5 ms·

If Wikipedia is to be believed, GitHub had 56 million users in September 2020. If we adjust that to 60 million for the time that's passed, that gives us a ballp

If Wikipedia is to be believed, GitHub had 56 million users in September 2020. If we adjust that to 60 million for the time that's passed, that gives us a ballpark of 600 users who were affected. So no it's not high. But I'm impressed if they were able to accurately quantify that less than 600 users were impacted by this race condition.

mattrick 6y ago
But its talking specifically about sessions. There's plenty of inactive users on GitHub as well.
- ksec 6y ago
  Using 80:20 rules, and assume only 20% of those are active. We could be down to 120 user?
- EE84M3i 6y ago
  There are also potentially many sessions per user. (Different browsers, even automated tools perhaps)
manquer 6y ago
Sessions != Users. I have two or three active sessions at any point, Multiple browsers + mobile. Since the issue seems to be with cookies, we can probably discard mobile. Also each time you login/ token refreshes is probably a new session. So they easily have million's of sessions daily. So in the one month period between 6th Feb and 5 March, you have **(DAU) * 35* (average sessions / user)** . So in the ballpark of 10M * 35 * 5 sessions ~ so anywhere between 700-1500 M sessions conservatively . That is in the ballpark of 15,000 users. Also 0.001% is their belief of the impact. I don't see any evidence or statistical model or details supporting the statement. I am deeply skeptical of this number without knowing the methodology , as you say it would quite impressive to narrow down a race condition to that level.
- fractionalhare 6y ago
  Good point, after re-reading I see the 0.001% does apply to sessions rather than users. That should elevate the total users affected, yeah.
lambda_obrien 6y ago
It's a race condition, so it had to do with two operations happening in a certain incorrect order. I bet they are able to see the exact situations where it occurred with pretty great certainty by reviewing the logs of the two operations that raced and see where the incorrect operation won. They even say they are invalidating all sessions or of an abundance of caution, indicative that they are pretty sure about it.
- IncRnd 6y ago
  You called it! Just another race condition that uses shared objects without protecting them.

mattrick 6y ago

But its talking specifically about sessions. There's plenty of inactive users on GitHub as well.

ksec 6y ago
Using 80:20 rules, and assume only 20% of those are active. We could be down to 120 user?
EE84M3i 6y ago
There are also potentially many sessions per user. (Different browsers, even automated tools perhaps)

manquer 6y ago

Sessions != Users. I have two or three active sessions at any point, Multiple browsers + mobile. Since the issue seems to be with cookies, we can probably discard mobile. Also each time you login/ token refreshes is probably a new session. So they easily have million's of sessions daily. So in the one month period between 6th Feb and 5 March, you have **(DAU) * 35* (average sessions / user)** . So in the ballpark of 10M * 35 * 5 sessions ~ so anywhere between 700-1500 M sessions conservatively . That is in the ballpark of 15,000 users. Also 0.001% is their belief of the impact. I don't see any evidence or statistical model or details supporting the statement. I am deeply skeptical of this number without knowing the methodology , as you say it would quite impressive to narrow down a race condition to that level.

fractionalhare 6y ago
Good point, after re-reading I see the 0.001% does apply to sessions rather than users. That should elevate the total users affected, yeah.

lambda_obrien 6y ago

It's a race condition, so it had to do with two operations happening in a certain incorrect order. I bet they are able to see the exact situations where it occurred with pretty great certainty by reviewing the logs of the two operations that raced and see where the incorrect operation won. They even say they are invalidating all sessions or of an abundance of caution, indicative that they are pretty sure about it.

IncRnd 6y ago
You called it! Just another race condition that uses shared objects without protecting them.