801–810 of 840 posts
Earlier quoted context omitted.
Who has this access. The NSA? They didn't have this access when GitHub was independent? Says who? Backed up by which facts?
Fact is Microsoft is a hostile company and will have access to private repositories.
Earlier quoted context omitted.
What do you mean by 'wrapper over binary blobs'? I know the old .doc format was basically a memory dump of the document; but how does OXML relate to that?
> OpenXML on the other hand, is a high-level specification which describes the high level envelopes used to embed binary objects which are included in the content. The content itself contains the binary code which can call any function in any Microsoft library and has all permissions of the person opening the document. http://slated.org/ooxml_dissecting_the_binary_blob_problem http://ooxmlisdefectivebydesign.blogspot…
Well, I kinda trusted Github to be good actors with the things they centralized while Microsoft is almost the epitome of reasons why centralization is bad and why you want to carefully keep control over your process. Nope. Nope nope nope nope nope.
I trust Microsoft more than GitHub, honestly. GH handled their last round of ethics issues very poorly.
An investigation is ongoing in Spain since Windows 8 UEFI's practices made competition harder.
Microsoft is still Microsoft. Breaking standards, making interoperability harder. It won't be 6 months before github starts having VS-only or windows-only features.
Earlier quoted context omitted.
> I wanted to give an example of a potential threat. I really don't like this line of thinking. It's the same one used by news organizations to plump up their stories, or by politicians to make an improbable threat seem more real. In both of those cases, I think the long-term effect is to cause the public to think that very rare events are a lot more common. The result is not a culture of wariness but a culture of fe…
OK. Let's not talk about potential threats. That's the language of fear, control, and paralysis. It's the language of liars and demagogues and exaggerations. Let's talk about risks and goals. The language of opportunities. An approach of `curl | bash` takes a needless amount of risk to accomplish its goals. It can do far too many things, of which it actually needs to do a small subset. It offers a lot of opportunity…
The happy path is that you have some code to share and I want to get it exactly as you wrote it.
Right now the current issues with just using GitHub to share your code are the following:
1. GitHub app gets hacked and let's someone else do a commit (like the rails hack mentioned above).
2. GitHub employee modifies files in prod servers.
3. GitHub cloud provider gets hacked
4. State actor with lots of resources MITM GitHub.com domain and internet traffic and you fetch something else.
I think all this problems could be solved if:
1. Git enforces that all commits must be signed.
2. There is a decentralized list of usernames and keys.
This feature doesn't exists in git but it would be great if you could run `git clone` and it rejects the cloning if not all commits and tags has been signed.
But what If someone hacked GitHub to add a commit and she or he signed the commit. We need some kind of CA to only accept signed commits from the right people.
So there should be a fixed list of committers allowed in the repo and git would have to enforce that as well.
Then you have the problem that if all public keys are stored in GitHub then you almost get back to all the problems again of GitHub getting hacked. It would be great to have as many copies of usernames and public keys as possible. Something like a blockchain would be a good fit.
To recap, by having a decentralized system of users and public keys, and making git validate that the commits are signed and from the right people, we could have a much more reliable way of sharing code.
Additionally, we could have an "audit" system on top of all this were users can review code and mark it as "good". Then if you have a repo with a tagged version that has 5 reviews you can hope that it's pretty safe to run that version. Because it's a single system of usernames, you can check who are the reviewers.
It might be a bad idea to `curl | bash` a script from an stranger but at least you remove the risks of your code being delivered by a third party.
Earlier quoted context omitted.
Exactly. A big concern for enterprise customers (that often drove them to Atlassian over Github) was the fear that Github was "just a startup" and might disappear at any moment and the lack of integration with existing enterprise tools. If MS can put together a comprehensive platform here that doesn't cost an arm and a leg they could dominate this market. The real story here is that nobody wants to host their own ser…
The success of Atlassian shows that you can have a great business in development tools without caring much about developer experience.
After all, the people buying the software/service aren't the ones who are going to be using it every day.
Earlier quoted context omitted.
The NSA is not god, they can't break 2048-bit TLS encryption no matter how many computers they have.
> The NSA is not god, they can't break 2048-bit TLS encryption no matter how many computers they have. 2048 bit TLS encryption? You mean 2048 bit RSA encryption? Also what source do you have that says the NSA can not crack a 2048 bit RSA key? Last I checked that info was non public and there is no definitive, credible source saying whether they can or can not crack 2048 RSA keys.
Earlier quoted context omitted.
Phrases don't lose their relevance due to age. If they do, they do it because the situation has changed, and similar situations haven't come up. For example, the phrase "doublespeak" is much older and also especially relevant today.
The phrase is still valid, but it is unclear that it applies to the current company. Companies do not have minds and are not people. They do have inertia, but if you change enough of the people then it's fundamentally a different company. MS is certainly different than it was 20 or 10 years ago.
The year is 2018 and Windows still ships with a single navigator, only supports NTFS and does not know that dual-boot is even a possibility.
Earlier quoted context omitted.
My criteria is based on how they treated me on several occasions.
Very vague description of your anecdotal evidence. I mean, for starters, which time period are you referring to?
Friendly reminder: this is the same Microsoft that "empowered" skype and once called open source a cancer. Its the same Microsoft that ruined open document standards and started the browser wars. I wouldnt be surprised to see next years release of "Github Pro Platinum with Minecraft 3D and Windows Store integration" For those looking to move, https://gitlab.com is an excellent open source alternative that can easily…
> once called open source a cancer There are some really good arguments as to why we should be worried about Microsoft so can we please stop ruining them by using this complete misquote as a component. This comment covers it well: > This is disingenuous. He was referring to the licensing model of certain open-source projects, where the introduction of a single line of code coming from an open source project would req…
This fits pretty well with Microsoft calling Linux a "cancer".
(Note that you also have to carefully review licensing of libraries used with proprietary licenses; that's not a problem caused by open source unlike the quote wants to imply. Proprietary licenses also tend to "contamine" a project and make the entire project non-free, so that is not specific to open source either.)
Earlier quoted context omitted.
OK. Let's not talk about potential threats. That's the language of fear, control, and paralysis. It's the language of liars and demagogues and exaggerations. Let's talk about risks and goals. The language of opportunities. An approach of `curl | bash` takes a needless amount of risk to accomplish its goals. It can do far too many things, of which it actually needs to do a small subset. It offers a lot of opportunity…
Good question. The specific problem that I'd like to tackle is sharing code as safe as possible. The happy path is that you have some code to share and I want to get it exactly as you wrote it. Right now the current issues with just using GitHub to share your code are the following: 1. GitHub app gets hacked and let's someone else do a commit (like the rails hack mentioned above). 2. GitHub employee modifies files in…
https://git.scuttlebot.io/%25q5d5Du%2B9WkaSdjc8aJPZm%2BjMrqg...
