4 ms·

> state level actors having the ability to do this Not just nation state actors, but basically anyone in a position to MITM. Also, you don't have to be a nati

by LeonM 4y ago

> state level actors having the ability to do this Not just nation state actors, but basically anyone in a position to MITM. Also, you don't have to be a nation state actor to extort a GH employee. Any bad guy can do a "give me this key or I'll hurt your kid". People are being extorted for a lot less. There are billions of dollars of assets flowing through GH's infrastructure, for the sake of safety (!= security) of Github's employees, nobody should ever have access to key material.

palijer 4y ago
>There are billions of dollars of assets flowing through GH's infrastructure Do you mean source code here? I have a hard time believing source code holds that much value.
- nicoburns 4y ago
  > As of January 2023, GitHub reported having over 100 million developers and more than 372 million repositories, including at least 28 million public repositories If there are ~350 million private repos then they'd only need to be worth an average of $30 each to be worth a billion dollars in total. Which doesn't seem farfetched.
  - explaininjs 4y ago
    Considering the looooong tail of these repos are forks with no changes, sample code, toy projects abandoned after a single commit, etc. etc., I'd say it's pretty far fetched. For proof, try searching for a mundane string in GH Code search. The vast majority of repos you see will be basically garbage.
  - palijer 4y ago
    I think that is incredibly farfetched. If you got access to 1,000 random private Github repos, I don't think you could sell them, or otherwise utilize them for anywhere near that value, if anything.
  - iudqnolq 4y ago
    A better way of quantifying this would be to look at the impact of real life source code leaks. I'm not aware of any significant monetization of the windows source leak, for example.
- adityasaky 4y ago
  You've also got to factor in all the software that relies on projects developed primarily on GitHub.
kimburgess 4y ago
Spot on. Most people will remain absolutely rational when faced with irrational threats. The only protection against that is ensuring that condition cannot be encountered.
- Gurkenglas 4y ago
  "Obey so they don't carry out their threat." may be prescribed by classical decision theory, but I wouldn't call it rational when it's bad for you to be known to do it. I just asked classical decision theory what decision theory to pick and I think it said "take action x such that, if you do x, and everyone had known since 15:53 UTC Mar 24, 2023 that you'd do x, you'd have done as well as possible.". So what deserves to be called "rational" may be to do what the person you wish you'd always been would do.
fierro 4y ago
it doesn't take a state actor to MITM this. It takes a Wifi Pineapple advertising a fake AP and tired devs in Blue Bottle smashing `ssh-keygen -R github.com` without verifying the fingerprint. Very simple. Even easier than trying to MITM a site accessed via browser, which will probably have at least HSTS to help you out.
- Exuma 4y ago
  Excellent reference to Blue Bottle. I enjoyed visualizing this scenario.

by LeonM 4y ago

palijer 4y ago

>There are billions of dollars of assets flowing through GH's infrastructure Do you mean source code here? I have a hard time believing source code holds that much value.

nicoburns 4y ago
> As of January 2023, GitHub reported having over 100 million developers and more than 372 million repositories, including at least 28 million public repositories If there are ~350 million private repos then they'd only need to be worth an average of $30 each to be worth a billion dollars in total. Which doesn't seem farfetched.
- explaininjs 4y ago
  Considering the looooong tail of these repos are forks with no changes, sample code, toy projects abandoned after a single commit, etc. etc., I'd say it's pretty far fetched. For proof, try searching for a mundane string in GH Code search. The vast majority of repos you see will be basically garbage.
- palijer 4y ago
  I think that is incredibly farfetched. If you got access to 1,000 random private Github repos, I don't think you could sell them, or otherwise utilize them for anywhere near that value, if anything.
- iudqnolq 4y ago
  A better way of quantifying this would be to look at the impact of real life source code leaks. I'm not aware of any significant monetization of the windows source leak, for example.
adityasaky 4y ago
You've also got to factor in all the software that relies on projects developed primarily on GitHub.

kimburgess 4y ago

Spot on. Most people will remain absolutely rational when faced with irrational threats. The only protection against that is ensuring that condition cannot be encountered.

Gurkenglas 4y ago
"Obey so they don't carry out their threat." may be prescribed by classical decision theory, but I wouldn't call it rational when it's bad for you to be known to do it. I just asked classical decision theory what decision theory to pick and I think it said "take action x such that, if you do x, and everyone had known since 15:53 UTC Mar 24, 2023 that you'd do x, you'd have done as well as possible.". So what deserves to be called "rational" may be to do what the person you wish you'd always been would do.

fierro 4y ago

it doesn't take a state actor to MITM this. It takes a Wifi Pineapple advertising a fake AP and tired devs in Blue Bottle smashing `ssh-keygen -R github.com` without verifying the fingerprint. Very simple. Even easier than trying to MITM a site accessed via browser, which will probably have at least HSTS to help you out.

Exuma 4y ago
Excellent reference to Blue Bottle. I enjoyed visualizing this scenario.