4 ms·

> The users can still see all their stars and find the private repo, which makes it not private. Why seeing a start you made for a previously public repository

by XCSme 5y ago

> The users can still see all their stars and find the private repo, which makes it not private. Why seeing a start you made for a previously public repository makes it not private? People remember things too, there's also the webarchive. You should be able to unstar it or keep your star, the only difference is that you don't know if the repository still exists or not.

judge2020 5y ago
> the only difference is that you don't know if the repository still exists or not. If an admin were to private->delete, then all the stars referencing the report would stay and thus the reference to the repo would still be there, on GitHub's servers. There's a difference between GitHub storing things forever and third parties on the internet being a forever archive of visible pages.
- jedberg 5y ago
  But that's an easy fix. If they delete the repo, delete the stars. If they make it private, indicate it is now private in some way.
  - judge2020 5y ago
    That's information disclosure; nothing about the repo after it's privated should be known, including name changes and deletion.
    - jedberg 5y ago
      It’s unclear to me what the attack vector is for that disclosure.
    - loa_in_ 5y ago
      It was known and there are many sites scraping GH for metadata that will have it anyway
      - judge2020 5y ago
        Not whether or not a repo exists after it's set private.
        loa_in_ 5y ago
        This information is useless. It leaks nothing but name and existence of something once public (that vanished from public view). Most importantly it's not confidential or critical in any way