Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.
I think the name of the service is a bit ambiguous; they could've called it "Access Key Scanning" or even just "Secret*s* Scanning". Even capitalizing it would set it apart as a service instead of regular words in a sentence.
Credential scanning.
It's not scanning that they're doing in secret. Credential scanning removes the ambiguity
To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wechat. Whatsapp, Signal & co are banned.
These "leaked" secrets GitHub forwards might be dissidents getting access without being tracked. It might not be a WeChat secret at all who knows? They're not a trustworthy partner, nothing should be shared with this company.
And to the folks saying it's public information and they already have it: That makes no sense, then they don't need GitHubs help. Obviously GitHub is supporting their scanning efforts here.
To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wec…
Wait a second, the requirement of a government to get a sim card is kinda standard practice in multiple countries. Also, when it comes to privacy, US based companies must be last ones to talk, like as if China is the only bad guy who infringes upon peoples right to privacy.
China is dangerous, but it's not the only dangerous thing in the room.
Also, your comment doesn't make sense. If you are committing your public credentials while diseenting against the government, you are doing it wrong.
Also, any publicly committed credentials are like literally tracked by thousands of both within minutes. Its not like if China really want to scan them, they can't do it without Github telling them they found something.
Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.
Yeah, you have to read the article to realize that "secret" is a noun in this case, not an adjective...
To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wec…
Without taking away from your first paragraph at all, if any dissidents are publishing their access codes to GitHub repos, they are 1) doing it completely wrong and 2) are already screwed.
The threat here, in the worst case, is associating a GitHub ID with a WeChat ID.
Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.
Scanning repos for secrets has been a thing for a while now. But seeing Tencent might put people on edge.
Optics of this article could be improved. However, this is already a well established and useful thing. When you publish your AWS (for example) secrets to your public repo, it will scan it and stop it leaking before damage can be done. This is just the same for another service.
It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.
Is this blog post not the transparency part?
I assume that the regex is `TC:[a-z0-9]{20}` or something uninteresting like that.