GitHub hasn't been hacked. We accidentally shipped an un-stripped/obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago. It shares code with github.com. As others have pointed out, much of GitHub is written in Ruby.
Git makes it trivial to impersonate unsigned commits, so we recommend people sign their commits and look for the 'verified' label on GitHub to ensure that things are as they appear to be.
As for repo impersonation – stay tuned, we are going to make it much more obvious when you're viewing an orphaned commit.
In summary: everything is fine, situation normal, the lark is on the wing, the snail is on the thorn, and all's right with the world.
Thank you.
[0] you failed to read the 1st paragraph of the linked article :)
By the way the serious design flaw where GitHub forges signatures on merge commits I told you about when you joined as CEO... Still not fixed.
The fact a commit can be shown as "verified" in the interface when I didn't sign it with my Yubikey is totally broken.
One issue is that you are loading profile images and creating links based on unverified emails (if I click the little picture next to the commit message I get to the impersonated profile). I mean I get that a proper solution might introduce unacceptable friction, but you can't really blame users for misunderstandings in the current state either.
Maybe add a checkbox in your profile like "Specifically mark unsigned commits" or even "don't associate unsigned commits to my account" as well.
> This is GitHub.com and GitHub Enterprise
It also contains linting config, ci workflows, dockerfiles, and other build related files that you probably wouldn't put in an "un-stripped/obfuscated tarball of our GitHub Enterprise Server source code"
Instead of making conflict messages clearer and easier to work with using local files, contributors keep thinking the users are too dumb and adding (and changing) merge resolution hacks.
This boils up to github, as can be seen by teams who do not understand the very basic about git commits, and enable "squash commits by default" on their repos. With these teams, git commit history cease to be bit sized changes in a larger changeset, and become useless displays of the author interacting with the remote server while they upload small changes to tests to make the continuous builds get green.
Funds are safu?
But Github uses the same single Git repository for all forks, and they have an issue where you can access a branch/commit of a fork from the main repository if you know its hash. They should probably fix that at some point.
bit of a Wodehousian twist there. appreciated.
Robert Browning, Pippa Passes (1901)
A nice one. I didn't know it.
https://www.goodreads.com/quotes/314320-the-year-s-at-the-sp...
Insane.
(Reading docs...)
The desktop client explicitly does not support this, why is that?
Git does not make it trivial to impersonate commits. http://www.linuxjournal.com/content/signing-git-commits
Are you aware of the fact that it is irony in the original work?
https://en.wikipedia.org/wiki/Pippa_Passes
Have you read the newspaper in the last months?
I suspect irony on your side and if it's true you are kind of funny...
You "hacked" yourself. A majority of commits are not "verified", and a majority of users don't know to "look for" the verified label. Why didn't you make signing mandatory if you recommend it?
As for repercussions to your mismanagement, I will certainly stay tuned.
In summary: you're fucked.
Also, if users don't know the very basics of how Git works, they probably shouldn't be using it, and certainly not trusting it.
Security by oh yuck it's Ruby.
No, it is not.
EDIT: Anyone looking to try doing this, please support open alternatives instead: https://gitea.io/en-us/
This is GitHub.com and GitHub Enterprise.Most likely support. GH probably doesn’t want to support an open source version (triaging issues, reviewing 3rd party pull requests, having an open roadmap). Likewise it would probably be bad PR if they just dumped the code base and were really slow (or didn’t) respond to bug reports.
Being open source requires a lot more than just the source code being available.
why does anything needs to be open source in the first place?
Open-sourcing something should add value. Github doesn't see any value in doing so (and i would agree). It's not like github has any secret ingredient that makes github source special - gitlab has replicated most of github's functionality, and so has many open hosting platforms.
The value of github is mindshare, rather than anything code wise.
- If it is so easy to shoplift, why don't stores just give out everything for free?
I've used it as a local-network git remote and generally enjoyed my experiences with it. It's not quite as developed of a web interface as Gitlab or Github, but as a git remote with a web frontend it's very usable and quick to deploy.
Regarding it's current, although waning, top choice for hosting open source software, I certainly do think we are starting to see the trade offs the open source community has been making.
There are tons of hosted GIT solutions. I've started using sourcehut [1] which seems like an rising platform that is also opensource. Hopefully youtube-dl ends up there instead of risking it on another big provider.
[1] https://sr.ht/
They don't have a mantra of all information wants to be free, and indeed their entire business model relies on hosting private repos.
I understand people wanting to host their open source on a server that's also open source. There's an argument it makes business sense if the closed source setup creates a long-term drift to GitLab or elsewhere. Nevertheless, I don't see the closed source as a contradiction.
You can love open source while producing a mix of open and closed source. Building a sustainable business often means being selective about it and seeing open source as a tool you can benefit from (enlightened self-interest), rather than an ideology you must adhere to at all times.
Which at the time of writing read as follows "It's not open source because the open source "community" is a liability and you want them far away from you at all times.
I'm not trying to be mean or sarcastic or anything. Just look at how maintainers are treated for a week and you'll see exactly what I mean."
Similar things happened with Sony over Other OS. Sadly I bet there will be further attacks and leaks as time goes on here.
