21 ms·

GitHub Source Code Leak

1013 points by resynth1943 6y ago

metiscus 6y ago
Stated without proof: I firmly believe this is related to the youtube-dl takedown. Look at the repo it was committed to as well as the timing. Similar things happened with Sony over Other OS. Sadly I bet there will be further attacks and leaks as time goes on here.
- gameswithgo 6y ago
  I don’t really consider non violent non cooperation as a sad form of protest over the iron grip corporations have over the proletariat. It is about all we can do. We can’t even democratically address the issue, we tried and the supreme court said nope.
- Miner49er 6y ago
  Why "sadly"?
  - metiscus 6y ago
    Github is complying with a mandatory legal process. It isn't like they are at fault here. As much as I hate what has happened, folks are attacking the wrong company. Come out against the RIAA if you must do something. Better still to let the process work, you don't win legal battles by committing crimes.
    - sneak 6y ago
      > It isn't like they are at fault here. GitHub (via their owners Microsoft) is a member of the RIAA. They give the RIAA money to do stuff like this.
    - Reelin 6y ago
      Actually the takedown wasn't mandatory because (AFAIK, IANAL, etc) it wasn't actually a takedown request that GitHub received. Takedowns only apply to infringing content itself, not to tools. (Even if the tool were in violation of the DMCA it doesn't seem like the RIAA would have standing to pursue it.) That being said, it also seems like GitHub is well within their rights to choose not to host a project accused of violating the law.
    - LeifCarrotson 6y ago
      An empire will always want to promulgate the idea that gerruila warfare is bad form, that the resistance should stand in an orderly lineup and fight fairly, may the side with superior resources triumph. Civil disobedience and conscientious objection are going to be more effective than merely communicating your displeasure to your Twitter followers or starting a petition on change.org. It's unreasonable to expect that the individual who took this action could go to court against the RIAA and extract their deeply embedded claws from the legislative, executive, and even cultural environment in which they've entrenched themselves. Instead, it's reasonable to expect that somewhere in a conference room at say, Gitlab, Sourceforge, etc., sometime in the near future, some lawyer is going to mention "We got DCMAs from X for repo Y, and foo for repo bar, and from the MPAA for the popular repo (insert software tool here), obviously we should remove all of those repos." Maybe someone familiar looks up and says "that sounds a little silly, isn't that tool just a general-purpose media player?" And the lawyer might respond "We don't care-we don't have the budget to determine if the DCMA notice looks valid or not, if it turns out to be valid we have to do it and if it's not valid it costs us nothing to take it down". Actions like this provides a reasonable response of "But, as we saw with GitHub, some of our users and maybe even some of our own employees will resent us for this. It could cost us users, cost us bad publicity, or cost us real money. Let's put a couple people on this for an hour or two to estimate the pros and cons." Github was just a middleman, responding rationally to their existing financial, legal, and moral incentives, in a battle between their little users and the RIAA. Like a little flock of oxpecker birds riding a rhinoceros, we wouldn't even register in a fight against a tiger, we can only warn our larger intermediary of the danger we perceive. The RIAA doesn't care that you're against them. We need to change the incentives for companies like Github that have a chance to be heard.
    - User23 6y ago
      > you don't win legal battles by committing crimes Tell that to the Civil Rights movement.
    - samim 6y ago
      It's always good to remind oneself, that most dictators in history came to power through legal means. The Nazi's were democratically elected at first etc. Plus "Complying with a mandatory legal process" is a very relative thing for a multi-national giant corporation that pays very little taxes, hides most of its wealth offshore and is a leader in shaping the law through intensive lobbying.
    - breakfastduck 6y ago
      > you don't win legal battles by committing crimes Quite possibly one of the most incorrect things I've ever read.
- pricci 6y ago
  I think this is related to the fact that you can push to GitHub as another user and make the commit appear as it is part of another repo. After the youtube-dl event many people became aware of those "hacks" because someone used it to "upload youtube-dl into the DMCA's repo". Since those hacks are known by GitHub but they won't fix it, someone thought that the best way to "protest" against the decition was to push GH's source into the DMCA's repo impersonating GH's CEO. That's my theory, a protest. edit: DMCA
- 6456457 6y ago
  > Sadly What's sad about this?
- rasz 6y ago
  Isnt this shooting the wrong man? IF you wanted to protest RIAA you would DOX lawyers, their families and friends. Hack and leak their private emails, dig up dirt like mistresses/embezzlement etc, not attack open source code repository RIAA happened to strong arm.
The_rationalist 6y ago
Where can we find the code?
- resynth1943 6y ago
  I linked it in the article :D
  - arthurcolle 6y ago
    Is there a way to download it? I can't seem to click into the repo files
    - resynth1943 6y ago
      https://web.archive.org/web/20201104050026if_/https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050026if_/https://github... Click "Code". I'm not suggesting you download it, that would be naughty.
      - arthurcolle 6y ago
        That doesn't work
        deleted 6y ago
        [deleted]
        rukshn 6y ago
        try this if you have not already found the code - https://web.archive.org/web/20201104050247/https://codeload.github.com/github/dmca/zip/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050247/https://codeload....
      - deleted 6y ago
        [deleted]
  - deleted 6y ago
thdc 6y ago
I wouldn't say it was a bug in GitHub's application that allowed someone to impersonate Nat, it's just that the author of the commit (which can be changed easily/set manually in git) matched his name/email. How many people can actually push to that repo? I wonder if it would be easy to figure out who actually did it...
- resynth1943 6y ago
  I'd still say it was a bug in GitHub, to be frank. This definitely shouldn't be allowed.
  - lights0123 6y ago
    Currently, requiring signed commits (the only way to prevent this) would be a massive breaking change, as I would guess that 90%+ of GitHub users don't use GPG to sign their commits. However, they may be able to make that opt in, although it could very well break a ton of automated scripts and would completely break things like squash merging or rebasing by a maintainer.
    - resynth1943 6y ago
      I was thinking more along the lines of simply checking the email of the (real) commit author against the "email" used in the Git commit. Would this not be possible?
      - TheDong 6y ago
        That would break quite a few workflows. For example, if I were to 'git clone' a project currently on gitlab, create a github repo for it, add that origin, and push... Well, that pushes commits authored by every single person who ever committed to that other repository. Do I have to make all of them re-push only their own commits in order? Can robots not mirror repositories anymore? What about commits authored by people without github accounts? There's also the obvious issues of me merging a coworker's commit into my branch, or cherry-picking, or rebasing a third-party contributor's commits to update them before merge. I think the case of "push an existing repo with N authors to a new repo" is a really compelling reason though for why that sort of "you can only push commits with your email" thing would not work.
deleted 6y ago
[deleted]
mohamez 6y ago
What's up with all this source codes leaking online?
- deleted 6y ago
  [deleted]
- ffhhj 6y ago
  Someone released after the DMCA controversy to encourage others to find vulnerabilities in their system and perform attacks.
deleted 6y ago
[deleted]
npad 6y ago
I'm guessing this is just a dump of the GitHub Enterprise source? Apparently it's never been all that hard to decrypt - e.g. https://gist.github.com/iscgar/e8ea7560c9582e4615fcc439177e22b7 https://gist.github.com/iscgar/e8ea7560c9582e4615fcc439177e2...
- duskwuff 6y ago
  It looks like it's something more. The README is clearly targeted to Github employees, for instance.
willio58 6y ago
