Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tencent WeChat is now a GitHub secret scanning partner

github.blog

Post reply on HN
Print view View original

71–80 of 144 posts

Re: Tencent WeChat is now a GitHub secret scanning partner

#71

Post by Cthulhu_ »

mylidlpony wrote: post #24
boredhedgehog wrote: post #20

Earlier quoted context omitted.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

> because there's nothing they can do about it Are you talking about the China that bought huge areas in ports around the world? The same one that has secret police stations as well?

TECHNICALLY they only supply loans and construction assistance to countries that don't have the infrastructure themselves yet, but, yeah.

Not like the US is much better though; US based investors and shell companies own property all across the world, and US intelligence agencies infiltrated / owned European based secure communications companies / products (https://en.wikipedia.org/wiki/Crypto_AG).

Also, the US has public / non-secret army bases in 100+ countries, and secret police stations in loads of places elsewhere (50 prisons in 28 countries: https://en.wikipedia.org/wiki/CIA_black_sites)

Re: Tencent WeChat is now a GitHub secret scanning partner

#72

Post by zanellato19 »

talkingtab wrote: post #69
boredhedgehog wrote: post #20

Earlier quoted context omitted.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

You may not have noticed this, but China is seeking to extend it's influence. By whatever means required including deadly force. There is a picture you might want to look at. Search "Tank Man". That is why people worry about China so much.

oh, you mean like the US and its global reaching government?

Re: Tencent WeChat is now a GitHub secret scanning partner

#73

Post by nicce »

pell wrote: post #57
nicce wrote: post #43

Earlier quoted context omitted.

So, basically... nothing? You should go into China to get a real threat. On the other hand, there is global cooperation with intelligence agencies of USA and many European countries.

China spies on Uyghurs in other countries, puts pressure on them and has been known to run secret police stations as well. China spying on Uyghurs in Sweden: https://www.rferl.org/a/Sweden_Jails_Uyghur_Chinese_Man_For_... China controls dissidents abroad through relatives back home: https://www.reuters.com/article/us-china-uighurs-idUSKBN0UD1... China's secret police stations in Europe: https://www.spiegel.de/interna…

They key point was not in acquiring information.. instead in authority to do something real with that information without real concequences.

Re: Tencent WeChat is now a GitHub secret scanning partner

#74

Post by cscurmudgeon »

boredhedgehog wrote: post #20
redleader55 wrote: post #16

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

https://amp.cnn.com/cnn/2022/12/04/world/china-overseas-poli...

Yep totally harmless.

> China operating over 100 police stations across the world with the help of some host nations, report claims

Re: Tencent WeChat is now a GitHub secret scanning partner

#75

Post by ilyt »

Alifatisk wrote: post #56
boredhedgehog wrote: post #20

Earlier quoted context omitted.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

> If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. Unless you live or visit there. Wasn’t there reports of China having concentration camps?

Obviously if someone would pick China it was because they were not planning to visit there

Re: Tencent WeChat is now a GitHub secret scanning partner

#76

Post by ilyt »

didericis wrote: post #60
boredhedgehog wrote: post #20

Earlier quoted context omitted.

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

> If I was forced to pick one government to share my secrets with, it would be the Chinese, because there’s nothing they can do about it. What makes you so sure about that? I worry about China because there’s no internal checks to prevent them from doing anything . Western governments and allies have a long culture of court systems and thinking about balancing constituent needs. That is eroding and becoming more dang…

Eh, never stopped USA

Re: Tencent WeChat is now a GitHub secret scanning partner

#77

Post by ilyt »

AlbertVAustin wrote: post #9
nomercy400 wrote: post #8

Wait, what? So any string (which Github deems an access token) is forwarded to Tencent? Or will Tencent share all their current access tokens with github?

Any string that matches access token regexp provided by Tencent (see https://docs.github.com/en/developers/overview/secret-scanni... ).

So it is just one bad regexp away from sending them other companies secrets

Re: Tencent WeChat is now a GitHub secret scanning partner

#78

Post by masterof0 »

whoevercares wrote: post #63

It’s absolutely shocking to observe how hostile HN is to Chinese affairs. While in real life many must have collaborated A LOT with Chinese engineers & managers. Are you worry about bias bleeding into real life? I’m indeed worried as a Chinese immigrant working in tech

Is simply xenophobia, as it is with Russians or Russia-related issues. This is how the internet works in the Western world. When you point it out, they simply downvote you; if your account is new, they will claim it is a bot or that you are an agent/collaborator, and so on.

Re: Tencent WeChat is now a GitHub secret scanning partner

#79

Post by ilyt »

pontilanda wrote: post #33
jhugo wrote: post #27

Earlier quoted context omitted.

Tencent provides a list of regexps, and anything matching those regexps is passed to them. As far as I can tell, we don't get to know what those regexps are (and presumably they can be changed at Tencent's whim). Can you not see the issue?

I cannot see the issue because the regex are pre-approved by GitHub. And even then, the service will only return the string, not who wrote it. Unless GitHub approves /Jonh Doe said:.*/ there is no issue whatsoever.

Yeah because it is oh-so-easy to ensure your regexp matches only your company's tokens and not 10000 other companies tokens /s

Re: Tencent WeChat is now a GitHub secret scanning partner

#80

Post by MonkeyClub »

astrange wrote: post #52
MonkeyClub wrote: post #39

Earlier quoted context omitted.

> I cannot see the issue because the regex are pre-approved by GitHub. GitHub is a private company with one dual obligation, to prolong its existence and keep increasing its profit margin. It is not any sort of arbiter for morality - morality being an externality to its central obligation - so it cannot be relief upon to “do the right thing”. So it is not in any position of authority that would enable it to “approve”…

Generally when you come up with something from first principles that appears to be "terrifyingly obvious", that thing is false. Microsoft's mission in life is to do whatever its directors want, insofar as its shareholders don't get /too/ annoyed about this, and to not break the law. They have no actual "obligations" or "fiduciary duties" to keep increasing profits or anything like that.

So they have no duty towards the general public either, until the public’s too irritated with them, and calls for overview. How’s that better, or any different at all?
Post reply on HN