4 ms·

> Long before the acquisition, we've been hosting important stuff in private GitHub repositories. Including having strategic discussions in those private reposi

> Long before the acquisition, we've been hosting important stuff in private GitHub repositories. Including having strategic discussions in those private repositories. Wow! I am very surprised by that. Is that an officially allowed policy? Or is it something that is "don't ask for permission, ask for forgiveness"?

nielsbjerg 8y ago
How so? What was going to be controlled, by whom?
- 8_hours_ago 8y ago
  I assumed that Microsoft has security policies to ensure that all confidential information (e.g. non-open-source code and strategic discussions) is stored on infrastructure controlled by Microsoft. The company I work at is very careful about keeping our intellectual property on our infrastructure, and I am surprised that a larger company like Microsoft doesn't have similar policies.
  - jethro_tell 8y ago
    Maybe info sec drove the decision to purchase github because that was the easier way to reign in the data leak. =)
  - com2kid 8y ago
    > I assumed that Microsoft has security policies to ensure that all confidential information (e.g. non-open-source code and strategic discussions) is stored on infrastructure controlled by Microsoft. It depends on how important the code is. I don't imagine MS will ever move Office or Windows to external servers, but a lot of other stuff is fair game. There is always a security/convenience trade off.
  - jameshart 8y ago
    Microsoft aims to make most of its money in the immediate future by convincing every major business in the world to let MS host that company's email, internal documents, spreadsheets and powerpoints on Microsoft's office365 servers. It would be highly contradictory for MS to take the position, as a matter of policy, that it is too risky for them to ever place confidential business data onto a third party cloud-hosted SaaS system, because that is precisely the risk they are asking every one of their customers to take. Similarly, if you have concerns about putting your company's source code into GitHub now, you should be equally concerned about putting your company's prerelease annual report on the office365 onedrive.
    - 8_hours_ago 8y ago
      My company is concerned about that as well. We don’t use any cloud storage from Microsoft or anyone else, and we self host Exchange and SharePoint servers. That is a good point though, it’s becoming more and more inconvenient for a company to self host everything. Microsoft does stand to benefit from everyone becoming more accustomed to relying on 3rd party services in the cloud.
      - kthejoker2 8y ago
        Serious question: do you think your company has better security than the Azure cloud? Or is it a trust issue with the cloud vendors themselves?
        johannes1234321 8y ago
        .... and if you don't trust Microsoft: Why use Exchange and such? :-)
        Piskvorrr 8y ago
        Better is relative - especially in one metric: many eggs in one basket make that basket exponentially more attractive to evil actors. Bigger attack surface and whatnot...
phillipcarter 8y ago
Yes, it's absolutely an allowed policy. When we made .NET (Core) open source, we meant it. We still use email like any other org, but whenever we're working on our product we try to keep discussions on GitHub. It's also made collaboration with other teams far, far easier.

nielsbjerg 8y ago

How so? What was going to be controlled, by whom?

8_hours_ago 8y ago
I assumed that Microsoft has security policies to ensure that all confidential information (e.g. non-open-source code and strategic discussions) is stored on infrastructure controlled by Microsoft. The company I work at is very careful about keeping our intellectual property on our infrastructure, and I am surprised that a larger company like Microsoft doesn't have similar policies.
- jethro_tell 8y ago
  Maybe info sec drove the decision to purchase github because that was the easier way to reign in the data leak. =)
- com2kid 8y ago
  > I assumed that Microsoft has security policies to ensure that all confidential information (e.g. non-open-source code and strategic discussions) is stored on infrastructure controlled by Microsoft. It depends on how important the code is. I don't imagine MS will ever move Office or Windows to external servers, but a lot of other stuff is fair game. There is always a security/convenience trade off.
- jameshart 8y ago
  Microsoft aims to make most of its money in the immediate future by convincing every major business in the world to let MS host that company's email, internal documents, spreadsheets and powerpoints on Microsoft's office365 servers. It would be highly contradictory for MS to take the position, as a matter of policy, that it is too risky for them to ever place confidential business data onto a third party cloud-hosted SaaS system, because that is precisely the risk they are asking every one of their customers to take. Similarly, if you have concerns about putting your company's source code into GitHub now, you should be equally concerned about putting your company's prerelease annual report on the office365 onedrive.
  - 8_hours_ago 8y ago
    My company is concerned about that as well. We don’t use any cloud storage from Microsoft or anyone else, and we self host Exchange and SharePoint servers. That is a good point though, it’s becoming more and more inconvenient for a company to self host everything. Microsoft does stand to benefit from everyone becoming more accustomed to relying on 3rd party services in the cloud.
    - kthejoker2 8y ago
      Serious question: do you think your company has better security than the Azure cloud? Or is it a trust issue with the cloud vendors themselves?
      - johannes1234321 8y ago
        .... and if you don't trust Microsoft: Why use Exchange and such? :-)
      - Piskvorrr 8y ago
        Better is relative - especially in one metric: many eggs in one basket make that basket exponentially more attractive to evil actors. Bigger attack surface and whatnot...

phillipcarter 8y ago

Yes, it's absolutely an allowed policy. When we made .NET (Core) open source, we meant it. We still use email like any other org, but whenever we're working on our product we try to keep discussions on GitHub. It's also made collaboration with other teams far, far easier.