It never sat well with me how GitHub itself was not open-source. Is it a fundamental mistrust of the very technology that made the platform possible?
- resynth1943 6y ago
  Well, it definitely carries a hint of irony. They seem to be going against everything they stand for.
  - mmahemoff 6y ago
    Not true. Github only hosts projects publicly for people who want to host their project publicly. They don't have a mantra of all information wants to be free, and indeed their entire business model relies on hosting private repos. I understand people wanting to host their open source on a server that's also open source. There's an argument it makes business sense if the closed source setup creates a long-term drift to GitLab or elsewhere. Nevertheless, I don't see the closed source as a contradiction. You can love open source while producing a mix of open and closed source. Building a sustainable business often means being selective about it and seeing open source as a tool you can benefit from (enlightened self-interest), rather than an ideology you must adhere to at all times.
  - carapace 6y ago
    A hint of irony? It's freaking absurd. The "hub" for decentralized git (The "D" in DVCS stands for Distributed, doesn't it?) which has become the Kleenex of open source, is itself a closed, proprietary system. It's beyond ironic and well into oxymoronical. And then MS bought them! You can't make this stuff up.
- manigandham 6y ago
  The fundamental tech is hit, which is open source. GitHub provides the hosting and project management features on top.
  - foolfoolz 6y ago
jpdlla 6y ago
Probably de-obfuscated source code from a Github Enterprise vm
mappu 6y ago
It's unlikely this is a "leak" per se - the source code can be straightforwardly recovered from the trial version of Github Enterprise, see e.g. https://news.ycombinator.com/item?id=13875993 https://news.ycombinator.com/item?id=13875993 or (more comments) https://news.ycombinator.com/item?id=13346866 https://news.ycombinator.com/item?id=13346866 EDIT: Anyone looking to try doing this, please support open alternatives instead: https://gitea.io/en-us/ https://gitea.io/en-us/
- resynth1943 6y ago
  I'd still call it a leak, since GitHub is closed-source. Then again, this raises an important point: with the source code so easily acquired, why isn't it open-source?
  - nanagojo 6y ago
    Open source is another ball game license wise.
  - freeone3000 6y ago
    Because their primary target is enterprise consumers, who care about legality. It doesn't matter how easy it is to get illegal source code, their customers can't risk it.
  - smnrchrds 6y ago
    - If the locks can be so easily broken, why are there locks? - If it is so easy to shoplift, why don't stores just give out everything for free?
    - resynth1943 6y ago
      The hyperbole contributes nothing of any value to the conversation. While folks are definitely making good counter-points, I think the question needed to be asked.
      - smnrchrds 6y ago
SethTro 6y ago
Commit message was "felt cute, might put gh source code on dmca repo now idk" https://web.archive.org/web/20201104050026if_/https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050026if_/https://github...
- klysm 6y ago
  Oh my you aren’t kidding
- deleted 6y ago
  [deleted]
- areyousure 6y ago
  That link now says "Sorry. This URL has been excluded from the Wayback Machine."
  - sdfhbdf 6y ago
    I think it might because of their robots.txt. I remember reading somewhere that once You include some url in robots.txt archive.org even though can have it archived it will stop showing it to the public. https://blog.archive.org/2017/04/17/robots-txt-meant-for-search-engines-dont-work-well-for-web-archives/ https://blog.archive.org/2017/04/17/robots-txt-meant-for-sea... https://github.com/robots.txt https://github.com/robots.txt They have some interesting nuggets in their robots though like `/ExplodingStuff/` and `/account-login` both of which seem to be some accounts. Or probably more possible - they just got in contact with the archive.org people.
    - roryokane 6y ago
      The first page you linked tells the story of how the Wayback Machine once deleted archived content if robots.txt directed it to, but was moving towards not doing that anymore. You can also see in GitHub’s robots.txt that URLs matching `/*/tree/` should already have been forbidden, yet the Wayback Machine at one point had https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d... archived. These facts suggest that it is your second theory that is correct—GitHub contacted archive.org to get the archive taken down.
kzrdude 6y ago
It is a bit sad that the dmca repo gets targeted, because it's an optional extra that github is doing to show publicly when DMCA notices are received.
- ehsankia 6y ago
  I'm curious why that repo even has PR's enabled?
  - DoctorOW 6y ago
    I don't think you can disable them.
    - jdbernard 6y ago
      Ironically, this is a feature people have been asking GitHub to implement for years now.
      - kzrdude 6y ago
        But, in this topic, PRs are not needed for the current shenanigans - all it uses is object sharing between forks
        londons_explore 6y ago
        I assume thats because internally within github, all forks are implemented as a single repo with some kind of namespacing on branches.
preommr 6y ago
7.5 billion dollars well spent.
- eli 6y ago
  You misunderstand where the value comes from
ibraheemdev 6y ago
Would downloading a local copy be considered illegal?
- Reelin 6y ago
  Yes, almost certainly. You haven't licensed the material so it's copying or possession by you is an illegal act in most jurisdictions. Your awareness of the nature of the content and its licensing status establishes intent. Of course, if you don't redistribute it you shouldn't have any problems (at least in the US) because an IP address alone isn't sufficient to pursue someone in court here.
  - bawolff 6y ago
    IANAL, but if you dont have plans to do anything evil with it, steal github's customers, etc (and havent made any promises to github to keep things secret) i think you could argue that making a copy for research purposes is fair use.
    - Reelin 6y ago
      If you were collecting public documents in bulk and had concrete plans that you could articulate, sure. I suppose the same might even apply to bulk collection of pirated content as well, although I'd certainly want to run that one by a lawyer before depending on it. I really don't think any of that applies here though. This is an isolated leak of materials which you very clearly do not have any rights to access, copy, or possess in any manner whatsoever. I just can't see how "research purposes" helps you here. (Unless you happen to be an established researcher with an ongoing project that involves surveying source code leaks over time, perhaps? But again, you'd really need to consult a lawyer before doing something like that.)
      - bawolff 6y ago
        Disclaimer: not a lawyer, do not actuslly follow this as advice. Yadda > This is an isolated leak of materials which you very clearly do not have any rights to access, copy, or possess in any manner whatsoever I think that's backwards - you don't need the right to posess something, you need to make sure that nobody has the right to stop you from posessing it. The default state in the absence of someone else's right interfereing is information gets to be free. So the question is, are you violating any of github's rights if you download the code for "personal research" or curiosity? As far as copyright/fair use goes, the fact its a leak doesn't seem that applicable to me - you do not need permission from the copyright holder for fair use to apply (in fact that would defeat the entire point of fair use). "Research" might apply here, because in the united states you can basically ignore copyright if its for research purposes (although there is a lot of fine print on that and its really complicated). In particular, if your personal research is non-commercial and unlikely to affect github's bottom line, it further increases the liklihood fair use applies. https://en.wikipedia.org/wiki/Fair_use#U.S._fair_use_factors https://en.wikipedia.org/wiki/Fair_use#U.S._fair_use_factors Personally i think trade secret law is more appropriate than copyright here, but afaik that only applies to people who have a responsibility to keep github's code confidential. I don't think that applies to randoms on the internet who are just curious what github's source looks like. And again, IANAL.
arthurcolle 6y ago
Is there a torrent for this?
- sneak 6y ago
  I would imagine so, but the whole thing (.zip) is still available on the Internet Archive's site: https://web.archive.org/web/20201104050247/https://codeload.github.com/github/dmca/zip/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050247/https://codeload.... mirror: https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b6d2b5ed9cb4097f9d5_zip https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b...