After the youtube-dl event many people became aware of those "hacks" because someone used it to "upload youtube-dl into the DMCA's repo".
Since those hacks are known by GitHub but they won't fix it, someone thought that the best way to "protest" against the decition was to push GH's source into the DMCA's repo impersonating GH's CEO.
That's my theory, a protest.
edit: DMCA
Come out against the RIAA if you must do something. Better still to let the process work, you don't win legal battles by committing crimes.
What's sad about this?
Specifically, the way GitHub "embraced and extended" git (even before the Microsoft acquisition) is to have quite a few things outside the repository - like issues. You can take your source anywhere you want, but a project with 30,000 issues is going to have trouble migrating those issues.
Microsoft are running Bartertown and and are doing a pretty good impression of Master Blaster. Ironically youtube-dl just got dragged into the thunder dome.
You can trade outside Bartertown but it’s going to have low visibility.
Or is there something specific you are accusing Microsoft of?
To give an analogy, I think the Internet is great. But I dislike the individuals who exploit it to send spam and propagate worms etc.
How many people can actually push to that repo? I wonder if it would be easy to figure out who actually did it...
Github does the thing where a cloned repo shares the object space with all repos of the origin, so you can use the same commit sha1 on any of the repos. All someone would have to do is clone the repo, make the commit to their clone, then share the link with the sha1 in the origin repo.
The sha1 blob may not actually appear in the main repo timeline.
Viewing classified top secret nsa documents is not illegal unless you have agreed to never viewing them when gaining classified clearance. Anyone who does not have classified clearance is free to look at them.
You are not liable for what you read. Those posting it may be liable for infringement, and you could be liable if you infringement upon it. But reading is not yet illegal in the usa.
Reading something isn't inherently illegal itself, true. I'm fairly certain that intentionally navigating to a website that you know contains pirated content is a violation of copyright law though. (Of course no one is going to bother prosecuting you for it, but still.)
The laws surrounding classified information in the US are quite different from copyright law. They aren't relevant here at all. (https://en.wikipedia.org/wiki/Classified_information_in_the_...)
You haven't licensed the material so it's copying or possession by you is an illegal act in most jurisdictions. Your awareness of the nature of the content and its licensing status establishes intent.
Of course, if you don't redistribute it you shouldn't have any problems (at least in the US) because an IP address alone isn't sufficient to pursue someone in court here.
This URL has been excluded from the Wayback Machine."
Apart from the code linked above, I don’t think you’re missing any significant information that was on that archived page whose URL is now excluded. The screenshot at the top of this article matches what I remember of that page: https://arstechnica.com/information-technology/2020/11/githu....
To describe the screenshot in words, for the sake of those who prefer text to images for whatever reason: the commit was an orphan with no parent; it had no commit history. The message was as SethTro quoted it: “felt cute, might put gh source code on dmca repo now idk”. GitHub’s interface suggested the committer was https://github.com/nat, but there was no “Verified” label. The interface described the commit as having been created “1 hour ago” at 2020-11-04 05:00:26, the time of crawling.
I remember reading somewhere that once You include some url in robots.txt archive.org even though can have it archived it will stop showing it to the public.
https://blog.archive.org/2017/04/17/robots-txt-meant-for-sea...
They have some interesting nuggets in their robots though like `/ExplodingStuff/` and `/account-login` both of which seem to be some accounts.
Or probably more possible - they just got in contact with the archive.org people.
Of course Drew DeVault thinks this way. He's trying to monetize his own github-like product, the sourcehut, so less people using GitHub means more people using sourcehut.
https://web.archive.org/web/20201104050247/https://codeload....
mirror: https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b...
c51717e6755ac0efdf22f7421e372f5b061724d6I'd love to study it but not if just viewing it is a gray area
You can read bomb-making instructions, for heaven's sake. You can certainly look at this code. Just don't base a product on the ideas you got from looking at it.
This is not a bug, it's a part of how Git fundamentally works. If you want to mitigate it you have to sign your commits. GitHub could only attribute commits in the UI if they're signed, but I suspect that this is considered too much friction to enable.
1. is not equal to making it open to collaboration.
2. does not mean they can’t keep making money from it.
[1] http://theorangeduck.com/page/reproduce-their-results#source...
https://www.reddit.com/r/programming/comments/jnpufo/using_t...
Using the same trick as the one with youtube-dl, I uploaded the entire GitHub backend source code to GitHub's own DMCA repo. Maybe now not only GitHub can have the chance to fix the "bug", but the entire community as well? ;)
2) They most certainly did not "impersonat[e] Nat Friedman using a bug in GitHub's application"; they impersonated him using a design feature in Git.
I believe this isn't an existential threat to the company by any means.
https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large
...and show that making it work in any browser, even text-based ones (as far as possible), is not hard.
Zipped source (140 MB) mirror https://web.archive.org/web/20201104050247/https://codeload....
I'd love to hear more about that.
I'm wondering when one of the 1000s of services with write access to 100s of thousands of github run repos gets hacked or tokens expropriated and lots of repos suddenly get malicious commits.
I saw the headline and assumed this was a leak of someone else's source via stolen tokens.
