5 ms·

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people i

It would be nice of Github if they could publish a transparency repo with all the partners and all the regex along with this initiative. I see a lot of people in this thread worried that "China gets their data" and this transparency repo could alleviate some of that.

tomudding 4y ago
There is a list of partners [0], I thought I had seen regexes at some point but I can no longer find them. [0]: https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/secret-scanning-patterns https://docs.github.com/en/enterprise-cloud@latest/code-secu...
boredhedgehog 4y ago
Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.
- mylidlpony 4y ago
  > because there's nothing they can do about it Are you talking about the China that bought huge areas in ports around the world? The same one that has secret police stations as well?
  - nicce 4y ago
    So, basically... nothing? You should go into China to get a real threat. On the other hand, there is global cooperation with intelligence agencies of USA and many European countries.
    - pell 4y ago
      China spies on Uyghurs in other countries, puts pressure on them and has been known to run secret police stations as well. China spying on Uyghurs in Sweden: https://www.rferl.org/a/Sweden_Jails_Uyghur_Chinese_Man_For_Spying/1977995.html https://www.rferl.org/a/Sweden_Jails_Uyghur_Chinese_Man_For_... China controls dissidents abroad through relatives back home: https://www.reuters.com/article/us-china-uighurs-idUSKBN0UD1BE20151230 https://www.reuters.com/article/us-china-uighurs-idUSKBN0UD1... China's secret police stations in Europe: https://www.spiegel.de/international/world/beijing-s-long-arm-china-s-secret-police-stations-in-europe-a-d6732094-ca32-4c0a-8e6f-58b395b946aa https://www.spiegel.de/international/world/beijing-s-long-ar... >On the other hand, there is global cooperation with intelligence agencies of USA and many European countries. Two wrongs don't make a right.
      - nicce 4y ago
        They key point was not in acquiring information.. instead in authority to do something real with that information without real concequences.
  - Cthulhu_ 4y ago
    TECHNICALLY they only supply loans and construction assistance to countries that don't have the infrastructure themselves yet, but, yeah. Not like the US is much better though; US based investors and shell companies own property all across the world, and US intelligence agencies infiltrated / owned European based secure communications companies / products (https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG). Also, the US has public / non-secret army bases in 100+ countries, and secret police stations in loads of places elsewhere (50 prisons in 28 countries: https://en.wikipedia.org/wiki/CIA_black_sites https://en.wikipedia.org/wiki/CIA_black_sites)
- dwighttk 4y ago
  > because there's nothing they can do about it What makes you think this?
- richardw 4y ago
  Because if you want to influence the voting patterns of a population, knowing as much as you can is useful. Search history + TikTok + FB would give you unbeatable datasets that you could use for the lifetime of the person. Take a dataset now, add a decade of AI progress and I’m pretty sure a nefarious actor would be leading many people around by the nose. Not all, but 5% would move many elections. They wouldn’t even need to learn all that much about you as an individual. Just enough to match you with a cluster from their own population that they have infinite data on.
  - 3np 4y ago
    In other words, your data in their hands is dangerous to you when combined with that of others.
- londons_explore 4y ago
  I agree. For most people here, it is their own government (or allied governments) which are the ones to be most cautious about. They're the ones most likely to ruin your life if they don't agree with what you're up to - elected or not.
- dncornholio 4y ago
  Because American propoganda.
- Alifatisk 4y ago
  > If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. Unless you live or visit there. Wasn’t there reports of China having concentration camps?
  - ilyt 4y ago
    Obviously if someone would pick China it was because they were not planning to visit there
- didericis 4y ago
  > If I was forced to pick one government to share my secrets with, it would be the Chinese, because there’s nothing they can do about it. What makes you so sure about that? I worry about China because there’s no internal checks to prevent them from doing anything. Western governments and allies have a long culture of court systems and thinking about balancing constituent needs. That is eroding and becoming more dangerous to the extent western leaders are envious of dictatorial powers and trying to emulate Chinese totalitarianism, but there is a lot of institutional and cultural bulwark against it. Any powerful totalitarian country should worry people. People underestimate the level of covert aggression in all facets of foreign involvement in regimes with no internal accountability.