  - ralph87 6y ago
    Hoping someone snarfed a git clone, revision history is waaay more interesting than the code itself
    - saagarjha 6y ago
      It seems like it was pushed as a single commit: https://web.archive.org/web/20201104050026if_/https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050026if_/https://github...
  - arthurcolle 6y ago
    thanks dude, I tried hitting the Code button but it didn't download. Is it really working for you? Interesting, I got an HTTP error from it.
- banana_giraffe 6y ago
  c51717e6755ac0efdf22f7421e372f5b061724d6
emrehan 6y ago
Now that the damage is done, GitHub can go release the source code and own it.
- snazz 6y ago
  The source code was never very private in the first place—it's easy to de-obfuscate it. More importantly, GitHub doesn't want to support and deal with open-sourcing their core. There's some amount of irony here considering that GitHub is the primary place for other open-source projects to be developed, but it's important to remember that GitHub makes their money from private team repos anyway.
  - emrehan 6y ago
    Making the source code open... 1. is not equal to making it open to collaboration. 2. does not mean they can’t keep making money from it.
    - snazz 6y ago
      What incentive do they have to keep it open, though? People who already needed to read the source code (like security researchers) don't need the complete unobfuscated source in the first place. It would likely cost GitHub money in frivolous support queries.
      - bawolff 6y ago
        Security research might not require unobfuscated source code, but it does make it easier.
natfriedman 6y ago
Hi folks, I'm the CEO of GitHub. GitHub hasn't been hacked. We accidentally shipped an un-stripped/obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago. It shares code with github.com. As others have pointed out, much of GitHub is written in Ruby. Git makes it trivial to impersonate unsigned commits, so we recommend people sign their commits and look for the 'verified' label on GitHub to ensure that things are as they appear to be. As for repo impersonation – stay tuned, we are going to make it much more obvious when you're viewing an orphaned commit. In summary: everything is fine, situation normal, the lark is on the wing, the snail is on the thorn, and all's right with the world.
- czbond 6y ago
  <had a comment, it was snarky, bad taste, removing. even if accurate>
  - mdoms 6y ago
    Unsigned. Unsigned commits.
    - czbond 6y ago
      Clever.... :)
- tomglynch 6y ago
  Thanks for the response here Nat. Upfront and to the point. Now that most of the code is out there, will you consider making the whole project Open Source?
  - chenpengcheng 6y ago
    great question!
  - metiscus 6y ago
    Answered in part here quoted in case of edits. https://news.ycombinator.com/item?id=24995266 https://news.ycombinator.com/item?id=24995266 "It's not open source because the open source "community" is a liability and you want them far away from you at all times. I'm not trying to be mean or sarcastic or anything. Just look at how maintainers are treated for a week and you'll see exactly what I mean."
czbond 6y ago
I had always heard GitHub was running on Rails - but I always thought "sure some section of it is". Not ALL on rails - with models and controllers in there.
Wowfunhappy 6y ago
Has anyone gotten this running? I'd thought it might be easy since it uses Docker, but docker-compose appears to be trying to pull a dependency called "git-daemon-server" from a URL that requires authentication.
- fyfy18 6y ago
  The advantage of not having a monorepo?
dboreham 6y ago
Whenever I've worked on large proprietary products we would joke we should leak our source to tie up our competitors for years trying understand it...
- Thorrez 6y ago
  That reminds me of this story[1]. The author shared some code that was so bad, that the recipient of the code was kicked out of the country. Receiving bad code can have some extreme consequences. [1] http://theorangeduck.com/page/reproduce-their-results#sourcecode http://theorangeduck.com/page/reproduce-their-results#source...
qgrgergfqgfev 6y ago
I saw Github's code as a consultants years ago, and I always thought it was crazy that they would ship the whole thing to us. But then I thought, how many employees do they have? Probably enough that security should not rely on the secrecy of the code anymore.
- alpb 6y ago
  I think the main concern would be the intellectual property around the large-scale distributed system which is storing billions of lines of code in a single system. Implementing git object storage is still hard (e.g. https://en.wikipedia.org/wiki/Virtual_File_System_for_Git https://en.wikipedia.org/wiki/Virtual_File_System_for_Git). Though, that's probably not what they use in the enterprise edition, so maybe they aren't as worried.
- speedgoose 6y ago
  I guess it's difficult and expensive to deploy a ruby on rails application on premise without giving some kind of source code.
- 0xdeadb00f 6y ago
  If that is the case then why don't they open source it all?
  - qgrgergfqgfev 6y ago
    what would be the point?
wdiamond 6y ago
I hope that I won't need to search in a thousand of githubs for each npm packet I need in near future.
syspec 6y ago
What is the legality of /looking/ at this code in order to study how a large corporation with a large code base writes a Rails app? I'd love to study it but not if just viewing it is a gray area
- zymhan 6y ago
  AFAIK the only thing that's straight up illegal to look at in the USA is child porn. You can read bomb-making instructions, for heaven's sake. You can certainly look at this code. Just don't base a product on the ideas you got from looking at it.
  - Polylactic_acid 6y ago
    The problem is how do you prove you didn't base your ideas on what you saw? If you never saw it then its easy to say you can't have copied it.
    - vimax 6y ago
      Copyright is about copying. Are there any verbatim copies of the original in your project. Did you sign an enforceable ip ownership or non-compete agreement with GitHub about trade secrets learned while working on their source code? If the answers to those questions are no, there is a very long, very steep, uphill battle facing GitHub.
- npteljes 6y ago
  Legality aside, the clean-room FOSS projects won't like your contributions if you have been exposed to the respective leaked source codes. From the top of my head, WINE requires this: https://wiki.winehq.org/Clean_Room_Guidelines https://wiki.winehq.org/Clean_Room_Guidelines
deleted 6y ago
[deleted]
pietroglyph 6y ago
> impersonating Nat Friedman using a bug in GitHub's application. This is not a bug, it's a part of how Git fundamentally works. If you want to mitigate it you have to sign your commits. GitHub could only attribute commits in the UI if they're signed, but I suspect that this is considered too much friction to enable.
- redrobein 6y ago
  > how Git fundamentally works Honestly, given this, they should clearly label unsigned commits by default.
  - jfrunyon 6y ago
    They... do? Do you see the Verified note anywhere? It's not their fault if people don't understand how the tool they're using works at an extremely basic level...
    - kelnos 6y ago
      So few people sign their commits that the default is to assume commits are from where they say they are, even if they're not verified.
      - jfrunyon 6y ago
        Please let me know when you figure out what GitHub could reasonably do to make enough people sign their commits to change that default.
    - hvdijk 6y ago
      They don't. The comment was on labelling. There is nothing in the presentation of unsigned commits to indicate that they are unsigned. The presentation is indistinguishable from that of a hypothetical GitHub that never shows commit signatures, you need to have seen a signed commit on GitHub at some point to know that the absence of that Verified note is significant.
amb23 6y ago
What are the business risks to a company like Github when their source code has been released in the wild? Startups treat their code like IP, but I imagine it'd still be incredibly difficult for a competitor to try and build the same tool/features even if they have the code as a "cheat sheet" of sorts. Are there other risks (i.e. security vulnerabilities) it causes?
- mooman219 6y ago
