3 ms·

I dunno about other people but I’ve always assumed that if we’re giving employees, who we may have to fire someday, access to the code base that repos should be

I dunno about other people but I’ve always assumed that if we’re giving employees, who we may have to fire someday, access to the code base that repos should be treated as if they could be exposed to the world at any time any way.

hakre 3y ago
This is a great baseline, but it is often easier said than done. For example, those repositories contain a lot of privately identifiable information, it is not that easy to get such a baseline ready for that _"should be treated as if they could be exposed to the world at any time any way."_ Depending on jurisdiction this can affect sensitive information that requires much stronger controls in place when you (rightfully!) expect the repository to become public despite it is a private one.
- mikeryan 3y ago
  For example, those repositories contain a lot of privately identifiable information This seems to miss my point - I have no idea why PII is in a code repo.
  - hakre 3y ago
    Those of the workforce, that is a pretty typical situation. Timestamps of activity etc. .
bob1029 3y ago
I've had to explain to leadership that certain employees don't even need access to the actual codebase to potentially cause harm via a competitor. The real solution to this is to have a business model that is about more than just some source code in a repository, or "things one person could undo". Concerns like years-long relationships with customers (aka trust), platform-style lock-in patterns, etc. How many times have various parts of AAA game studio or Microsoft codebases been compromised? I am still waiting for that hacker edition of HL3 and my free copy of windows that doesn't suck. I actually spent a few minutes walking through a hypothetical where 100% of our latest code is lifted and taken to our biggest competitor. I think it would probably cause them more harm than good. Complexity is a hell of a thing. Just having a point-in-time snapshot doesn't really give you an advantage over someone who has been at it continuously for years. Perhaps we can strike a consulting contract with whoever steals our code... I am not against reasonable measures (i.e. MFA, GH Enterprise, VPNs), but I won't go into paranoid-tier (Citrix-style desktops) over stuff like this ever again. Code is a cheap commodity in 2023. Enshrining your repository as if it is the actual vehicle of business value is indicative of poor leadership. Customers, relationships, execution, etc. are way more challenging and important.

hakre 3y ago

This is a great baseline, but it is often easier said than done. For example, those repositories contain a lot of privately identifiable information, it is not that easy to get such a baseline ready for that _"should be treated as if they could be exposed to the world at any time any way."_ Depending on jurisdiction this can affect sensitive information that requires much stronger controls in place when you (rightfully!) expect the repository to become public despite it is a private one.

mikeryan 3y ago
For example, those repositories contain a lot of privately identifiable information This seems to miss my point - I have no idea why PII is in a code repo.
- hakre 3y ago
  Those of the workforce, that is a pretty typical situation. Timestamps of activity etc. .

bob1029 3y ago

I've had to explain to leadership that certain employees don't even need access to the actual codebase to potentially cause harm via a competitor. The real solution to this is to have a business model that is about more than just some source code in a repository, or "things one person could undo". Concerns like years-long relationships with customers (aka trust), platform-style lock-in patterns, etc. How many times have various parts of AAA game studio or Microsoft codebases been compromised? I am still waiting for that hacker edition of HL3 and my free copy of windows that doesn't suck. I actually spent a few minutes walking through a hypothetical where 100% of our latest code is lifted and taken to our biggest competitor. I think it would probably cause them more harm than good. Complexity is a hell of a thing. Just having a point-in-time snapshot doesn't really give you an advantage over someone who has been at it continuously for years. Perhaps we can strike a consulting contract with whoever steals our code... I am not against reasonable measures (i.e. MFA, GH Enterprise, VPNs), but I won't go into paranoid-tier (Citrix-style desktops) over stuff like this ever again. Code is a cheap commodity in 2023. Enshrining your repository as if it is the actual vehicle of business value is indicative of poor leadership. Customers, relationships, execution, etc. are way more challenging and important.