4 ms·
It seems a certainty to me that github will be breached one of these days, and all internal data (i.e., private repos) made public. On that day, so many compan
by kzhahou 11y ago
It seems a certainty to me that github will be breached one of these days, and all internal data (i.e., private repos) made public. On that day, so many companies will inadvertently become open source!
Do we have any info on what steps github takes to prevent this? I ask as a paying customer (with both personal and corporate accounts).
- atonse 11y agoIf such a massive scale breach would happen, it would probably have to take weeks because GitHub probably has so much data. (I would guess on the order of hundreds of TB or a few PB). It would be more likely to just have handful of high visibility repos.
- mrks_ 11y agoYou're probably right. It's unlikely that a hacker would care about my private repos. That being said, I'm also curious about GitHub's efforts to prevent such a scenario.
- stingraycharles 11y agoWhich makes me wonder: how would one prevent such a scenario, where you cannot simply encrypt with a shared key given github's auth model ?
- Rafert 11y agoLike http://homakov.blogspot.nl/2013/03/hacking-github-with-webkit.html http://homakov.blogspot.nl/2013/03/hacking-github-with-webki... or http://homakov.blogspot.nl/2014/02/how-i-hacked-github-again.html http://homakov.blogspot.nl/2014/02/how-i-hacked-github-again... ? ;)
- dubcanada 11y agoYou would probably get a better answer if you asked Github this question.
- kzhahou 11y agoGithub employees are here on HN, and just as likely to answer here vs a tweet or whatever.
- dubcanada 11y agoYes, but this isn't a support channel. Twitter and their support email(s) are a support channel. They may answer the question here, just like they may answer the question if you sent them a snail mail with it written in crayon. But they are not required too.
- kzhahou 11y agoSupport channel is where I go when I can't access my account, or want to submit a feature request. Anyway, it'd be awesome if someone posted a technical response here, but I don't expect them to.
- vezzy-fnord 11y agoOn that day, so many companies will inadvertently become open source! Well, no. They would be inadvertently source-available. If the license doesn't comply with the Open Source Definition, it's not open source. EDIT: Downvoted as usual for correcting false impressions about how free software and open source works.
- bdcravens 11y agoThis. If we accept "stolen and leaked information" as open source, we may as well start coaching discussions about privacy leaks in the same way. "Ashley Madison customers' information open sourced"
- zo1 11y ago"EDIT: Downvoted as usual for correcting false impressions about how free software and open source works." Are you seriously suggesting that the OP you responded to was comparing "stolen" or "leaked" software to open source? That is probably why you're being downvoted, not because people around here have a false impression as to what constitutes open-source.
- vezzy-fnord 11y ago"Open source" has an established meaning. Even if the poster in question was using the term facetiously, I feel it must be corrected since there is legitimately a large body of misconception surrounding the mechanics of free software and open source, and such humor may fuel it further. Moreover, it reflects a critical flaw in the open source dogma as compared to free software. Open source puts source code at the forefront, which is fallacious. The key elements are the ability to run unfettered, study, modify and redistribute identical or modified versions. The source code is a necessary precondition for properly exercising those freedoms, but not a central focus in any real sense. It is easy to misinterpret "open source" as being about publicly viewable source code, and many companies have exploited this to their advantage presently or in the past (GitHub with Atom, Epic Games with UE4, etc.)
- gpvos 11y ago> On that day, so many companies will inadvertently become open source! The OP was explicitly calling such stolen or leaked software open source. Please read more closely.
- Qualman 11y agoI'd imagine that for legal/security reasons, you'd get about the same response as any other company: "We use better than industry standard encryption on private repo data, encrypted with AES-1024 and encrypted in transit via TLS-3 etc etc..." But, I don't know. What was that quote? "Don't put anything on the internet that you wouldn't want to see on your grandma's coffee table."