  I imagine the risk here is more about embarrassment than a business threat. Github endpoints are still authenticated, and their business is still in providing a service. Propping up, understanding, and maintaining the leaked codebase to use "for free" probably will never pay dividends. Another company referencing this code base when designing their own software will just expose them to needless risk in the future. I believe this isn't an existential threat to the company by any means.
jfrunyon 6y ago
1) It is extremely unlikely that this was actually pushed to the github/dmca repo. Github has a bug where you can make commits to forked/"networked" repo's appear as if they're in the original repo. 2) They most certainly did not "impersonat[e] Nat Friedman using a bug in GitHub's application"; they impersonated him using a design feature in Git.
- HotHotLava 6y ago
  They wrote a commit message with Nat Friedman's email address using a design feature of git, but it was still a design feature of GitHub that took this non-gpg signed commit and linked it with Nat Frieman's account, making it appear very legitimate in the GitHub UI, without an option for him to change that.
phendrenad2 6y ago
Is there an open-source alternative to GitHub that has all of the (A) Features and (B) UI Niceness that GitHub had 10 years ago?
- cs02rm0 6y ago
  Gitlab possibly, YMMV.
samim 6y ago
Github, via extension of its owner Microsoft, is owned by some of the most regressive, monopolistic, oligarchic/kleptocratic, big-finance forces on the planet - the likes of Blackrock, Berkshire, Gates, etc. It is very much in their interest to centralize and control open source/free software (free as in freedom), and they have a well established track record of doing just that, by any means necessary. To say it more poignantly: Microsoft is a direct driver of perverse wealth inequality, endless wars and centralisation of power which effectively destroys any resemblance of democracy everywhere. Behind the clean corporate facade, they are just another mafia. If you support this system - by hosting your code on Github and buying MS products - you are de-facto supporting this techno-dictatorship.
- nstj 6y ago
  It’s a decentralized version control system though! It seems tough to make the argument that M$ are trying to suppress free software speech through GitHub. Literally, a Git project can be redistributed immediately if it was ever taken down by GitHub so the argument that M$ is trying to control open source seems pretty soft.
  - qz2 6y ago
    It’s mostly about mindshare. Microsoft are running Bartertown and and are doing a pretty good impression of Master Blaster. Ironically youtube-dl just got dragged into the thunder dome. You can trade outside Bartertown but it’s going to have low visibility.
    - nstj 6y ago
      I can sort of buy that argument; but in that case it seems the problem is just that M$ is a company which many people dislike? Not that there are actual restrictiveness issues?
      - qz2 6y ago
        Rightfully dislike yes. They have a very long history of making the wrong decision almost universally, being a monopolist and abusive towards suppliers and customers. People are afraid that they will do that again after relying on them as a foundation for their product or experience based on some trite promise of "we changed". So when something happens, the attribution and a hypothesis is already formed. Unfortunately, based on my experiences attempting to fight their universal telemetry, the promise they made is invalid. So why should I trust any of their other promises? I think a lot of people are there too.
userbinator 6y ago
Now maybe someone will actually make a "hack" with a UI that looks like this... https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large ...and show that making it work in any browser, even text-based ones (as far as possible), is not hard.
- vxNsr 6y ago
  Kinda ridiculous how much I want this and at the same time how much I don't. Like I love how easy it is to use, everything immediately makes sense... but I can't get over my abject horror of the 90s UI. (even though it's 1000x better than anything some graphics design "expert" could make today.
robarr 6y ago
The reasons the guy who says leaked it: https://www.reddit.com/r/programming/comments/jnpufo/using_the_same_trick_as_the_one_with_youtubedl_i/ https://www.reddit.com/r/programming/comments/jnpufo/using_t... Using the same trick as the one with youtube-dl, I uploaded the entire GitHub backend source code to GitHub's own DMCA repo. Maybe now not only GitHub can have the chance to fix the "bug", but the entire community as well? ;)
- anticensor 6y ago
  Try the same thing for Windows 10.
madeforbbc 6y ago
Made for big black coq
kys-ms 6y ago
KYS for messing with youtube-dl
kubanczyk 6y ago
OP mirror https://web.archive.org/web/20201105011435/https://resynth1943.net/articles/github-source-code-leak/ https://web.archive.org/web/20201105011435/https://resynth19... Zipped source (140 MB) mirror https://web.archive.org/web/20201104050247/https://codeload.github.com/github/dmca/zip/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050247/https://codeload....
deleted 6y ago
[deleted]
neiman 6y ago
> We accidentally shipped an un-stripped/obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago. I'd love to hear more about that.
adenozine 6y ago
I don't suspect I'll ever see a more ironic headline in my entire life.
deleted 6y ago
[deleted]
globular-toast 6y ago
There's a really strange phenomenon that I experience on the internet where I think news is much older than it really. This is quite a striking example of that. I read this title today and immediately thought "that's old news". But it turns out that I read this only yesterday and in comment, not even an article. It's strange how my brain seems to store this information quickly, but doesn't have enough time to timestamp it.
aesyondu 6y ago
If anyone wants to share their thoughts on the code quality I would be happy to read them.
knolax 6y ago
Wait Github isn't open source? The irony.
pojntfx 6y ago
Tbh I think it's quite interesting that the by far biggest open source platform is in itself not open source. Why?
greggman3 6y ago
Tangentially lated I'm wondering when one of the 1000s of services with write access to 100s of thousands of github run repos gets hacked or tokens expropriated and lots of repos suddenly get malicious commits. I saw the headline and assumed this was a leak of someone else's source via stolen tokens.
_a1_ 6y ago
> Some users, such as Drew DeVault, suggest Microsoft is attempting to centralise open-source. Of course Drew DeVault thinks this way. He's trying to monetize his own github-like product, the sourcehut, so less people using GitHub means more people using sourcehut.
- mouldysammich 6y ago
  His product is, however, free and open-source, which follows that goal of avoiding centralization of free open-source software.
- 0xCMP 6y ago
  And if he hadn't already built it people would be saying his criticism was coming from someone who was just complaining and not doing anything to fix it. As another comment mentioned his service is open source.
- the5avage 6y ago
  Just looked at it and I like that "All features work without JavaScript" is listed as a pro.
- CameronNemo 6y ago
  Drew made source hut as a reaction to github and the centralization he laments. Monetization is absolutely essential to run a SaaS. It would not be a sustainable exercise without a monetization strategy.
rickspencer3 6y ago
A classy move here would be to make a bunch PRs to fix bugs in the codebase, inspiring Nat and Co. to just Open Source it all :) I know nothing about their revenue model of how it relies on proprietary code, of course, but it's fun to imagine.
thrownaway954 6y ago
it looks like they have already taken the source code down, which sucks cause i would have LOVED to look at it. github has some of the smartest developers in the world working for them and i would love to pour over the code and see the thought process involved in creating the github backend.
- avery42 6y ago
  The .zip download of the code was archived: https://web.archive.org/web/20201104050026/https://github.com/github/dmca/archive/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5.zip https://web.archive.org/web/20201104050026/https://github.co...
blitblitblit 6y ago
Can we finally see wich WebComponents are being used now? Github forcing WebComponents is a serious design flaw.
rurban 6y ago
Lots of small perl oneliners for a ruby shop :)
devcriollo 6y ago
https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b6d2b5ed9cb4097f9d5_zip https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b...
7leafer 6y ago
> What do Microsoft really think about open-source? - "Thank you, creative person, here is your exposure" https://s3.amazonaws.com/theoatmeal-img/comics/exposure/exposure.png https://s3.amazonaws.com/theoatmeal-img/comics/exposure/expo...

