Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tencent WeChat is now a GitHub secret scanning partner

github.blog

Post reply on HN
Print view View original

1–10 of 144 posts

Re: Tencent WeChat is now a GitHub secret scanning partner

#3

Post by Arnt »

okokwhatever wrote: post #2

Is this a joke? I'm not laughing.

No joke. «GitHub will forward access tokens found in public repositories to Tencent WeChat, who will notify affected users.» In other words, Tencent now has access to all of your public repositories.

Also, Github now has code recognise Tencent access tokens.

Re: Tencent WeChat is now a GitHub secret scanning partner

#4

Post by _jplc »

Arnt wrote: post #3
okokwhatever wrote: post #2

Is this a joke? I'm not laughing.

No joke. «GitHub will forward access tokens found in public repositories to Tencent WeChat, who will notify affected users.» In other words, Tencent now has access to all of your public repositories. Also, Github now has code recognise Tencent access tokens.

> We have partnered with Tencent WeChat to scan for *THEIR* tokens

Re: Tencent WeChat is now a GitHub secret scanning partner

#6

Post by andrewaylett »

Arnt wrote: post #3
okokwhatever wrote: post #2

Is this a joke? I'm not laughing.

No joke. «GitHub will forward access tokens found in public repositories to Tencent WeChat, who will notify affected users.» In other words, Tencent now has access to all of your public repositories. Also, Github now has code recognise Tencent access tokens.

Tencent already had access to all your public repositories? They're public.

Re: Tencent WeChat is now a GitHub secret scanning partner

#7

Post by jkaplowitz »

Arnt wrote: post #3
okokwhatever wrote: post #2

Is this a joke? I'm not laughing.

No joke. «GitHub will forward access tokens found in public repositories to Tencent WeChat, who will notify affected users.» In other words, Tencent now has access to all of your public repositories. Also, Github now has code recognise Tencent access tokens.

> In other words, Tencent now has access to all of your public repositories.

They already did. That's what public means. This is just an optimization to make it harder for WeChat access tokens to be inadvertently compromised without getting noticed.

If you're worried about the Chinese government having inappropriate influence over or access to various things outside China, that's in general a valid concern indeed, but facilitating credential scanning in public repositories really doesn't seem worrying.

Re: Tencent WeChat is now a GitHub secret scanning partner

#9

Post by AlbertVAustin »

nomercy400 wrote: post #8

Wait, what? So any string (which Github deems an access token) is forwarded to Tencent? Or will Tencent share all their current access tokens with github?

Any string that matches access token regexp provided by Tencent (see https://docs.github.com/en/developers/overview/secret-scanni...).

Re: Tencent WeChat is now a GitHub secret scanning partner

#10

Post by blitzar »

andrewaylett wrote: post #6
Arnt wrote: post #3

Earlier quoted context omitted.

No joke. «GitHub will forward access tokens found in public repositories to Tencent WeChat, who will notify affected users.» In other words, Tencent now has access to all of your public repositories. Also, Github now has code recognise Tencent access tokens.

Tencent already had access to all your public repositories? They're public .

Thats one thing, but its not like they have access to my public instagram photos, tweets or anything like that (/s?)
Post reply on HN