously assumed they're letting China scan my private repos. To clarify, it's Microsoft/Github doing the scanning of private repos on behalf of the partners. They're just f…
Yeah I read the article and the comments on HN so I know what it's about now. I still think they (not HN) should change the title to include what secret scanning means. Edit: how about dropping the corporatese and title it "github will now scan public repos for secret WeChat tokens"?
Yea, but you don't get panic clickthru with this message.
Re: Tencent WeChat is now a GitHub secret scanning partner
#46Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.
>, I had no idea they had a program called "secret scanning" and that it's actually beneficial. Fyi... this feature was also previously mentioned in the news for public repos: https://techcrunch.com/2022/12/15/github-brings-free-secret-... >So I obviously assumed they're letting China scan my private repos. To clarify, it's Microsoft/Github doing the scanning of private repos on behalf of the partners. They're just f…
Like .* ?
Re: Tencent WeChat is now a GitHub secret scanning partner
#47Isn't this information already public?
Which information?
Your wechat tokens, no that should never be public, hence why this feature exist?
That github reports that you leaked your wechat tokens, it was announced just recently, hence the post.
That github is giving wechat your secrets, not that is not what this is about although the article title would make you think that.
Re: Tencent WeChat is now a GitHub secret scanning partner
#48Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.
Seems unbelievable how they'd fumble the title when they could just as easily have called it "secrets scanning" and it would be OK.
Re: Tencent WeChat is now a GitHub secret scanning partner
#49Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.
Seems unbelievable how they'd fumble the title when they could just as easily have called it "secrets scanning" and it would be OK.
Maybe it's intentional, to generate traffic.
Re: Tencent WeChat is now a GitHub secret scanning partner
#50Just a reminder that Git is a decentralized protocol and Github is merely a (poor) implementation of it. Microsoft-Github have been increasingly introducing antifeatures, just one of which is sending repository contents to China automatically.
For the last few years I've been running Git off my own servers with a cgit [0] frontend, and couldn't be happier.