3 ms·

Is there any reason for GitHub to hide this information though? How could it be used against them? (I understand many companies default to not expose any infor

Is there any reason for GitHub to hide this information though? How could it be used against them? (I understand many companies default to not expose any information unless forced otherwise.)

toast0 1y ago
The rate of creation is like meh, but being able to enumerate all of the repos might be problematic, following new repos and scanning them for leaked credentials could be a negative... but github may have a feed of new repos anyway? Also, having a sequence implies at least a global lock on that sequence during repo creation. Repo creation could otherwise be a scoped lock. OTOH, it's not necessarily handled that way --- they could hand out ranges of sequences to different servers/regions and the repo id may not be actually sequential.
- colechristensen 1y ago
  >following new repos and scanning them for leaked credentials could be a negative People do this. GitHub started doing it too so now you get a nice email from them first instead of another kind of surprise.
  - mdaniel 1y ago
    Email, bleh, I'm sure I'm not the only one who basically /dev/null's emails from github about pearl-clutching "security" but I wanted to point out that for quite a few providers they actually have an integration to revoke them if found in a public repo, which I think is way more handy https://docs.github.com/en/code-security/secret-scanning/secret-scanning-partnership-program/secret-scanning-partner-program#the-secret-scanning-process https://docs.github.com/en/code-security/secret-scanning/sec... and the list is way bigger than I recalled: https://docs.github.com/en/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#default-patterns https://docs.github.com/en/code-security/secret-scanning/int...
    - colechristensen 1y ago
      You can turn those GitHub security warnings off if you don't want them. >quite a few providers they actually have an integration to revoke them if found in a public repo, which I think is way more handy Yes I've also gotten an email from Amazon saying they revoked a key someone inadvertently leaked (but so long ago I only remember that it happened). I read my AWS emails at least.
- 4hg4ufxhy 1y ago
  What would be the issue with global lock? I think repo creation is a very rare event when measured in computer time.
- progval 1y ago
  > but github may have a feed of new repos anyway? Yes: https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#list-public-repositories https://docs.github.com/en/rest/repos/repos?apiVersion=2022-... (you can filter to only show repositories created since a given date).
  - tough 1y ago
    and using their obscure graphql api, you can do the same for -new commits- across any repos. they have some secret leaking infra for enterprise
xboxnolifes 1y ago
Companies usually hide this type of information so competitors have a harder time determining if they are growing/shrinking/neutral.
- dietr1ch 1y ago
  And engineers thinking of scale would usually try to steer away from a sequential id because of self inflicted global locking and hot spots.
- blitzar 1y ago
  Companies usually hide this type of information so VC's / stonk investors will give them more money.

Is there any reason for GitHub to hide this information though? How could it be used against them? (I understand many companies default to not expose any information unless forced otherwise.)

toast0 1y ago

The rate of creation is like meh, but being able to enumerate all of the repos might be problematic, following new repos and scanning them for leaked credentials could be a negative... but github may have a feed of new repos anyway? Also, having a sequence implies at least a global lock on that sequence during repo creation. Repo creation could otherwise be a scoped lock. OTOH, it's not necessarily handled that way --- they could hand out ranges of sequences to different servers/regions and the repo id may not be actually sequential.

colechristensen 1y ago
>following new repos and scanning them for leaked credentials could be a negative People do this. GitHub started doing it too so now you get a nice email from them first instead of another kind of surprise.
- mdaniel 1y ago
  Email, bleh, I'm sure I'm not the only one who basically /dev/null's emails from github about pearl-clutching "security" but I wanted to point out that for quite a few providers they actually have an integration to revoke them if found in a public repo, which I think is way more handy https://docs.github.com/en/code-security/secret-scanning/secret-scanning-partnership-program/secret-scanning-partner-program#the-secret-scanning-process https://docs.github.com/en/code-security/secret-scanning/sec... and the list is way bigger than I recalled: https://docs.github.com/en/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#default-patterns https://docs.github.com/en/code-security/secret-scanning/int...
  - colechristensen 1y ago
    You can turn those GitHub security warnings off if you don't want them. >quite a few providers they actually have an integration to revoke them if found in a public repo, which I think is way more handy Yes I've also gotten an email from Amazon saying they revoked a key someone inadvertently leaked (but so long ago I only remember that it happened). I read my AWS emails at least.
4hg4ufxhy 1y ago
What would be the issue with global lock? I think repo creation is a very rare event when measured in computer time.
progval 1y ago
> but github may have a feed of new repos anyway? Yes: https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#list-public-repositories https://docs.github.com/en/rest/repos/repos?apiVersion=2022-... (you can filter to only show repositories created since a given date).
- tough 1y ago
  and using their obscure graphql api, you can do the same for -new commits- across any repos. they have some secret leaking infra for enterprise

xboxnolifes 1y ago

Companies usually hide this type of information so competitors have a harder time determining if they are growing/shrinking/neutral.

dietr1ch 1y ago
And engineers thinking of scale would usually try to steer away from a sequential id because of self inflicted global locking and hot spots.
blitzar 1y ago
Companies usually hide this type of information so VC's / stonk investors will give them more money.