  - Cthulhu_ 4y ago
    > What makes you so sure about that? I think the commenter means that China can't do much about them while living where they do (e.g. the US), whereas the US based intelligence agencies can black bag them in most of the western world. Given the Snowden revelations, I don't believe there's much accountability to what the NSA and co collect and analyze. Secret courts, CIA dark sites, Gitmo, all kinds of things that might be legal according to the letter of the law, but feel immoral and unjust (war crimes level of unjust).
    - didericis 4y ago
      The fact that we’re able to talk openly about the unaccountability of the NSA, CIA, FISA courts and Gitmo is a form of accountability that does not exist in China. I do not condone the actions of all of the US institutions and believe many are largely unaccountable, but there is still far more accountability in our least accountable institutions than any in China. Culture within institutions, the populace at large from which institutions hire from, and the history of institutions is a very important but subtle factor that westerners take for granted and is not identical between countries. The fact that we even call US actions war crimes is another form of accountability China lacks. China forcibly annexed Tibet. China has concentration camps in inner Mongolia. China massacred it’s own people during the Mao era and is run by the same party today. China releases dams upstream of cities and drowns its own people. China committed war crimes in its support of North Korea during the Korean War, and Vietnam in the Vietnam War. China turned hundreds of its college students into mincemeat in Tiananmen square. These are not on the radar of most people in China the same way Gitmo and Iraq and Vietnam are in the US because the CCP has a level of unaccountability westerners do not understand. Their stranglehold on media and public perception is extreme, and they have been exerting influence on western social media like reddit, youtube, and facebook, as well as google search. They do so through virtually all corporations that want access to Chinese labor and the Chinese market. The ramifications of this are severe. The lockdown policies that have destroyed a lot of the global economy were pushed on the world by pressure from China (and our own fear and incompetence), despite existing pandemic plans in western nations that were far more sane, more humane, and less destructive. They were able to get us to discard our own pandemic plans from our own institutions because of the influence they have been gaining. China exerted influence over the WHO recommendations, and was very aggressive/in PR panic mode when the virus first escaped. Our own internal division is largely our own doing, but they were extremely aggressive in the early phases of the pandemic online and greatly exacerbated western problems precisely because they knew what talking points to copy and paste for maximum division and lack of consensus. Giving them your data and more ability to influence you and people that fit your demographics online is incredibly naive and foolish, no matter how much you may dislike your own government or how valid that dislike may be.
- talkingtab 4y ago
  You may not have noticed this, but China is seeking to extend it's influence. By whatever means required including deadly force. There is a picture you might want to look at. Search "Tank Man". That is why people worry about China so much.
  - zanellato19 4y ago
    oh, you mean like the US and its global reaching government?
- eynsham 4y ago
  Some people are Chinese.
- cscurmudgeon 4y ago
  https://amp.cnn.com/cnn/2022/12/04/world/china-overseas-police-stations-intl-cmd/index.html https://amp.cnn.com/cnn/2022/12/04/world/china-overseas-poli... Yep totally harmless. > China operating over 100 police stations across the world with the help of some host nations, report claims
ffpip 4y ago
I don't think they would release the regex used to validate the API keys since it would help people automate scanning for API keys of all supported providers on public repos on any other site using the regex given by the provider itself.
SalimoS 4y ago
I guess because some lazy people will use those regex in all other public git hosts and search engine
civopsec 4y ago
Is this blog post not the transparency part? I assume that the regex is `TC:[a-z0-9]{20}` or something uninteresting like that.

