5 ms·

Github is a single point of failure for the open source community

• mistrial9 6y ago
  > a single point of failure for the open source community some actors who benefit from scale are purposefully trying to make Github fit that role, to gather, search and mine the work of others without paying or giving back.. but due to the distributed nature of git itself, there are alternatives
• creato 6y ago
  What does this have to do with this incident? Do you think attackers having to scan 10 or more open source repo hosts for leaks is impractical? If so, maybe that's a worse situation? After all, if it's harder for attackers to scan, it must be harder for"white hats" looking for leaks to report? If anything, this might make companies increase the risk they associate with open sourcing their code. This wouldn't have happened if solar winds were not uploading anything at all to github...
  • _jal 6y ago
    It isn't open sourcing that increases risk, it is the open repositories. It is a vital distinction to make. Code needs to be scanned for secrets even in closed repositories because of insider threats. But opening them up guarantees your mistakes will be caught by, ah, volunteer sysadmins. I understand you're pointing out that fuzzing the distinction is a way for someone with an anti-open-source agenda to advance their efforts, just trying to make the point explicit.