41–50 of 150 posts
> We cram our secrets into git Excuse me?!
Earlier quoted context omitted.
Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.
> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.
It made a lot of sharp business choices in that decade, but it also left a LOT of money on the table for developers, as part of a strategic goal to grow the platform.
Then the 00s came, platform growth slowed (because they were already running on everything desktop), and the "vs linux" decisions started coming.
Earlier quoted context omitted.
Your other points are useful but I find the below questionable and counterproductive: > - Disable the ability to fork repos in your organization If someone can read it, they can trivially fork it (clone locally, then republish as new repo). The only thing you're preventing with this advice is the free discoverability and tracking of forks which you get with forks created with the GitHub "fork" button. The forks are s…
The idea is to protect against accidental sharing. A rogue employee can simply take dump and share on 4Chan no matter what tools you use.
This is true for everything in the cloud that isn’t end-to-end-encrypted. There is the saying that the cloud is just someone else's computer. But in addition, you also have no control over your data on that computer not being leaked elsewhere, or the computer ending up becoming someone different’s computer.
> We cram our secrets into git Excuse me?!
Yeah, I reacted to that too. It's like nonchalantly saying that you have all your passwords written on post-it notes at your desk. The topic of discussion shouldn't be how to secure your desk from spying eyes, but about why having post-it notes with passwords is bad practice and just a bad idea overall. If your private github repo accidentally goes public, the response should be "that's annoying but ultimately harmle…
The problem is not keeping those passwords in a secure location, treat it like a stack of $100 bills.
When we moved our code from privately hosted SVN to GitHub 10+ years ago, folks at GitHub were quite clear that we should not trust private repos with secrets like private keys or passwords.
So why have private repos at all? It is to allow control of collaborators. GitHub originally allowed everyone to see and fork every repo—a true open source approach. Private repos were added basically so corporate codebase managers would not have to spend tons of time rejecting random PRs and responding to random people.
For a LOT of private software projects, everything secret can be easily stored in the database, environments, or a dedicated tool for managing secrets. GitHub private repos are great for those. If my entire codebase is a highly sensitive trade secret, I would not use GitHub private repos, personally.
Earlier quoted context omitted.
Your other points are useful but I find the below questionable and counterproductive: > - Disable the ability to fork repos in your organization If someone can read it, they can trivially fork it (clone locally, then republish as new repo). The only thing you're preventing with this advice is the free discoverability and tracking of forks which you get with forks created with the GitHub "fork" button. The forks are s…
But now it becomes a harder mistake to make. Creating a new repository is easy, but not so easy you would do it by accident. Importantly when this is discovered you can fire the person who did it, and they can't say it's was an accident, while the fork button to the wrong place is potentially an accident.
If you want a collaboration repository with forking disabled, public is the default.
Earlier quoted context omitted.
Thats the main reason i moved my code away from github and am advising clients to follow suit. It boggles the mind that we have to actively police against ip theft by formerly reputable corporations but here we are.
> formerly reputable corporations I'm sorry but when was Microsoft ever reputable? They have a long history (and reputation) of being merciless in every single way they can, and have for as long as I can remember.
Please note I am not attempting to address the reputability of GitHub pre-acquisition. That is a separate matter.