5 ms·

> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who c

> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable. I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked. BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you must trust all of your data with the one provider, who might go belly up at any point and take it with them. Yes, GitHub provides some fantastic social features and helps with community involvement through these features, but if you are dependant on a "single service" and you're using a DSCM/DVCS, you should probably look at a few alternatives to reduce that dependancy.

ricardobeat 15y ago
People use services like GitHub because they provide security, reliability, uptime, protection against hw failure, centralized issues and patches, and so on. If we have to worry about each of these on our pwn, what's the point?
- elithrar 15y ago
  > If we have to worry about each of these on our pwn, what's the point? You should always have to worry about these things, regardless of who's hosting things. It just so happens that Github, to date, has been checking the boxes in these areas and has established a reputation for doing so. But, if GitHub losing your repo/having it trashed beyond repair will kill your project (or severely hamper it), the cost of setting up a second Git server and a couple of hooks to mirror your push is very low, in both dollars and man-hours.
  - maratd 15y ago
    That's not how git works. I have the entire repo locally. If I didn't, I wouldn't be able to commit anything. So if Github goes poof, I'd be pissed, but I wouldn't lose a single line of code. I would obviously lose things like issues/wiki. Actually, it would be pretty cool if Github turned issues/wiki into some sort of git repo of markdown files and allow me to pull them and commit to them. Something for them to think about =)
    - jcoder 15y ago
      That is how Github wikis work. Don't have my laptop here, but I think the tab/link is "git access"
- augustl 15y ago
  Akin's law #2: To design a spacecraft right takes an infinite amount of effort. This is why it's a good idea to design them to operate when some things are wrong. I think there's some truth to that :) Source: http://spacecraft.ssl.umd.edu/akins_laws.html http://spacecraft.ssl.umd.edu/akins_laws.html
stickfigure 15y ago
I don't think anyone is dreadfully concerned about service availability - although that is certainly a concern. The problem is that source code is incredibly valuable and often represents many man-years of effort. A competitor could use this to bypass a lot of the early architectural fumbling around that we all do. Also, source code often contains passwords and shared secrets like Facebook secret keys. Disclosure wouldn't be the end of the world, but it could certainly be disastrous for a lot of companies.
- rdl 15y ago
  Do people actually host confidential code on Github, vs. open source projects? I'm worried about the integrity of open source projects, but not really their confidentiality.
  - stickfigure 15y ago
    According to https://github.com/about https://github.com/about, they have 59 employees and have never taken VC. Since the opensource projects don't pay, the math suggests that yes, quite a lot of organizations are paying to host confidential code. FWIW, we do.
augustl 15y ago
I agree wholeheartedly. I always facepalm when people aren't able to work because the internet is down (read: no github access). Just start an SSH server, netcat some keys around (or use an USB stick), and get back to work again :) Transmitting files via Google's email servers from two computers on the same network in the same office in the same room, especially if you're in europe (ridicilously far away from GMail's servers) instead of directly between the computers on the local network is one of my main pet peeves..
- ktizo 15y ago
  LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.
  - augustl 15y ago
    I guess it's just about familiarity. We do have the tools (mdns/avahi/bonjour, tcp/netcat, ...). But the internet is usually up, so we don't need to learn how to set up our own local servers, and there's no punishment for transmitting a file across the atlantic when it could have been transferred to another room in the same building and back again.
    - ktizo 15y ago
      The fact that there is not persistent caching of mission dependent code and data as a fundamental commercial standard shows how badly we as a species in general can judge risk, even when the stakes are really high.
      - icebraining 15y ago
        How so? Each git user has a local copy of the whole repository.
        ktizo 15y ago
anthonyb 15y ago
You can get your code out, but what about all of the rest of your data? Wiki, issues, pull requests, etc. Update: Apparently it's doable with some API magic, but you still have to handroll your exporter: http://www.lornajane.net/posts/2011/github-api-issues-list http://www.lornajane.net/posts/2011/github-api-issues-list

ricardobeat 15y ago

People use services like GitHub because they provide security, reliability, uptime, protection against hw failure, centralized issues and patches, and so on. If we have to worry about each of these on our pwn, what's the point?

elithrar 15y ago
> If we have to worry about each of these on our pwn, what's the point? You should always have to worry about these things, regardless of who's hosting things. It just so happens that Github, to date, has been checking the boxes in these areas and has established a reputation for doing so. But, if GitHub losing your repo/having it trashed beyond repair will kill your project (or severely hamper it), the cost of setting up a second Git server and a couple of hooks to mirror your push is very low, in both dollars and man-hours.
- maratd 15y ago
  That's not how git works. I have the entire repo locally. If I didn't, I wouldn't be able to commit anything. So if Github goes poof, I'd be pissed, but I wouldn't lose a single line of code. I would obviously lose things like issues/wiki. Actually, it would be pretty cool if Github turned issues/wiki into some sort of git repo of markdown files and allow me to pull them and commit to them. Something for them to think about =)
  - jcoder 15y ago
    That is how Github wikis work. Don't have my laptop here, but I think the tab/link is "git access"
augustl 15y ago
Akin's law #2: To design a spacecraft right takes an infinite amount of effort. This is why it's a good idea to design them to operate when some things are wrong. I think there's some truth to that :) Source: http://spacecraft.ssl.umd.edu/akins_laws.html http://spacecraft.ssl.umd.edu/akins_laws.html

stickfigure 15y ago

I don't think anyone is dreadfully concerned about service availability - although that is certainly a concern. The problem is that source code is incredibly valuable and often represents many man-years of effort. A competitor could use this to bypass a lot of the early architectural fumbling around that we all do. Also, source code often contains passwords and shared secrets like Facebook secret keys. Disclosure wouldn't be the end of the world, but it could certainly be disastrous for a lot of companies.

rdl 15y ago
Do people actually host confidential code on Github, vs. open source projects? I'm worried about the integrity of open source projects, but not really their confidentiality.
- stickfigure 15y ago
  According to https://github.com/about https://github.com/about, they have 59 employees and have never taken VC. Since the opensource projects don't pay, the math suggests that yes, quite a lot of organizations are paying to host confidential code. FWIW, we do.

augustl 15y ago

I agree wholeheartedly. I always facepalm when people aren't able to work because the internet is down (read: no github access). Just start an SSH server, netcat some keys around (or use an USB stick), and get back to work again :) Transmitting files via Google's email servers from two computers on the same network in the same office in the same room, especially if you're in europe (ridicilously far away from GMail's servers) instead of directly between the computers on the local network is one of my main pet peeves..

ktizo 15y ago
LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.
- augustl 15y ago
  I guess it's just about familiarity. We do have the tools (mdns/avahi/bonjour, tcp/netcat, ...). But the internet is usually up, so we don't need to learn how to set up our own local servers, and there's no punishment for transmitting a file across the atlantic when it could have been transferred to another room in the same building and back again.
  - ktizo 15y ago
    The fact that there is not persistent caching of mission dependent code and data as a fundamental commercial standard shows how badly we as a species in general can judge risk, even when the stakes are really high.
    - icebraining 15y ago
      How so? Each git user has a local copy of the whole repository.
      - ktizo 15y ago

anthonyb 15y ago

You can get your code out, but what about all of the rest of your data? Wiki, issues, pull requests, etc. Update: Apparently it's doable with some API magic, but you still have to handroll your exporter: http://www.lornajane.net/posts/2011/github-api-issues-list http://www.lornajane.net/posts/2011/github-api-issues-list