Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tencent WeChat is now a GitHub secret scanning partner

github.blog

Post reply on HN
Print view View original

61–70 of 144 posts

Re: Tencent WeChat is now a GitHub secret scanning partner

#61

Post by gamegod »

Arnt wrote: post #40
jkaplowitz wrote: post #7

Earlier quoted context omitted.

> In other words, Tencent now has access to all of your public repositories. They already did. That's what public means. This is just an optimization to make it harder for WeChat access tokens to be inadvertently compromised without getting noticed. If you're worried about the Chinese government having inappropriate influence over or access to various things outside China, that's in general a valid concern indeed, bu…

I'm shocked by the number of respondents who felt the need to point out what public means.

It's because this site is dead and more than half the comments are written by bots. On average HN article, like 75% of the comments make absolutely no sense.

Re: Tencent WeChat is now a GitHub secret scanning partner

#62

Post by hunter2_ »

pixl97 wrote: post #47
galuggus wrote: post #11

Isn't this information already public?

Which information? Your wechat tokens, no that should never be public, hence why this feature exist? That github reports that you leaked your wechat tokens, it was announced just recently, hence the post. That github is giving wechat your secrets, not that is not what this is about although the article title would make you think that.

GitHub is indeed giving WeChat our information, but only when it looks just like WeChat secrets, and only once it's already publicly leaked (any leaked via private repo instead goes to the repo admin).

So technically the answer to GP is 'yes'.

Re: Tencent WeChat is now a GitHub secret scanning partner

#63

Post by whoevercares »

It’s absolutely shocking to observe how hostile HN is to Chinese affairs. While in real life many must have collaborated A LOT with Chinese engineers & managers. Are you worry about bias bleeding into real life? I’m indeed worried as a Chinese immigrant working in tech

Re: Tencent WeChat is now a GitHub secret scanning partner

#64

Post by 3np »

richardw wrote: post #25
boredhedgehog wrote: post #20

Earlier quoted context omitted.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

Because if you want to influence the voting patterns of a population, knowing as much as you can is useful. Search history + TikTok + FB would give you unbeatable datasets that you could use for the lifetime of the person. Take a dataset now, add a decade of AI progress and I’m pretty sure a nefarious actor would be leading many people around by the nose. Not all, but 5% would move many elections. They wouldn’t even…

In other words, your data in their hands is dangerous to you when combined with that of others.

Re: Tencent WeChat is now a GitHub secret scanning partner

#65

Post by boomboomsubban »

Alifatisk wrote: post #58
lopkeny12ko wrote: post #50

Just a reminder that Git is a decentralized protocol and Github is merely a (poor) implementation of it. Microsoft-Github have been increasingly introducing antifeatures, just one of which is sending repository contents to China automatically. For the last few years I've been running Git off my own servers with a cgit [0] frontend, and couldn't be happier. [0] https://git.zx2c4.com/cgit/about/

How is Githun a poor implementation of Git? Because it’s centralized?

I believe it's roughly a quote from Linus Torvalds, the creator of git who has many issues with githubs decisions. See https://www.wired.com/2012/05/torvalds-github/ for a start, his opinion hasn't improved over the decade.

Re: Tencent WeChat is now a GitHub secret scanning partner

#66

Post by Cthulhu_ »

nottorp wrote: post #13

Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.

I think the name of the service is a bit ambiguous; they could've called it "Access Key Scanning" or even just "Secret*s* Scanning". Even capitalizing it would set it apart as a service instead of regular words in a sentence.

Re: Tencent WeChat is now a GitHub secret scanning partner

#67

Post by tonmoy »

iampivot wrote: post #46
jasode wrote: post #19

Earlier quoted context omitted.

>, I had no idea they had a program called "secret scanning" and that it's actually beneficial. Fyi... this feature was also previously mentioned in the news for public repos: https://techcrunch.com/2022/12/15/github-brings-free-secret-... >So I obviously assumed they're letting China scan my private repos. To clarify, it's Microsoft/Github doing the scanning of private repos on behalf of the partners. They're just f…

Like .* ?

I don’t think GitHub will send back the matching string, just the name of the repos

Re: Tencent WeChat is now a GitHub secret scanning partner

#68

Post by Cthulhu_ »

didericis wrote: post #60
boredhedgehog wrote: post #20

Earlier quoted context omitted.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

> If I was forced to pick one government to share my secrets with, it would be the Chinese, because there’s nothing they can do about it. What makes you so sure about that? I worry about China because there’s no internal checks to prevent them from doing anything . Western governments and allies have a long culture of court systems and thinking about balancing constituent needs. That is eroding and becoming more dang…

> What makes you so sure about that?

I think the commenter means that China can't do much about them while living where they do (e.g. the US), whereas the US based intelligence agencies can black bag them in most of the western world.

Given the Snowden revelations, I don't believe there's much accountability to what the NSA and co collect and analyze. Secret courts, CIA dark sites, Gitmo, all kinds of things that might be legal according to the letter of the law, but feel immoral and unjust (war crimes level of unjust).

Re: Tencent WeChat is now a GitHub secret scanning partner

#69

Post by talkingtab »

boredhedgehog wrote: post #20
redleader55 wrote: post #16

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

You may not have noticed this, but China is seeking to extend it's influence. By whatever means required including deadly force. There is a picture you might want to look at. Search "Tank Man". That is why people worry about China so much.

Re: Tencent WeChat is now a GitHub secret scanning partner

#70

Post by eynsham »

boredhedgehog wrote: post #20
redleader55 wrote: post #16

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

Some people are Chinese.
Post reply on HN