1013 points by resynth1943 6y ago

Stated without proof: I firmly believe this is related to the youtube-dl takedown. Look at the repo it was committed to as well as the timing. Similar things happened with Sony over Other OS. Sadly I bet there will be further attacks and leaks as time goes on here.

gameswithgo 6y ago
I don’t really consider non violent non cooperation as a sad form of protest over the iron grip corporations have over the proletariat. It is about all we can do. We can’t even democratically address the issue, we tried and the supreme court said nope.
Miner49er 6y ago
Why "sadly"?
- metiscus 6y ago
  Github is complying with a mandatory legal process. It isn't like they are at fault here. As much as I hate what has happened, folks are attacking the wrong company. Come out against the RIAA if you must do something. Better still to let the process work, you don't win legal battles by committing crimes.
  - sneak 6y ago
    > It isn't like they are at fault here. GitHub (via their owners Microsoft) is a member of the RIAA. They give the RIAA money to do stuff like this.
  - Reelin 6y ago
    Actually the takedown wasn't mandatory because (AFAIK, IANAL, etc) it wasn't actually a takedown request that GitHub received. Takedowns only apply to infringing content itself, not to tools. (Even if the tool were in violation of the DMCA it doesn't seem like the RIAA would have standing to pursue it.) That being said, it also seems like GitHub is well within their rights to choose not to host a project accused of violating the law.
  - LeifCarrotson 6y ago
    An empire will always want to promulgate the idea that gerruila warfare is bad form, that the resistance should stand in an orderly lineup and fight fairly, may the side with superior resources triumph. Civil disobedience and conscientious objection are going to be more effective than merely communicating your displeasure to your Twitter followers or starting a petition on change.org. It's unreasonable to expect that the individual who took this action could go to court against the RIAA and extract their deeply embedded claws from the legislative, executive, and even cultural environment in which they've entrenched themselves. Instead, it's reasonable to expect that somewhere in a conference room at say, Gitlab, Sourceforge, etc., sometime in the near future, some lawyer is going to mention "We got DCMAs from X for repo Y, and foo for repo bar, and from the MPAA for the popular repo (insert software tool here), obviously we should remove all of those repos." Maybe someone familiar looks up and says "that sounds a little silly, isn't that tool just a general-purpose media player?" And the lawyer might respond "We don't care-we don't have the budget to determine if the DCMA notice looks valid or not, if it turns out to be valid we have to do it and if it's not valid it costs us nothing to take it down". Actions like this provides a reasonable response of "But, as we saw with GitHub, some of our users and maybe even some of our own employees will resent us for this. It could cost us users, cost us bad publicity, or cost us real money. Let's put a couple people on this for an hour or two to estimate the pros and cons." Github was just a middleman, responding rationally to their existing financial, legal, and moral incentives, in a battle between their little users and the RIAA. Like a little flock of oxpecker birds riding a rhinoceros, we wouldn't even register in a fight against a tiger, we can only warn our larger intermediary of the danger we perceive. The RIAA doesn't care that you're against them. We need to change the incentives for companies like Github that have a chance to be heard.
  - User23 6y ago
    > you don't win legal battles by committing crimes Tell that to the Civil Rights movement.
  - samim 6y ago
    It's always good to remind oneself, that most dictators in history came to power through legal means. The Nazi's were democratically elected at first etc. Plus "Complying with a mandatory legal process" is a very relative thing for a multi-national giant corporation that pays very little taxes, hides most of its wealth offshore and is a leader in shaping the law through intensive lobbying.
  - breakfastduck 6y ago
    > you don't win legal battles by committing crimes Quite possibly one of the most incorrect things I've ever read.
pricci 6y ago
I think this is related to the fact that you can push to GitHub as another user and make the commit appear as it is part of another repo. After the youtube-dl event many people became aware of those "hacks" because someone used it to "upload youtube-dl into the DMCA's repo". Since those hacks are known by GitHub but they won't fix it, someone thought that the best way to "protest" against the decition was to push GH's source into the DMCA's repo impersonating GH's CEO. That's my theory, a protest. edit: DMCA
6456457 6y ago
> Sadly What's sad about this?
rasz 6y ago
Isnt this shooting the wrong man? IF you wanted to protest RIAA you would DOX lawyers, their families and friends. Hack and leak their private emails, dig up dirt like mistresses/embezzlement etc, not attack open source code repository RIAA happened to strong arm.

The_rationalist 6y ago

Where can we find the code?

resynth1943 6y ago
I linked it in the article :D
- arthurcolle 6y ago
  Is there a way to download it? I can't seem to click into the repo files
  - resynth1943 6y ago
    https://web.archive.org/web/20201104050026if_/https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050026if_/https://github... Click "Code". I'm not suggesting you download it, that would be naughty.
    - arthurcolle 6y ago
      That doesn't work
      - deleted 6y ago
        [deleted]
      - rukshn 6y ago
        try this if you have not already found the code - https://web.archive.org/web/20201104050247/https://codeload.github.com/github/dmca/zip/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050247/https://codeload....
    - deleted 6y ago
      [deleted]
- deleted 6y ago

thdc 6y ago

I wouldn't say it was a bug in GitHub's application that allowed someone to impersonate Nat, it's just that the author of the commit (which can be changed easily/set manually in git) matched his name/email. How many people can actually push to that repo? I wonder if it would be easy to figure out who actually did it...

resynth1943 6y ago
I'd still say it was a bug in GitHub, to be frank. This definitely shouldn't be allowed.
- lights0123 6y ago
  Currently, requiring signed commits (the only way to prevent this) would be a massive breaking change, as I would guess that 90%+ of GitHub users don't use GPG to sign their commits. However, they may be able to make that opt in, although it could very well break a ton of automated scripts and would completely break things like squash merging or rebasing by a maintainer.
  - resynth1943 6y ago
    I was thinking more along the lines of simply checking the email of the (real) commit author against the "email" used in the Git commit. Would this not be possible?
    - TheDong 6y ago
      That would break quite a few workflows. For example, if I were to 'git clone' a project currently on gitlab, create a github repo for it, add that origin, and push... Well, that pushes commits authored by every single person who ever committed to that other repository. Do I have to make all of them re-push only their own commits in order? Can robots not mirror repositories anymore? What about commits authored by people without github accounts? There's also the obvious issues of me merging a coworker's commit into my branch, or cherry-picking, or rebasing a third-party contributor's commits to update them before merge. I think the case of "push an existing repo with N authors to a new repo" is a really compelling reason though for why that sort of "you can only push commits with your email" thing would not work.

deleted 6y ago

[deleted]

mohamez 6y ago

What's up with all this source codes leaking online?

deleted 6y ago
[deleted]
ffhhj 6y ago
Someone released after the DMCA controversy to encourage others to find vulnerabilities in their system and perform attacks.

deleted 6y ago

[deleted]

npad 6y ago

I'm guessing this is just a dump of the GitHub Enterprise source? Apparently it's never been all that hard to decrypt - e.g. https://gist.github.com/iscgar/e8ea7560c9582e4615fcc439177e22b7 https://gist.github.com/iscgar/e8ea7560c9582e4615fcc439177e2...

duskwuff 6y ago
It looks like it's something more. The README is clearly targeted to Github employees, for instance.