tomudding 4y ago

There is a list of partners [0], I thought I had seen regexes at some point but I can no longer find them. [0]: https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/secret-scanning-patterns https://docs.github.com/en/enterprise-cloud@latest/code-secu...

boredhedgehog 4y ago

Why do people worry about China so much? There is barely any cooperation between Chinese intelligence and the rest of the world. If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. My own government and its allies is infinitely more dangerous to me than such a foreign one.

mylidlpony 4y ago
> because there's nothing they can do about it Are you talking about the China that bought huge areas in ports around the world? The same one that has secret police stations as well?
- nicce 4y ago
  So, basically... nothing? You should go into China to get a real threat. On the other hand, there is global cooperation with intelligence agencies of USA and many European countries.
  - pell 4y ago
    China spies on Uyghurs in other countries, puts pressure on them and has been known to run secret police stations as well. China spying on Uyghurs in Sweden: https://www.rferl.org/a/Sweden_Jails_Uyghur_Chinese_Man_For_Spying/1977995.html https://www.rferl.org/a/Sweden_Jails_Uyghur_Chinese_Man_For_... China controls dissidents abroad through relatives back home: https://www.reuters.com/article/us-china-uighurs-idUSKBN0UD1BE20151230 https://www.reuters.com/article/us-china-uighurs-idUSKBN0UD1... China's secret police stations in Europe: https://www.spiegel.de/international/world/beijing-s-long-arm-china-s-secret-police-stations-in-europe-a-d6732094-ca32-4c0a-8e6f-58b395b946aa https://www.spiegel.de/international/world/beijing-s-long-ar... >On the other hand, there is global cooperation with intelligence agencies of USA and many European countries. Two wrongs don't make a right.
    - nicce 4y ago
      They key point was not in acquiring information.. instead in authority to do something real with that information without real concequences.
- Cthulhu_ 4y ago
  TECHNICALLY they only supply loans and construction assistance to countries that don't have the infrastructure themselves yet, but, yeah. Not like the US is much better though; US based investors and shell companies own property all across the world, and US intelligence agencies infiltrated / owned European based secure communications companies / products (https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG). Also, the US has public / non-secret army bases in 100+ countries, and secret police stations in loads of places elsewhere (50 prisons in 28 countries: https://en.wikipedia.org/wiki/CIA_black_sites https://en.wikipedia.org/wiki/CIA_black_sites)
dwighttk 4y ago
> because there's nothing they can do about it What makes you think this?
richardw 4y ago
Because if you want to influence the voting patterns of a population, knowing as much as you can is useful. Search history + TikTok + FB would give you unbeatable datasets that you could use for the lifetime of the person. Take a dataset now, add a decade of AI progress and I’m pretty sure a nefarious actor would be leading many people around by the nose. Not all, but 5% would move many elections. They wouldn’t even need to learn all that much about you as an individual. Just enough to match you with a cluster from their own population that they have infinite data on.
- 3np 4y ago
  In other words, your data in their hands is dangerous to you when combined with that of others.
londons_explore 4y ago
I agree. For most people here, it is their own government (or allied governments) which are the ones to be most cautious about. They're the ones most likely to ruin your life if they don't agree with what you're up to - elected or not.
dncornholio 4y ago
Because American propoganda.
Alifatisk 4y ago
> If I was forced to pick one government to share my secrets with, it would be the Chinese, because there's nothing they can do about it. Unless you live or visit there. Wasn’t there reports of China having concentration camps?
- ilyt 4y ago
  Obviously if someone would pick China it was because they were not planning to visit there
didericis 4y ago
> If I was forced to pick one government to share my secrets with, it would be the Chinese, because there’s nothing they can do about it. What makes you so sure about that? I worry about China because there’s no internal checks to prevent them from doing anything. Western governments and allies have a long culture of court systems and thinking about balancing constituent needs. That is eroding and becoming more dangerous to the extent western leaders are envious of dictatorial powers and trying to emulate Chinese totalitarianism, but there is a lot of institutional and cultural bulwark against it. Any powerful totalitarian country should worry people. People underestimate the level of covert aggression in all facets of foreign involvement in regimes with no internal accountability.
- Cthulhu_ 4y ago
  > What makes you so sure about that? I think the commenter means that China can't do much about them while living where they do (e.g. the US), whereas the US based intelligence agencies can black bag them in most of the western world. Given the Snowden revelations, I don't believe there's much accountability to what the NSA and co collect and analyze. Secret courts, CIA dark sites, Gitmo, all kinds of things that might be legal according to the letter of the law, but feel immoral and unjust (war crimes level of unjust).
  - didericis 4y ago
    The fact that we’re able to talk openly about the unaccountability of the NSA, CIA, FISA courts and Gitmo is a form of accountability that does not exist in China. I do not condone the actions of all of the US institutions and believe many are largely unaccountable, but there is still far more accountability in our least accountable institutions than any in China. Culture within institutions, the populace at large from which institutions hire from, and the history of institutions is a very important but subtle factor that westerners take for granted and is not identical between countries. The fact that we even call US actions war crimes is another form of accountability China lacks. China forcibly annexed Tibet. China has concentration camps in inner Mongolia. China massacred it’s own people during the Mao era and is run by the same party today. China releases dams upstream of cities and drowns its own people. China committed war crimes in its support of North Korea during the Korean War, and Vietnam in the Vietnam War. China turned hundreds of its college students into mincemeat in Tiananmen square. These are not on the radar of most people in China the same way Gitmo and Iraq and Vietnam are in the US because the CCP has a level of unaccountability westerners do not understand. Their stranglehold on media and public perception is extreme, and they have been exerting influence on western social media like reddit, youtube, and facebook, as well as google search. They do so through virtually all corporations that want access to Chinese labor and the Chinese market. The ramifications of this are severe. The lockdown policies that have destroyed a lot of the global economy were pushed on the world by pressure from China (and our own fear and incompetence), despite existing pandemic plans in western nations that were far more sane, more humane, and less destructive. They were able to get us to discard our own pandemic plans from our own institutions because of the influence they have been gaining. China exerted influence over the WHO recommendations, and was very aggressive/in PR panic mode when the virus first escaped. Our own internal division is largely our own doing, but they were extremely aggressive in the early phases of the pandemic online and greatly exacerbated western problems precisely because they knew what talking points to copy and paste for maximum division and lack of consensus. Giving them your data and more ability to influence you and people that fit your demographics online is incredibly naive and foolish, no matter how much you may dislike your own government or how valid that dislike may be.
talkingtab 4y ago
You may not have noticed this, but China is seeking to extend it's influence. By whatever means required including deadly force. There is a picture you might want to look at. Search "Tank Man". That is why people worry about China so much.
- zanellato19 4y ago
  oh, you mean like the US and its global reaching government?
eynsham 4y ago
Some people are Chinese.
cscurmudgeon 4y ago
https://amp.cnn.com/cnn/2022/12/04/world/china-overseas-police-stations-intl-cmd/index.html https://amp.cnn.com/cnn/2022/12/04/world/china-overseas-poli... Yep totally harmless. > China operating over 100 police stations across the world with the help of some host nations, report claims

ffpip 4y ago

I don't think they would release the regex used to validate the API keys since it would help people automate scanning for API keys of all supported providers on public repos on any other site using the regex given by the provider itself.

SalimoS 4y ago

I guess because some lazy people will use those regex in all other public git hosts and search engine

civopsec 4y ago

Is this blog post not the transparency part? I assume that the regex is `TC:[a-z0-9]{20}` or something uninteresting like that.