8 ms·
It sounds like Mrs. Preston-Werner was a regular presence at the GitHub office and, according to Horvath, had extensive access to private information throughout
by brandon272 13y ago
It sounds like Mrs. Preston-Werner was a regular presence at the GitHub office and, according to Horvath, had extensive access to private information throughout GitHub's systems despite the fact that she wasn't an employee. If true, that should certainly be a privacy and security concern to any GitHub customer or user.
- kybernetyk 13y ago> If true, that should certainly be a privacy and security concern to any GitHub customer or user. We left github private repo hosting when they got VC funding. Because of such a scenario where we could be competing with a company that was funded by the same VC that gave GH money. Now in a perfect world that shouldn't be a problem because the VC should never access private user data. But well ... as you see it's not a perfect world and if a wife of an employee can browse through customer data than why shouldn't this be true for the guy who gave GH a few million dollars?
- mhd 13y agoWouldn't that rule out any corporation, too? Not much difference between VCs and large shareholders.
- atmosx 13y agoYou moved into a direct competitor or you rolled up your own infrastructure? I'm curious because if the company is not large, doesn't seem like much of a hassle having your own depository server.
- jc4p 13y agoNot the person you replied to, but we're a large company and we're using Gitlab internally, it even hooks up to LDAP which is fantastic. We still use some private Github projects too.
- matdes 13y agoGitlab is a FOSS self hosted alternative to github.
- kybernetyk 13y agoWe rolled our own. Git hosting is pretty straight forward. And Gitlab makes it even simpler.
- codeka 13y agoShe apparently had access to employee data, not customer data. In my experience, businesses will often play a little fast-and-loose with employee data - far more so than customer data. Though I agree it presents a bad image of GitHub's access control in general.
- jemeshsu 13y agoI was hoping Github would address this. But the whole post is about HR issues and having an inclusive work environment.
- jamesaguilar 13y agoThere was never much chance that they were going to be completely open about their findings. It would only made an eventual lawsuit against them more likely to succeed, while likely not doing anything to make people feel better about what happened. The removal of TPW is a pretty huge move either way.
- awnird 13y agoThis is incredibly troubling. How can anyone trust GitHub, knowing that non-employees regularly had access to private information?
- onotarti 13y agoIn my experience it is pretty common for people who bring work home with them not to be super-meticulous about preventing access to the content of the work by their families. How many people do you know who sound-proof their home office so their wife can't eavesdrop on their business calls?
- dfc 13y agoI think that people that can and do bring work home are employed in fields where one does not need to be super meticulous about preventing access to the work.
- kfcm 13y agoYou would think wrong. Very wrong.
- dfc 13y agoYou know a lot of people that bring work home because the living room has better reading light than the SCIF?
- sliverstorm 13y agoNo, people bring work home because they need to put in some extra hours, but do not wish to stay at the office until 9PM.
- dfc 13y agoSo you know a lot of people that take things out of the SCIF because they do not want to stay late?
- debt 13y agoYeah I'm curious about this myself. Doesn't this create a pretty serious security situation? GitHub isn't a small startup anymore, I would assume they'd have some pretty serious security precautions in place.
- TazeTSchnitzel 13y agoThey also handle plenty of trade secrets, I'd bet. They have private repos.
- drgath 13y agoWith so many self-hosted Github alternatives, and even Github Enterprise (self-hosted Github), I don't feel sorry for anyone having trade secrets stolen if they were hosting via private repos on Github.com.
- carlosdp 13y agoI thought the allegation was she had access to internal chat, not customer data.
- bryanlarsen 13y agoAccess to internal chat may have given her access to much of GitHub through HuBot. https://hubot.github.com/ https://hubot.github.com/
- malandrew 13y agoAccess to emails is one thing. Access to the internal public banter and coordination of work hardly strikes me as worrying based on all the discussions I've seen at my current place of work and past places of work. Any information sensitive enough to keep from your significant other is probably too sensitive for a shared internal conversation system available to all employees. Yeah, there's stuff that you wouldn't want your competitors to know, but for most everyone else with no skin in the business/industry is fairly irrelevant information.
- bryanlarsen 13y agoHuBot let's githubbers deploy code to production, amongst lots of other things. In other words, access to internal chat is a much bigger deal at GitHub than it is at your workplace.
- malandrew 13y agoI would certainly hope that you can only tell hubot to do something like that if you have the correct permissions. Hubot should not be accepting deploy code commands from anyone except those with the sufficient privileges. If that isn't the case, that needs to be fixed asap.