Beehaw
  • Communities
  • Create Post
  • search
    Search
  • Login
  • Sign Up
communism ( communism@lemmy.ml )  to Open Source@lemmy.ml · 2 years ago

Anyone can Access Deleted and Private Repository Data on GitHub

trufflesecurity.com

external-link
message-square
8
link
fedilink
  • cross-posted to:
  • hackernews@lemmy.smeargle.fans
143
external-link

Anyone can Access Deleted and Private Repository Data on GitHub

trufflesecurity.com

communism ( communism@lemmy.ml )  to Open Source@lemmy.ml · 2 years ago
message-square
8
link
fedilink
  • cross-posted to:
  • hackernews@lemmy.smeargle.fans
Anyone can Access Deleted and Private Repository Data on GitHub ◆ Truffle Security Co.
trufflesecurity.com
external-link
You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way.
alert-triangle
You must log in or # to comment.
  • MajorHavoc ( MajorHavoc@programming.dev ) 
    link
    fedilink
    arrow-up
    59
    ·
    edit-2
    2 years ago

    Misleading title.

    If my thing was public in the past, and I took it private, the old public code is still public.

    That’s… How the Internet works anyway.

    Edit: See Eager Eagle’s better explanation below.

    TL;DR - be careful who you allow to fork your private repos. And if you need to take a public repo, which has forks, private, consider archiving the repo and doing all the new work in a new repo. Which is arguably the reasonable thing to do anyway.

    Still a misleading title. This isn’t a way to break into all or even most of your private repositories.

    • hedgehog ( hedgehog@ttrpg.network ) 
      link
      fedilink
      arrow-up
      11
      ·
      2 years ago

      Misleading title.

      The title literally spells out the concern, which is that code that is in a private or deleted repository is, in some circumstances, visible publicly.

      What title would you propose?

      If my thing was public in the past, and I took it private, the old public code is still public.

      The “Accessing Private Repo Data” section covers a situation where code that has always been private becomes publicly visible.

  • youmaynotknow ( jjlinux@lemmy.ml ) 
    link
    fedilink
    arrow-up
    6
    ·
    2 years ago

    Just this week I migrated all my repos from github to Gitlab. And only because I can’t host my own gits just yet, but will do it soon enough.

    • 🇦🇺𝕄𝕦𝕟𝕥𝕖𝕕𝕔𝕣𝕠𝕔𝕠𝕕𝕚𝕝𝕖 ( muntedcrocodile@lemm.ee ) 
      link
      fedilink
      English
      arrow-up
      4
      ·
      2 years ago

      I tried but they demanded a phone number and credit card for “verification” and fuck that.

      • ReversalHatchery ( ReversalHatchery@beehaw.org ) 
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 years ago

        Also endless verification of you have resistfingerprinting on.

        • 🇦🇺𝕄𝕦𝕟𝕥𝕖𝕕𝕔𝕣𝕠𝕔𝕠𝕕𝕚𝕝𝕖 ( muntedcrocodile@lemm.ee ) 
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 years ago

          Thats probably what did it. Guess when given the options of let us track you or provide your real identity for us to track you. The option of fucking off is best.

    • sorter_plainview ( sorter_plainview@lemmy.today ) 
      link
      fedilink
      arrow-up
      4
      ·
      2 years ago

      Im using a raspberry pi with a binary installation of Forgejo. Pretty easy to set up if you are comfortable with the terminal.

      • youmaynotknow ( jjlinux@lemmy.ml ) 
        link
        fedilink
        arrow-up
        1
        ·
        2 years ago

        I’ve been migrating all my services hosted in UnRaid to ProxMox these last days, but Forgejo is absolutely on my list of new services to selfhosted. Thanks for the tip bud.

Open Source@lemmy.ml

opensource@lemmy.ml

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !opensource@lemmy.ml

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

  • Open Source Initiative
  • Free Software Foundation
  • Electronic Frontier Foundation
  • Software Freedom Conservancy
  • It’s FOSS
  • Android FOSS Apps Megathread

Rules

  • Posts must be relevant to the open source ideology
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

  • !libre_culture@lemmy.ml
  • !libre_software@lemmy.ml
  • !libre_hardware@lemmy.ml
  • !linux@lemmy.ml
  • !technology@lemmy.ml

Community icon from opensource.org, but we are not affiliated with them.

Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 255 users / day
  • 705 users / week
  • 2K users / month
  • 4.48K users / 6 months
  • 867 local subscribers
  • 49.4K subscribers
  • 3.01K Posts
  • 23.3K Comments
  • Modlog
  • mods:
  • Evan ( Cloak@lemmy.ml ) 
  • kevincox ( kevincox@lemmy.ml ) 
  • CrypticCoffee ( CrypticCoffee@lemmy.ml ) 
  • Lettuce eat lettuce ( Lettuceeatlettuce@lemmy.ml ) 
  • BE: 0.19.15
  • Modlog
  • Legal
  • Instances
  • Docs
  • Code