willio58 6y ago

It never sat well with me how GitHub itself was not open-source. Is it a fundamental mistrust of the very technology that made the platform possible?

resynth1943 6y ago
Well, it definitely carries a hint of irony. They seem to be going against everything they stand for.
- mmahemoff 6y ago
  Not true. Github only hosts projects publicly for people who want to host their project publicly. They don't have a mantra of all information wants to be free, and indeed their entire business model relies on hosting private repos. I understand people wanting to host their open source on a server that's also open source. There's an argument it makes business sense if the closed source setup creates a long-term drift to GitLab or elsewhere. Nevertheless, I don't see the closed source as a contradiction. You can love open source while producing a mix of open and closed source. Building a sustainable business often means being selective about it and seeing open source as a tool you can benefit from (enlightened self-interest), rather than an ideology you must adhere to at all times.
- carapace 6y ago
  A hint of irony? It's freaking absurd. The "hub" for decentralized git (The "D" in DVCS stands for Distributed, doesn't it?) which has become the Kleenex of open source, is itself a closed, proprietary system. It's beyond ironic and well into oxymoronical. And then MS bought them! You can't make this stuff up.
manigandham 6y ago
The fundamental tech is hit, which is open source. GitHub provides the hosting and project management features on top.
- foolfoolz 6y ago

jpdlla 6y ago

Probably de-obfuscated source code from a Github Enterprise vm

mappu 6y ago

It's unlikely this is a "leak" per se - the source code can be straightforwardly recovered from the trial version of Github Enterprise, see e.g. https://news.ycombinator.com/item?id=13875993 https://news.ycombinator.com/item?id=13875993 or (more comments) https://news.ycombinator.com/item?id=13346866 https://news.ycombinator.com/item?id=13346866 EDIT: Anyone looking to try doing this, please support open alternatives instead: https://gitea.io/en-us/ https://gitea.io/en-us/

resynth1943 6y ago
I'd still call it a leak, since GitHub is closed-source. Then again, this raises an important point: with the source code so easily acquired, why isn't it open-source?
- nanagojo 6y ago
  Open source is another ball game license wise.
- freeone3000 6y ago
  Because their primary target is enterprise consumers, who care about legality. It doesn't matter how easy it is to get illegal source code, their customers can't risk it.
- smnrchrds 6y ago
  - If the locks can be so easily broken, why are there locks? - If it is so easy to shoplift, why don't stores just give out everything for free?
  - resynth1943 6y ago
    The hyperbole contributes nothing of any value to the conversation. While folks are definitely making good counter-points, I think the question needed to be asked.
    - smnrchrds 6y ago

SethTro 6y ago

Commit message was "felt cute, might put gh source code on dmca repo now idk" https://web.archive.org/web/20201104050026if_/https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050026if_/https://github...

klysm 6y ago
Oh my you aren’t kidding
deleted 6y ago
[deleted]
areyousure 6y ago
That link now says "Sorry. This URL has been excluded from the Wayback Machine."
- sdfhbdf 6y ago
  I think it might because of their robots.txt. I remember reading somewhere that once You include some url in robots.txt archive.org even though can have it archived it will stop showing it to the public. https://blog.archive.org/2017/04/17/robots-txt-meant-for-search-engines-dont-work-well-for-web-archives/ https://blog.archive.org/2017/04/17/robots-txt-meant-for-sea... https://github.com/robots.txt https://github.com/robots.txt They have some interesting nuggets in their robots though like `/ExplodingStuff/` and `/account-login` both of which seem to be some accounts. Or probably more possible - they just got in contact with the archive.org people.
  - roryokane 6y ago
    The first page you linked tells the story of how the Wayback Machine once deleted archived content if robots.txt directed it to, but was moving towards not doing that anymore. You can also see in GitHub’s robots.txt that URLs matching `/*/tree/` should already have been forbidden, yet the Wayback Machine at one point had https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d... archived. These facts suggest that it is your second theory that is correct—GitHub contacted archive.org to get the archive taken down.

kzrdude 6y ago

It is a bit sad that the dmca repo gets targeted, because it's an optional extra that github is doing to show publicly when DMCA notices are received.

ehsankia 6y ago
I'm curious why that repo even has PR's enabled?
- DoctorOW 6y ago
  I don't think you can disable them.
  - jdbernard 6y ago
    Ironically, this is a feature people have been asking GitHub to implement for years now.
    - kzrdude 6y ago
      But, in this topic, PRs are not needed for the current shenanigans - all it uses is object sharing between forks
      - londons_explore 6y ago
        I assume thats because internally within github, all forks are implemented as a single repo with some kind of namespacing on branches.

preommr 6y ago

7.5 billion dollars well spent.

eli 6y ago
You misunderstand where the value comes from

ibraheemdev 6y ago

Would downloading a local copy be considered illegal?

Reelin 6y ago
Yes, almost certainly. You haven't licensed the material so it's copying or possession by you is an illegal act in most jurisdictions. Your awareness of the nature of the content and its licensing status establishes intent. Of course, if you don't redistribute it you shouldn't have any problems (at least in the US) because an IP address alone isn't sufficient to pursue someone in court here.
- bawolff 6y ago
  IANAL, but if you dont have plans to do anything evil with it, steal github's customers, etc (and havent made any promises to github to keep things secret) i think you could argue that making a copy for research purposes is fair use.
  - Reelin 6y ago
    If you were collecting public documents in bulk and had concrete plans that you could articulate, sure. I suppose the same might even apply to bulk collection of pirated content as well, although I'd certainly want to run that one by a lawyer before depending on it. I really don't think any of that applies here though. This is an isolated leak of materials which you very clearly do not have any rights to access, copy, or possess in any manner whatsoever. I just can't see how "research purposes" helps you here. (Unless you happen to be an established researcher with an ongoing project that involves surveying source code leaks over time, perhaps? But again, you'd really need to consult a lawyer before doing something like that.)
    - bawolff 6y ago
      Disclaimer: not a lawyer, do not actuslly follow this as advice. Yadda > This is an isolated leak of materials which you very clearly do not have any rights to access, copy, or possess in any manner whatsoever I think that's backwards - you don't need the right to posess something, you need to make sure that nobody has the right to stop you from posessing it. The default state in the absence of someone else's right interfereing is information gets to be free. So the question is, are you violating any of github's rights if you download the code for "personal research" or curiosity? As far as copyright/fair use goes, the fact its a leak doesn't seem that applicable to me - you do not need permission from the copyright holder for fair use to apply (in fact that would defeat the entire point of fair use). "Research" might apply here, because in the united states you can basically ignore copyright if its for research purposes (although there is a lot of fine print on that and its really complicated). In particular, if your personal research is non-commercial and unlikely to affect github's bottom line, it further increases the liklihood fair use applies. https://en.wikipedia.org/wiki/Fair_use#U.S._fair_use_factors https://en.wikipedia.org/wiki/Fair_use#U.S._fair_use_factors Personally i think trade secret law is more appropriate than copyright here, but afaik that only applies to people who have a responsibility to keep github's code confidential. I don't think that applies to randoms on the internet who are just curious what github's source looks like. And again, IANAL.

arthurcolle 6y ago

Is there a torrent for this?

