28 ms·
Without taking away from your first paragraph at all, if any dissidents are publishing their access codes to GitHub repos, they are 1) doing it completely wrong
by sulam 4y ago
Without taking away from your first paragraph at all, if any dissidents are publishing their access codes to GitHub repos, they are 1) doing it completely wrong and 2) are already screwed.
The threat here, in the worst case, is associating a GitHub ID with a WeChat ID.
- vxNsr 4y agoQuoted from the blog post: > We have partnered with Tencent WeChat to scan for their tokens and help secure our mutual users on all public repositories and private repositories with GitHub Advanced Security. This is GitHub scanning private repos and telling WeChat about them. WeChat can already scan public repos. They are not already screwed if they’re publishing something to a private repo, it might be the wrong way to do it, but it doesn’t mean they’re already screwed. If you don’t trust GitHub’s private repo security then why are you using it in the first place?
- aeyes 4y agoWrong, this only applies to public repos. https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning#about-secret-scanning https://docs.github.com/en/code-security/secret-scanning/abo...
- vxNsr 4y agoObviously you’re wrong or the article is wrong… I’m gonna lean on you being wrong as the article is coming from GitHub and you’re not GitHub.
- aeyes 4y agoFor private repos it is opt-in requiring the Advanced Security license: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security https://docs.github.com/en/get-started/learning-about-github...