3 ms·

Is it GitHub's responsibility to protect their users from their own stupidity? I'd argue it's not, but the issue creates such bad PR that it'd be prudent for t

Is it GitHub's responsibility to protect their users from their own stupidity? I'd argue it's not, but the issue creates such bad PR that it'd be prudent for them to add some sort of check. However, it should probably be a bit more nuanced than killing search :)

fnordfnordfnord 14y ago
I'm guessing it's a temporary attempt to give users some time to clean up the mess they've made for themselves.
- RaphiePS 14y ago
  From a quick check of their homepage and blog, I found no mention of the issue. If they were indeed giving the users a "grace period," wouldn't they want to publicize that?
  - alxndr 14y ago
    Still putting together the approach to take?
confluence 14y ago
It's not stupidity. It's statistics. There' s 1 million plus in projects, 2 million plus in repositories, and 1 million plus in users using the product over a stretch of nearly 5 years. If those searches had uncovered no passwords whatsoever - now that would be surprising. This is just what would be expected - just by sheer chance. And yes - it is Github's responsibility to protect its users from their own stupidity. Github's sole value is in its community - any of the technical issues that they have to deal with are commodity and have already been dealt with before else where. Github's net worth is in its community good will and path dependence. Killing search for now is the right decision to keep the gravy train running.
danso 14y ago
Well think of it this way. If a high profile hack occurs because of this, even though we all know it's the fault of the committing developers, what do you think the tech headlines are going to be: "Poor software engineering practices lead to exposed vulnerabilities again" Or: "Hackers use Github to launch destructive attack on tech companies' databases"? That kind of headline would make it especially hard for code teams to convince corporate IT to let them have a github account, even for private repos. Github did the most sensible thing...it's too hard to come up with a provably effective filter that prevents the compromise of inadvertently exposed data.

fnordfnordfnord 14y ago

I'm guessing it's a temporary attempt to give users some time to clean up the mess they've made for themselves.

RaphiePS 14y ago
From a quick check of their homepage and blog, I found no mention of the issue. If they were indeed giving the users a "grace period," wouldn't they want to publicize that?
- alxndr 14y ago
  Still putting together the approach to take?

confluence 14y ago

It's not stupidity. It's statistics. There' s 1 million plus in projects, 2 million plus in repositories, and 1 million plus in users using the product over a stretch of nearly 5 years. If those searches had uncovered no passwords whatsoever - now that would be surprising. This is just what would be expected - just by sheer chance. And yes - it is Github's responsibility to protect its users from their own stupidity. Github's sole value is in its community - any of the technical issues that they have to deal with are commodity and have already been dealt with before else where. Github's net worth is in its community good will and path dependence. Killing search for now is the right decision to keep the gravy train running.

danso 14y ago

Well think of it this way. If a high profile hack occurs because of this, even though we all know it's the fault of the committing developers, what do you think the tech headlines are going to be: "Poor software engineering practices lead to exposed vulnerabilities again" Or: "Hackers use Github to launch destructive attack on tech companies' databases"? That kind of headline would make it especially hard for code teams to convince corporate IT to let them have a github account, even for private repos. Github did the most sensible thing...it's too hard to come up with a provably effective filter that prevents the compromise of inadvertently exposed data.