sneak 6y ago
I would imagine so, but the whole thing (.zip) is still available on the Internet Archive's site: https://web.archive.org/web/20201104050247/https://codeload.github.com/github/dmca/zip/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050247/https://codeload.... mirror: https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b6d2b5ed9cb4097f9d5_zip https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b...
- ralph87 6y ago
  Hoping someone snarfed a git clone, revision history is waaay more interesting than the code itself
  - saagarjha 6y ago
    It seems like it was pushed as a single commit: https://web.archive.org/web/20201104050026if_/https://github.com/github/dmca/tree/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050026if_/https://github...
- arthurcolle 6y ago
  thanks dude, I tried hitting the Code button but it didn't download. Is it really working for you? Interesting, I got an HTTP error from it.
banana_giraffe 6y ago
c51717e6755ac0efdf22f7421e372f5b061724d6

emrehan 6y ago

Now that the damage is done, GitHub can go release the source code and own it.

snazz 6y ago
The source code was never very private in the first place—it's easy to de-obfuscate it. More importantly, GitHub doesn't want to support and deal with open-sourcing their core. There's some amount of irony here considering that GitHub is the primary place for other open-source projects to be developed, but it's important to remember that GitHub makes their money from private team repos anyway.
- emrehan 6y ago
  Making the source code open... 1. is not equal to making it open to collaboration. 2. does not mean they can’t keep making money from it.
  - snazz 6y ago
    What incentive do they have to keep it open, though? People who already needed to read the source code (like security researchers) don't need the complete unobfuscated source in the first place. It would likely cost GitHub money in frivolous support queries.
    - bawolff 6y ago
      Security research might not require unobfuscated source code, but it does make it easier.

natfriedman 6y ago

Hi folks, I'm the CEO of GitHub. GitHub hasn't been hacked. We accidentally shipped an un-stripped/obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago. It shares code with github.com. As others have pointed out, much of GitHub is written in Ruby. Git makes it trivial to impersonate unsigned commits, so we recommend people sign their commits and look for the 'verified' label on GitHub to ensure that things are as they appear to be. As for repo impersonation – stay tuned, we are going to make it much more obvious when you're viewing an orphaned commit. In summary: everything is fine, situation normal, the lark is on the wing, the snail is on the thorn, and all's right with the world.

czbond 6y ago
<had a comment, it was snarky, bad taste, removing. even if accurate>
- mdoms 6y ago
  Unsigned. Unsigned commits.
  - czbond 6y ago
    Clever.... :)
tomglynch 6y ago
Thanks for the response here Nat. Upfront and to the point. Now that most of the code is out there, will you consider making the whole project Open Source?
- chenpengcheng 6y ago
  great question!
- metiscus 6y ago
  Answered in part here quoted in case of edits. https://news.ycombinator.com/item?id=24995266 https://news.ycombinator.com/item?id=24995266 "It's not open source because the open source "community" is a liability and you want them far away from you at all times. I'm not trying to be mean or sarcastic or anything. Just look at how maintainers are treated for a week and you'll see exactly what I mean."

czbond 6y ago

I had always heard GitHub was running on Rails - but I always thought "sure some section of it is". Not ALL on rails - with models and controllers in there.

Wowfunhappy 6y ago

Has anyone gotten this running? I'd thought it might be easy since it uses Docker, but docker-compose appears to be trying to pull a dependency called "git-daemon-server" from a URL that requires authentication.

fyfy18 6y ago
The advantage of not having a monorepo?

dboreham 6y ago

Whenever I've worked on large proprietary products we would joke we should leak our source to tie up our competitors for years trying understand it...

Thorrez 6y ago
That reminds me of this story[1]. The author shared some code that was so bad, that the recipient of the code was kicked out of the country. Receiving bad code can have some extreme consequences. [1] http://theorangeduck.com/page/reproduce-their-results#sourcecode http://theorangeduck.com/page/reproduce-their-results#source...

qgrgergfqgfev 6y ago

I saw Github's code as a consultants years ago, and I always thought it was crazy that they would ship the whole thing to us. But then I thought, how many employees do they have? Probably enough that security should not rely on the secrecy of the code anymore.

alpb 6y ago
I think the main concern would be the intellectual property around the large-scale distributed system which is storing billions of lines of code in a single system. Implementing git object storage is still hard (e.g. https://en.wikipedia.org/wiki/Virtual_File_System_for_Git https://en.wikipedia.org/wiki/Virtual_File_System_for_Git). Though, that's probably not what they use in the enterprise edition, so maybe they aren't as worried.
speedgoose 6y ago
I guess it's difficult and expensive to deploy a ruby on rails application on premise without giving some kind of source code.
0xdeadb00f 6y ago
If that is the case then why don't they open source it all?
- qgrgergfqgfev 6y ago
  what would be the point?

wdiamond 6y ago

I hope that I won't need to search in a thousand of githubs for each npm packet I need in near future.

syspec 6y ago

What is the legality of /looking/ at this code in order to study how a large corporation with a large code base writes a Rails app? I'd love to study it but not if just viewing it is a gray area

zymhan 6y ago
AFAIK the only thing that's straight up illegal to look at in the USA is child porn. You can read bomb-making instructions, for heaven's sake. You can certainly look at this code. Just don't base a product on the ideas you got from looking at it.
- Polylactic_acid 6y ago
  The problem is how do you prove you didn't base your ideas on what you saw? If you never saw it then its easy to say you can't have copied it.
  - vimax 6y ago
    Copyright is about copying. Are there any verbatim copies of the original in your project. Did you sign an enforceable ip ownership or non-compete agreement with GitHub about trade secrets learned while working on their source code? If the answers to those questions are no, there is a very long, very steep, uphill battle facing GitHub.
npteljes 6y ago
Legality aside, the clean-room FOSS projects won't like your contributions if you have been exposed to the respective leaked source codes. From the top of my head, WINE requires this: https://wiki.winehq.org/Clean_Room_Guidelines https://wiki.winehq.org/Clean_Room_Guidelines

deleted 6y ago

[deleted]

pietroglyph 6y ago

> impersonating Nat Friedman using a bug in GitHub's application. This is not a bug, it's a part of how Git fundamentally works. If you want to mitigate it you have to sign your commits. GitHub could only attribute commits in the UI if they're signed, but I suspect that this is considered too much friction to enable.

redrobein 6y ago
> how Git fundamentally works Honestly, given this, they should clearly label unsigned commits by default.
- jfrunyon 6y ago
  They... do? Do you see the Verified note anywhere? It's not their fault if people don't understand how the tool they're using works at an extremely basic level...
  - kelnos 6y ago
    So few people sign their commits that the default is to assume commits are from where they say they are, even if they're not verified.
    - jfrunyon 6y ago
      Please let me know when you figure out what GitHub could reasonably do to make enough people sign their commits to change that default.
  - hvdijk 6y ago
    They don't. The comment was on labelling. There is nothing in the presentation of unsigned commits to indicate that they are unsigned. The presentation is indistinguishable from that of a hypothetical GitHub that never shows commit signatures, you need to have seen a signed commit on GitHub at some point to know that the absence of that Verified note is significant.

amb23 6y ago

What are the business risks to a company like Github when their source code has been released in the wild? Startups treat their code like IP, but I imagine it'd still be incredibly difficult for a competitor to try and build the same tool/features even if they have the code as a "cheat sheet" of sorts. Are there other risks (i.e. security vulnerabilities) it causes?

mooman219 6y ago
I imagine the risk here is more about embarrassment than a business threat. Github endpoints are still authenticated, and their business is still in providing a service. Propping up, understanding, and maintaining the leaked codebase to use "for free" probably will never pay dividends. Another company referencing this code base when designing their own software will just expose them to needless risk in the future. I believe this isn't an existential threat to the company by any means.

jfrunyon 6y ago

1) It is extremely unlikely that this was actually pushed to the github/dmca repo. Github has a bug where you can make commits to forked/"networked" repo's appear as if they're in the original repo. 2) They most certainly did not "impersonat[e] Nat Friedman using a bug in GitHub's application"; they impersonated him using a design feature in Git.

