Anyone can Access Deleted and Private Repository Data on GitHub
https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-githubOpen linkView original on lemmy.ml216
Comments39https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-githubOpen linkView original on lemmy.ml
Misleading title.
If my thing was public in the past, and I took it private, the old public code is still public.That's... How the Internet works anyway.
Edit: See Eager Eagle's better explanation below.
TL;DR - be careful who you allow to fork your private repos. And if you need to take a public repo, which has forks, private, consider archiving the repo and doing all the new work in a new repo. Which is arguably the reasonable thing to do anyway.
Still a misleading title. This isn't a way to break into all or even most of your private repositories.
That is not exactly what they are saying. You could create a private fork of a public repo and the code in your private fork is publicly accessible.
I don't think you can create private forks from public repos (the fork is public upon creation). This is more like the opposite:
If there's a private repo that is forked and the fork is made public, further changes to that original private repo become public too, despite the repo remaining private and the fork not being synced.
The title literally spells out the concern, which is that code that is in a private or deleted repository is, in some circumstances, visible publicly.
What title would you propose?
The “Accessing Private Repo Data” section covers a situation where code that has always been private becomes publicly visible.
the title is dyslexic at best
While this is still a massive problem, it does require a public fork at some point. So if you have a private repo that has never had a public fork, you should be safe.
(unforked repos that are forks are also affected.)
Yes, but only in very limited circumstances. If you:
then commits A and B are publicly visible, but commit C is not.
Per the linked Github docs:
Modifying the above situation to start with a public repo:
Commit B remains visible.
A version of this where step 3 is to take the fork private isn’t feasible because you can’t take a fork private - you have to duplicate the repo. And duplicated repos aren’t part of the same repository network in the way that forks are, so the same situation wouldn’t apply.
The second situation you listed is incredibly common, as the blog post explains.
Im thinking of self hosting Forgejo one day.
I do and it is pretty easy with docker compose.
Does it treat forks differently?
sourcehut is much better if you can pay
Edit: Only repo hosters need to pay. Everything else is free.
I want forgejo for its upcoming federation feature tbh.
Considering that git doesn’t need federation, and email is the grandfather of federation, sourcehut has a working version of it this very moment.
Why the downvotes?
I'd guess because the same argument could be made for the website you're on right now. Why use that when we could just use mailing lists instead?
More specifically: Sure, Git is decentral at its core, but all the tooling that has been built around it, like issue tracking, is not. Suggesting to go back to email, even if some projects still use it, isn't the way to go forward.
I'm sorry to be blunt, but mailing lists just suck for group conversations and are a crutch that only gained popularity due to the lack of better alternatives at the time. While the current solutions also come with their own unique set of drawbacks, it's undeniable that the majority clearly prefers them and wouldn't want to go back. There's a reason why almost everyone switched over.
What makes sourcehut better?
From a self-hosting perspective, it looks like much more of a pain to get it set up and to keep it updated. There aren’t even official Docker images or builds. (There’s this and the forks of it, but it’s unofficial and explicitly says it’s not recommended for prod use.)
It also supports browsing without JavaScript, if that's your thing.
Sourcehut has straightforward much better UI, UX, and features (more than gitea/forgejo but less than GitLab ig). I really dig the subdomain design.
Issues and PRs are conducted through email, essentially making that part federated and signup-less.
I’ve seen many pieces of software that claim to be beta/not used for prod but are actually bedrock solid.
Damn that's a huge problem
The takeaway is to not use forks if there are changes you want to keep private.
The takeaway is still https://sfconservancy.org/GiveUpGitHub/
Sounds like they wanted to find a problem but it turned out to be a feature.
Yeah, pretty much everyone agrees that once something goes to git it lasts forever.
The fact they call out that secret keys must be rotated if committed, makes me think they thought just deleting a commit was enough 🤦
a problem that is documented is obviously a feature
Just this week I migrated all my repos from github to Gitlab. And only because I can't host my own gits just yet, but will do it soon enough.
Im using a raspberry pi with a binary installation of Forgejo. Pretty easy to set up if you are comfortable with the terminal.
I've been migrating all my services hosted in UnRaid to ProxMox these last days, but Forgejo is absolutely on my list of new services to selfhosted. Thanks for the tip bud.
Codeberg is great too
Yeah, I'm just getting started, and for the life of me, haven't found how to pull the Gitlab repos from it. But I will.
I tried but they demanded a phone number and credit card for "verification" and fuck that.