5 ms·

> You're relying on people not making their forks out of github. That makes perfect sense to me; the fork ON github is what lends the fork legitimacy versus "s

> You're relying on people not making their forks out of github. That makes perfect sense to me; the fork ON github is what lends the fork legitimacy versus "some dude found code."

fwdpropaganda 9y ago
> That makes perfect sense to me; the fork ON github is what lends the fork legitimacy versus "some dude found code." No, he made two points. The first one is that this way you don't have your code in random freelancer's accounts, which I'm saying is wrong: a freelancer can take his code, and upload it back to his account. So if this mechanism makes sense to you as a way of guaranteeing that your code won't be in other people's accounts, you're mistaken too. In fact if you don't believe me give me access to your private repos and lets see what happens.
- inetknght 9y ago
  I would be willing to bet that it would be fairly trivial for Github to identify fraudulent repos like that.
- CoryG89 9y ago
  While yes, you can simply create a new repo on GitHub with the local copy and name it similarly, it will not be linked to the original as a fork on GitHub.
- function_seven 9y ago
  You're misunderstanding the intent I think. This isn't a guarantee that the code is kept private. It's a guarantee that the other copies don't have a Github "fork" relationship to the true repo. Nobody is disputing that access to the private repo allows for a copy to be kept. But it's an "island", not a fork.
- monsieurbanana 9y ago
  > So if this mechanism makes sense to you as a way of guaranteeing that your code won't be in other people's accounts, you're mistaken too. Come on, no one is arguing that, and I'm sure you know that. He said it's "cleaner", not more secure. Yes anybody can re-upload his code to a random github account, but then it's easier to see it's stolen code in contrast of having a github fork of the private repository.
- s73v3r_ 9y ago
  "So if this mechanism makes sense to you as a way of guaranteeing that your code won't be in other people's accounts" Nobody but you is claiming this.
  - fwdpropaganda 9y ago
    Me and the person I was responding to. > It means there are no abandoned copies of my codebase sitting around forever forgotten in random Github accounts.
BlackLotus89 9y ago
The op doesn't want the code to be on github and his problem was about his code still being on someone elses accoint as a private fork. It sounded more like "if they get hacked my code isn't there" Being legit doesn't seem to have any meaning for him or the author of the article. Also the code is the only thing needed for legitimacy. The iphone bootloader code in some repo is still the legit iphone bootloader (as an example)
ctrl-j 9y ago
But they can still download the source and re-upload it to GitHub. It's really a false sense of control.
- moondev 9y ago
  But it won't say "forked from..."
  - gkya 9y ago
    And how does it matter when it's a private repo?
    - moondev 9y ago
      Imagine you run a website, foobar.com. You have foobar.com github org and foobar private repo (and also some public ones). Its the canonical org/repo. ninja123 has a github fork of it and it relays that from the github ui. "forked from foobar/foobar.com". rockstar123 also has a "fork" but it's just code sitting out there at rockstar123/foobar.com. There is no link to the canonical repo. If you fire ninja123 the link is severed. It just allows a way to show active, approved engagement and also to keep track of approved collaborators. What if rockstar123 gets arrested for ICO fraud. Do you want others to see he has an official upstream link to your repo even after you have severed the relationship? What if rockstar123 makes his fork public? It's just messy to keep the link.
      - gkya 9y ago
        I do not want to believe Github allows to make a privately-forked repository public. Other than that, I agree that the link is better removed, but what I don't understand is how that helps with keeping the code itself private, which is what I thought was meant at the root of the thread.
        moondev 9y ago
        Op is not claiming it keeps it private. It's just used as a tool to signal and track approved, active collaborators to the official upstream. That's beneficial to control.

> You're relying on people not making their forks out of github. That makes perfect sense to me; the fork ON github is what lends the fork legitimacy versus "some dude found code."

fwdpropaganda 9y ago

> That makes perfect sense to me; the fork ON github is what lends the fork legitimacy versus "some dude found code." No, he made two points. The first one is that this way you don't have your code in random freelancer's accounts, which I'm saying is wrong: a freelancer can take his code, and upload it back to his account. So if this mechanism makes sense to you as a way of guaranteeing that your code won't be in other people's accounts, you're mistaken too. In fact if you don't believe me give me access to your private repos and lets see what happens.

inetknght 9y ago
I would be willing to bet that it would be fairly trivial for Github to identify fraudulent repos like that.
CoryG89 9y ago
While yes, you can simply create a new repo on GitHub with the local copy and name it similarly, it will not be linked to the original as a fork on GitHub.
function_seven 9y ago
You're misunderstanding the intent I think. This isn't a guarantee that the code is kept private. It's a guarantee that the other copies don't have a Github "fork" relationship to the true repo. Nobody is disputing that access to the private repo allows for a copy to be kept. But it's an "island", not a fork.
monsieurbanana 9y ago
> So if this mechanism makes sense to you as a way of guaranteeing that your code won't be in other people's accounts, you're mistaken too. Come on, no one is arguing that, and I'm sure you know that. He said it's "cleaner", not more secure. Yes anybody can re-upload his code to a random github account, but then it's easier to see it's stolen code in contrast of having a github fork of the private repository.
s73v3r_ 9y ago
"So if this mechanism makes sense to you as a way of guaranteeing that your code won't be in other people's accounts" Nobody but you is claiming this.
- fwdpropaganda 9y ago
  Me and the person I was responding to. > It means there are no abandoned copies of my codebase sitting around forever forgotten in random Github accounts.

BlackLotus89 9y ago

The op doesn't want the code to be on github and his problem was about his code still being on someone elses accoint as a private fork. It sounded more like "if they get hacked my code isn't there" Being legit doesn't seem to have any meaning for him or the author of the article. Also the code is the only thing needed for legitimacy. The iphone bootloader code in some repo is still the legit iphone bootloader (as an example)

ctrl-j 9y ago

But they can still download the source and re-upload it to GitHub. It's really a false sense of control.

moondev 9y ago
But it won't say "forked from..."
- gkya 9y ago
  And how does it matter when it's a private repo?
  - moondev 9y ago
    Imagine you run a website, foobar.com. You have foobar.com github org and foobar private repo (and also some public ones). Its the canonical org/repo. ninja123 has a github fork of it and it relays that from the github ui. "forked from foobar/foobar.com". rockstar123 also has a "fork" but it's just code sitting out there at rockstar123/foobar.com. There is no link to the canonical repo. If you fire ninja123 the link is severed. It just allows a way to show active, approved engagement and also to keep track of approved collaborators. What if rockstar123 gets arrested for ICO fraud. Do you want others to see he has an official upstream link to your repo even after you have severed the relationship? What if rockstar123 makes his fork public? It's just messy to keep the link.
    - gkya 9y ago
      I do not want to believe Github allows to make a privately-forked repository public. Other than that, I agree that the link is better removed, but what I don't understand is how that helps with keeping the code itself private, which is what I thought was meant at the root of the thread.
      - moondev 9y ago
        Op is not claiming it keeps it private. It's just used as a tool to signal and track approved, active collaborators to the official upstream. That's beneficial to control.