HotHotLava 6y ago
They wrote a commit message with Nat Friedman's email address using a design feature of git, but it was still a design feature of GitHub that took this non-gpg signed commit and linked it with Nat Frieman's account, making it appear very legitimate in the GitHub UI, without an option for him to change that.

phendrenad2 6y ago

Is there an open-source alternative to GitHub that has all of the (A) Features and (B) UI Niceness that GitHub had 10 years ago?

cs02rm0 6y ago
Gitlab possibly, YMMV.

samim 6y ago

Github, via extension of its owner Microsoft, is owned by some of the most regressive, monopolistic, oligarchic/kleptocratic, big-finance forces on the planet - the likes of Blackrock, Berkshire, Gates, etc. It is very much in their interest to centralize and control open source/free software (free as in freedom), and they have a well established track record of doing just that, by any means necessary. To say it more poignantly: Microsoft is a direct driver of perverse wealth inequality, endless wars and centralisation of power which effectively destroys any resemblance of democracy everywhere. Behind the clean corporate facade, they are just another mafia. If you support this system - by hosting your code on Github and buying MS products - you are de-facto supporting this techno-dictatorship.

nstj 6y ago
It’s a decentralized version control system though! It seems tough to make the argument that M$ are trying to suppress free software speech through GitHub. Literally, a Git project can be redistributed immediately if it was ever taken down by GitHub so the argument that M$ is trying to control open source seems pretty soft.
- qz2 6y ago
  It’s mostly about mindshare. Microsoft are running Bartertown and and are doing a pretty good impression of Master Blaster. Ironically youtube-dl just got dragged into the thunder dome. You can trade outside Bartertown but it’s going to have low visibility.
  - nstj 6y ago
    I can sort of buy that argument; but in that case it seems the problem is just that M$ is a company which many people dislike? Not that there are actual restrictiveness issues?
    - qz2 6y ago
      Rightfully dislike yes. They have a very long history of making the wrong decision almost universally, being a monopolist and abusive towards suppliers and customers. People are afraid that they will do that again after relying on them as a foundation for their product or experience based on some trite promise of "we changed". So when something happens, the attribution and a hypothesis is already formed. Unfortunately, based on my experiences attempting to fight their universal telemetry, the promise they made is invalid. So why should I trust any of their other promises? I think a lot of people are there too.

userbinator 6y ago

Now maybe someone will actually make a "hack" with a UI that looks like this... https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large ...and show that making it work in any browser, even text-based ones (as far as possible), is not hard.

vxNsr 6y ago
Kinda ridiculous how much I want this and at the same time how much I don't. Like I love how easy it is to use, everything immediately makes sense... but I can't get over my abject horror of the 90s UI. (even though it's 1000x better than anything some graphics design "expert" could make today.

robarr 6y ago

The reasons the guy who says leaked it: https://www.reddit.com/r/programming/comments/jnpufo/using_the_same_trick_as_the_one_with_youtubedl_i/ https://www.reddit.com/r/programming/comments/jnpufo/using_t... Using the same trick as the one with youtube-dl, I uploaded the entire GitHub backend source code to GitHub's own DMCA repo. Maybe now not only GitHub can have the chance to fix the "bug", but the entire community as well? ;)

anticensor 6y ago
Try the same thing for Windows 10.

madeforbbc 6y ago

Made for big black coq

kys-ms 6y ago

KYS for messing with youtube-dl

kubanczyk 6y ago

OP mirror https://web.archive.org/web/20201105011435/https://resynth1943.net/articles/github-source-code-leak/ https://web.archive.org/web/20201105011435/https://resynth19... Zipped source (140 MB) mirror https://web.archive.org/web/20201104050247/https://codeload.github.com/github/dmca/zip/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5 https://web.archive.org/web/20201104050247/https://codeload....

deleted 6y ago

[deleted]

neiman 6y ago

> We accidentally shipped an un-stripped/obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago. I'd love to hear more about that.

adenozine 6y ago

I don't suspect I'll ever see a more ironic headline in my entire life.

deleted 6y ago

[deleted]

globular-toast 6y ago

There's a really strange phenomenon that I experience on the internet where I think news is much older than it really. This is quite a striking example of that. I read this title today and immediately thought "that's old news". But it turns out that I read this only yesterday and in comment, not even an article. It's strange how my brain seems to store this information quickly, but doesn't have enough time to timestamp it.

aesyondu 6y ago

If anyone wants to share their thoughts on the code quality I would be happy to read them.

knolax 6y ago

Wait Github isn't open source? The irony.

pojntfx 6y ago

Tbh I think it's quite interesting that the by far biggest open source platform is in itself not open source. Why?

greggman3 6y ago

Tangentially lated I'm wondering when one of the 1000s of services with write access to 100s of thousands of github run repos gets hacked or tokens expropriated and lots of repos suddenly get malicious commits. I saw the headline and assumed this was a leak of someone else's source via stolen tokens.

_a1_ 6y ago

> Some users, such as Drew DeVault, suggest Microsoft is attempting to centralise open-source. Of course Drew DeVault thinks this way. He's trying to monetize his own github-like product, the sourcehut, so less people using GitHub means more people using sourcehut.

mouldysammich 6y ago
His product is, however, free and open-source, which follows that goal of avoiding centralization of free open-source software.
0xCMP 6y ago
And if he hadn't already built it people would be saying his criticism was coming from someone who was just complaining and not doing anything to fix it. As another comment mentioned his service is open source.
the5avage 6y ago
Just looked at it and I like that "All features work without JavaScript" is listed as a pro.
CameronNemo 6y ago
Drew made source hut as a reaction to github and the centralization he laments. Monetization is absolutely essential to run a SaaS. It would not be a sustainable exercise without a monetization strategy.

rickspencer3 6y ago

A classy move here would be to make a bunch PRs to fix bugs in the codebase, inspiring Nat and Co. to just Open Source it all :) I know nothing about their revenue model of how it relies on proprietary code, of course, but it's fun to imagine.

thrownaway954 6y ago

it looks like they have already taken the source code down, which sucks cause i would have LOVED to look at it. github has some of the smartest developers in the world working for them and i would love to pour over the code and see the thought process involved in creating the github backend.

avery42 6y ago
The .zip download of the code was archived: https://web.archive.org/web/20201104050026/https://github.com/github/dmca/archive/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5.zip https://web.archive.org/web/20201104050026/https://github.co...

blitblitblit 6y ago

Can we finally see wich WebComponents are being used now? Github forcing WebComponents is a serious design flaw.

rurban 6y ago

Lots of small perl oneliners for a ruby shop :)

devcriollo 6y ago

https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b6d2b5ed9cb4097f9d5_zip https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b...

7leafer 6y ago

> What do Microsoft really think about open-source? - "Thank you, creative person, here is your exposure" https://s3.amazonaws.com/theoatmeal-img/comics/exposure/exposure.png https://s3.amazonaws.com/theoatmeal-img/comics/exposure/expo...