4 ms·
Even among engineers, most people don't think like a security engineer. I'm sure there are plenty of people who have access to their company's private repos th
by bsimpson 3y ago
Even among engineers, most people don't think like a security engineer.
I'm sure there are plenty of people who have access to their company's private repos through their personal GitHub accounts.
- icedchai 3y agoAt every company I've worked for, past 12+ years, this has been the rule, not the exception. They invite your personal github to corporate repos.
- 0cf8612b2e1e 3y agoI have read a couple of horror stories where it then becomes impossible to separate the account once you leave the employer. No thanks. New account per job.
- icedchai 3y agoSounds like a misunderstanding. They just remove you from the org. (And if they don't, it's not your problem.)
- 0cf8612b2e1e 3y agoBut being part of an organization, don’t they have admin control over your account? Could delete all of your repos, reset your keys, access private repos, etc. Even if a tiny risk, it seems silly just to bolster the GH activity graph.
- icedchai 3y agoNo. They have control over your membership in their org and which of their repos you can access, not your repos. Note that a GitHub account can be members of multiple orgs.
- Symbiote 3y agoIf the organization has public repositories, and the ex-employee has issues/PRs in those repositories, then I think they will continue to get notifications about followups to those issues. Involvement with private repositories is removed as soon as the organization removes the employee, or the employee removes themselves. I think the horror stories could only happen if the individual's account has been used for generating many API keys or similar, but there are other reasons not to rely on that sort of thing.
- tekla 3y agoSo?