4 ms·

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these ins

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public repositories, or repositories being prepped to be public. Actual internal stuff is hosted by one or more Github Enterprise accounts, the alleged hack does not claim they were hacked as well.

scared2 7y ago
In this sense "hacked" doesn't make sense. 8f everything was intended for open source.
- badRNG 7y ago
  I think there are still two concerns here even if everything is intended to eventually become open source. One, this doesn't address exactly how the repo was compromised. Likely one of the many folks with access had their credentials compromised, but until we know, there may be risk to other projects. Two, as the article mentions, it may not have had all passwords or API keys scrubbed.
- tlbsofware 7y ago
  The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.
  - dependenttypes 7y ago
    Having openpgp-signed commits would prevent such an issue.
    - jlgaddis 7y ago
      Would it? Couldn't the "hacker" have simply generated a new GPG key and added it to the account he had control of?
      - dependenttypes 7y ago
        The users would have specific keys trusted.
  - as300 7y ago
    Sure, but isn't the point of git to be able to roll back all changes on any branch? And since GitHub is owned by Microsoft, they themselves would surely be able to regain ownership of the account. This seems like a non-story.
    - MauranKilom 7y ago
      How much code with malicious modifications has been pulled from these repos since then? There's no evidence this happened, but we can't just handwave it away with "we can undo changes".
ShakataGaNai 7y ago
Ah source code at MS. Always amusing to me. VSS [1] (Visual Source Safe) was terrible and I always wondered how "real" companies could use it. From what I heard, MS never did use it, they bought it and sold licenses. That's it. That being said, Microsoft actually moved Windows to Git [2] years and years ago. Presumably they did the same with everything else. Team Foundation Server (TFS) supports Git, so they probably have the critical stuff on that TFS still, rather than GitHub. Especially since those repo's are huge. [1] https://en.wikipedia.org/wiki/Microsoft_Visual_SourceSafe https://en.wikipedia.org/wiki/Microsoft_Visual_SourceSafe [2] https://arstechnica.com/information-technology/2017/02/microsoft-hosts-the-windows-source-in-a-monstrous-300gb-git-repository/ https://arstechnica.com/information-technology/2017/02/micro...
- DiabloD3 7y ago
  They moved to Git, from what I can tell as an outsider, as part of the "Balmer fucked Microsoft" clean up duty that produced a toxic and soon-to-be-fatal culture over there. Github ended up being the final piece they needed after years of effort. Most of what I said in the earlier comment was what I pieced together from multiple (ex-)Microsoft people who chose to talk about it, over years. TFS afiact started as just a repo manager (in the sense, does what Github does) for VSS and Perforce, with more modern support for other things, including Microsoft's gargantuan Git monorepo... but a lot of people at Microsoft still like Github Enterprise better. I imagine given this, whatever TFS does better, Github Enterprise will learn to do over the next few years. Microsoft is big on eating their own dogfood now, but they don't seem to want to do Google sillyness where they have 20 products that do the same thing and let them fight it out in FFA arena combat (even Lync is still Lync underneath, it just keeps getting new frontends).
  - aksss 7y ago
    > Lync is still Lync mmm.. I know what you're saying but the change to Teams from a VOIP perspective substantially changed some of the under-the-hood stuff. They stood up a facade to offer luke-warm integration from SfB/Lync IP phones (authentication and basic calling, but that's about it). AFAIK this wasn't just a breaking change but a re-arch of some of the backend. Point being, they may be evolutions but the move to Teams is not just a new front-end. Substantial evolution has happened since we first installed server stacks to support Lync, even though we still see Lync fingerprints and junk dna everywhere.
balls187 7y ago
> some VSS-based thing I think It was Source Depot, a fork of Perforce. However, IIRC they moved to a git based Git Virtual File System for windows development a few years back..
- jayd16 7y ago
  >Git Virtual File System Hows that coming along, I wonder.
  - noahl 7y ago
    It was released, and was used for the Windows repo. Search "vfs for git" - it's open source. Then macOS removed kernel extensions, so they came up with a different approach and released that too. Search "scalar" to see it.
    - WorldMaker 7y ago
      It may be useful to note that "scalar" is mostly (albeit not entirely) a git (auto) configuration tool using (now) built-in tools like sparse checkouts and sparse checkout "cones", it shows how much of Microsoft's improvements have made it upstream into git itself. (And it is a stated goal of "scalar" that everything eventually should be.)
cptskippy 7y ago
Microsoft moved from VSTS Source Control to Git over 3 years ago. VSS hasn't been used in a decade or more.
- aksss 7y ago
  Right, I last used VSS in like 2008 or so and it was a pretty tired old tool by then. I mean, it worked, especially in the world it was built for in late 90's (corporate on-premise LAN stuff) - I can't remember any big complaints with it, although I do remember an occasional corruption, but was never f'd over by it. Unsuitable to the distributed and scaled world of today for sure.

