4 ms·

Bitbucket is ok for private repos. I think private repos are relatively secure there because Atlassian has much of reputation to loose if there is a security br

Bitbucket is ok for private repos. I think private repos are relatively secure there because Atlassian has much of reputation to loose if there is a security breach. Another plus for Bitbucket is the integration with Jira and other Atlassians tools. Beside that plus points I will rather go to GitLab.com (more features, better UI and integration with 3rd party) but my trust in private repos is lower there than on Bitbucket. I wished we could measure security somehow for private repos between Bitbucket, GitHub and Gitlab.com

sytse 10y ago
How could we convince you that at GitLab we take security very seriously?
- etjossem 10y ago
  Creating a Security page on the site to explain your infosec policies would go a long way. I like that we're able to view previous disclosures [1] and active security issues [2], but I had to dig a bit to find them. Surface those. [1] https://about.gitlab.com/vulnerability-acknowledgements/ https://about.gitlab.com/vulnerability-acknowledgements/ [2] https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B%5D=security https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B...
  - sytse 10y ago
    Sorry for the late reply, we've been busy releasing https://about.gitlab.com/2016/05/11/git-repository-pricing/ https://about.gitlab.com/2016/05/11/git-repository-pricing/ Anyway, I've added most information to https://about.gitlab.com/disclosure/ https://about.gitlab.com/disclosure/ with https://gitlab.com/gitlab-com/www-gitlab-com/commit/eab7e345409f72ee80d6af9f2bba7ca557311ded https://gitlab.com/gitlab-com/www-gitlab-com/commit/eab7e345... That page is linked from https://about.gitlab.com/contact/ https://about.gitlab.com/contact/
    - etjossem 10y ago
      Awesome, thanks for the quick response.
- therealmarv 10y ago
  Make a dedicated site on gitlab.com about security (make it bold) and about private repos. Some buzzwords: Countermeasures, security tracking, rate limiting, DDoS attacks, Backups... what do you do to ensure security, privacy or that nothing is lost? It's a littlebit in the dark. I would love to see comparisons between gitlab, bitbucket and github if possible (but I'm guessing that's not easy) or I would love to see somehow you take that extremely seriously for gitlab.com. I only have this gut feeling (I cannot exactly say why) that bitbucket and github feel more secure for private repos than gitlab because their business is dependent on security of hosting private repos. On gitlab.com the hosted private repos are a bonus and not the business of gitlab (because the real business is selling gitlab enterprise software and their support). Just ask yourself and imagine this: You have a new start up company based on very valuable closed source but you entirely do not want to host my own gitlab etc. server. Which service would you use? I'm guessing it is bitbucket or github because they are offering "premium" private repos and have a good reputation (at least I do not know that a private repo there was once disclosed).
  - sytse 10y ago
    Thanks for your input. I've added more security information on our website https://gitlab.com/gitlab-com/www-gitlab-com/commit/bb7decedabbfe5325019dc75bb4560de675e2399 https://gitlab.com/gitlab-com/www-gitlab-com/commit/bb7deced... We try to achieve a good reputation by taking security seriously every day and being responsive to disclosures.
striking 10y ago
All those sites are secure. Actually, between the three, GitHub has had the most vulnerabilities reported, like that one time someone got administration privileges over the entire website... yet people still trust them somehow. If you're working on government contracted stuff or something like that, where you need perfect and utter secrecy, you could self-host a GitLab instance. Which is $0, compared to GitHub Enterprise.

sytse 10y ago

How could we convince you that at GitLab we take security very seriously?

etjossem 10y ago
Creating a Security page on the site to explain your infosec policies would go a long way. I like that we're able to view previous disclosures [1] and active security issues [2], but I had to dig a bit to find them. Surface those. [1] https://about.gitlab.com/vulnerability-acknowledgements/ https://about.gitlab.com/vulnerability-acknowledgements/ [2] https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B%5D=security https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B...
- sytse 10y ago
  Sorry for the late reply, we've been busy releasing https://about.gitlab.com/2016/05/11/git-repository-pricing/ https://about.gitlab.com/2016/05/11/git-repository-pricing/ Anyway, I've added most information to https://about.gitlab.com/disclosure/ https://about.gitlab.com/disclosure/ with https://gitlab.com/gitlab-com/www-gitlab-com/commit/eab7e345409f72ee80d6af9f2bba7ca557311ded https://gitlab.com/gitlab-com/www-gitlab-com/commit/eab7e345... That page is linked from https://about.gitlab.com/contact/ https://about.gitlab.com/contact/
  - etjossem 10y ago
    Awesome, thanks for the quick response.
therealmarv 10y ago
Make a dedicated site on gitlab.com about security (make it bold) and about private repos. Some buzzwords: Countermeasures, security tracking, rate limiting, DDoS attacks, Backups... what do you do to ensure security, privacy or that nothing is lost? It's a littlebit in the dark. I would love to see comparisons between gitlab, bitbucket and github if possible (but I'm guessing that's not easy) or I would love to see somehow you take that extremely seriously for gitlab.com. I only have this gut feeling (I cannot exactly say why) that bitbucket and github feel more secure for private repos than gitlab because their business is dependent on security of hosting private repos. On gitlab.com the hosted private repos are a bonus and not the business of gitlab (because the real business is selling gitlab enterprise software and their support). Just ask yourself and imagine this: You have a new start up company based on very valuable closed source but you entirely do not want to host my own gitlab etc. server. Which service would you use? I'm guessing it is bitbucket or github because they are offering "premium" private repos and have a good reputation (at least I do not know that a private repo there was once disclosed).
- sytse 10y ago
  Thanks for your input. I've added more security information on our website https://gitlab.com/gitlab-com/www-gitlab-com/commit/bb7decedabbfe5325019dc75bb4560de675e2399 https://gitlab.com/gitlab-com/www-gitlab-com/commit/bb7deced... We try to achieve a good reputation by taking security seriously every day and being responsive to disclosures.

striking 10y ago

All those sites are secure. Actually, between the three, GitHub has had the most vulnerabilities reported, like that one time someone got administration privileges over the entire website... yet people still trust them somehow. If you're working on government contracted stuff or something like that, where you need perfect and utter secrecy, you could self-host a GitLab instance. Which is $0, compared to GitHub Enterprise.