scared2 7y ago

In this sense "hacked" doesn't make sense. 8f everything was intended for open source.

badRNG 7y ago
I think there are still two concerns here even if everything is intended to eventually become open source. One, this doesn't address exactly how the repo was compromised. Likely one of the many folks with access had their credentials compromised, but until we know, there may be risk to other projects. Two, as the article mentions, it may not have had all passwords or API keys scrubbed.
tlbsofware 7y ago
The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.
- dependenttypes 7y ago
  Having openpgp-signed commits would prevent such an issue.
  - jlgaddis 7y ago
    Would it? Couldn't the "hacker" have simply generated a new GPG key and added it to the account he had control of?
    - dependenttypes 7y ago
      The users would have specific keys trusted.
- as300 7y ago
  Sure, but isn't the point of git to be able to roll back all changes on any branch? And since GitHub is owned by Microsoft, they themselves would surely be able to regain ownership of the account. This seems like a non-story.
  - MauranKilom 7y ago
    How much code with malicious modifications has been pulled from these repos since then? There's no evidence this happened, but we can't just handwave it away with "we can undo changes".

ShakataGaNai 7y ago

Ah source code at MS. Always amusing to me. VSS [1] (Visual Source Safe) was terrible and I always wondered how "real" companies could use it. From what I heard, MS never did use it, they bought it and sold licenses. That's it. That being said, Microsoft actually moved Windows to Git [2] years and years ago. Presumably they did the same with everything else. Team Foundation Server (TFS) supports Git, so they probably have the critical stuff on that TFS still, rather than GitHub. Especially since those repo's are huge. [1] https://en.wikipedia.org/wiki/Microsoft_Visual_SourceSafe https://en.wikipedia.org/wiki/Microsoft_Visual_SourceSafe [2] https://arstechnica.com/information-technology/2017/02/microsoft-hosts-the-windows-source-in-a-monstrous-300gb-git-repository/ https://arstechnica.com/information-technology/2017/02/micro...

DiabloD3 7y ago
They moved to Git, from what I can tell as an outsider, as part of the "Balmer fucked Microsoft" clean up duty that produced a toxic and soon-to-be-fatal culture over there. Github ended up being the final piece they needed after years of effort. Most of what I said in the earlier comment was what I pieced together from multiple (ex-)Microsoft people who chose to talk about it, over years. TFS afiact started as just a repo manager (in the sense, does what Github does) for VSS and Perforce, with more modern support for other things, including Microsoft's gargantuan Git monorepo... but a lot of people at Microsoft still like Github Enterprise better. I imagine given this, whatever TFS does better, Github Enterprise will learn to do over the next few years. Microsoft is big on eating their own dogfood now, but they don't seem to want to do Google sillyness where they have 20 products that do the same thing and let them fight it out in FFA arena combat (even Lync is still Lync underneath, it just keeps getting new frontends).
- aksss 7y ago
  > Lync is still Lync mmm.. I know what you're saying but the change to Teams from a VOIP perspective substantially changed some of the under-the-hood stuff. They stood up a facade to offer luke-warm integration from SfB/Lync IP phones (authentication and basic calling, but that's about it). AFAIK this wasn't just a breaking change but a re-arch of some of the backend. Point being, they may be evolutions but the move to Teams is not just a new front-end. Substantial evolution has happened since we first installed server stacks to support Lync, even though we still see Lync fingerprints and junk dna everywhere.

balls187 7y ago

> some VSS-based thing I think It was Source Depot, a fork of Perforce. However, IIRC they moved to a git based Git Virtual File System for windows development a few years back..

jayd16 7y ago
>Git Virtual File System Hows that coming along, I wonder.
- noahl 7y ago
  It was released, and was used for the Windows repo. Search "vfs for git" - it's open source. Then macOS removed kernel extensions, so they came up with a different approach and released that too. Search "scalar" to see it.
  - WorldMaker 7y ago
    It may be useful to note that "scalar" is mostly (albeit not entirely) a git (auto) configuration tool using (now) built-in tools like sparse checkouts and sparse checkout "cones", it shows how much of Microsoft's improvements have made it upstream into git itself. (And it is a stated goal of "scalar" that everything eventually should be.)

cptskippy 7y ago

Microsoft moved from VSTS Source Control to Git over 3 years ago. VSS hasn't been used in a decade or more.

aksss 7y ago
Right, I last used VSS in like 2008 or so and it was a pretty tired old tool by then. I mean, it worked, especially in the world it was built for in late 90's (corporate on-premise LAN stuff) - I can't remember any big complaints with it, although I do remember an occasional corruption, but was never f'd over by it. Unsuitable to the distributed and scaled world of today for sure.