Github: when deleted is not deleted and private not private - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: July 26, 2024, 01:16:20 pm
content: Good to know if you're using Github:- Anyone can Access Deleted and Private Repository Data on GitHub:https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github

author: brucehoult
author_rank: Super Contributor
timestamp: July 26, 2024, 01:34:38 pm
content: That's just how any git repo works. Deleting a branch only deletes the entry in.git/refs/headsit doesn't delete any commits or trees. If you can find the hash -- for example from yourreflog-- then you can always resurrect it. At least until agit gc. Which is always very infrequent and github never does.And, as the article notes, you can only do this if the repo was public at some point, and someone forked it, and you can find that fork.The "guessing a short hash" thing only works if you're looking at a fork of the original, not just some random repo.I used basically this technique to resurrect the RISC-V draft 0.7.1 gcc branch  after the branch was (cynically, I think) deleted in the official repo after RVV 1.0 was ratified. I found the hash in some old notes from when I was implementing RVV in the Spike emulator and writing RVV example code to test it in 2019. needed for programming THead C906/C910 until they recently published an updated gcc version, and eventually got it merged into gcc 14https://github.com/brucehoult/riscv-gnu-toolchain(obsolete since gcc 14 release, unless you are allergic to addingth.prefix to all the instructions)

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 26, 2024, 08:44:58 pm
content: Don't use github.

author: magic
author_rank: Super Contributor
timestamp: July 26, 2024, 08:57:01 pm
content: Don't use git, period. You can change your legal sex, age, name and everything, butgit logwill still deadname you. I dunno what people expect from something that came from Linus.

author: golden_labels
author_rank: Super Contributor
timestamp: July 26, 2024, 10:03:08 pm
content: Konstantin Ryabitsev “Cross fork object sharing in git is not a bug” (Jan 2022)Too bad Truffle Security took sensationalistic angle, rises up a corpse and puts it into new clothes. It could’ve been a reasonable reminder.The part of the article really worth reading is at the bottom: the “Implications” heading. Instead of article’s general “your data will leak” fearmongering, it focuses on more substantive concerns. Receiving impossible to understand false positives from security scans, GitHub processing data despite an order to stop doing so, and the general muddiness of the solution.

author: Siwastaja
author_rank: Super Contributor
timestamp: July 27, 2024, 03:22:18 pm
content: Read halfway through it. Some idiotic sensationalism, is there finally some real problem?What blast from the past. So someone accidentally posted their private key / password / titpic / dickpic publicly on the internets and someone else took a copy (or "forked") it before they could delete it. What are you supposed to do as service provider? Yellow media and concerned citizens demanded censorship of the Internet and other totally impractical measures to somehow prevent this mistake. This was in early 2000's. We learned back then there is no other way than never do this mistake; and if you do, you suffer. Since freaking 2008 or so, yellow media has been telling people that once you put something online,you can't delete it.Now even normal people have pretty much understood not to post sensitive information publicly on the internet (and be very careful where to post it), and have stopped blaming others for their own mistakes. Is it too much to expect from freakingprogrammersto do the same?

author: magic
author_rank: Super Contributor
timestamp: July 27, 2024, 03:43:31 pm
content: Quote from: Siwastaja on July 27, 2024, 03:22:18 pmWith a little math and science, anyone can learn to code. Maybe you don't need to understand the concept of "distributed, immutable directed acyclic graph" to write JavaScript

author: DiTBho
author_rank: Super Contributor
timestamp: July 27, 2024, 04:18:04 pm
content: Quote from: SiliconWizard on July 26, 2024, 08:44:58 pmwhat is the alternative?I am considering ... ummm, a privategit server, running on mac-mini/intel at home

author: JPortici
author_rank: Super Contributor
timestamp: July 27, 2024, 04:42:47 pm
content: Quote from: DiTBho on July 27, 2024, 04:18:04 pmthis! i run gitea instances, at home in a VM (waiting to shell out for a NAS/Home server) and at work in a dedicated machine.. or forejo as gitea foundation has started having some questionable behaviouryoudoknow everything you upload to github is being used to train copilot, right?

author: brucehoult
author_rank: Super Contributor
timestamp: July 27, 2024, 07:41:32 pm
content: Quote from: DiTBho on July 27, 2024, 04:18:04 pmWhat do you mean by "git server"?Any machine that has a git repo on it, that you can access as a file server, or by ssh, or by http, is a "git server".For example I'm working on a project called "merv" on my Windows machine. It is located at~/projects/mervin Ubuntu on WSL. It of course has a.gitdirectory inside it, as well as the checked-out files.So I can just do this on my Mac (or on on Raspberry Pi, or one of my RISC-V boards .. whatever):Code:Mac-mini:~ bruce$ git clone wsl:projects/mervCloning into 'merv'...remote: Enumerating objects: 3, done.remote: Counting objects: 100% (3/3), done.remote: Compressing objects: 100% (2/2), done.remote: Total 3 (delta 0), reused 0 (delta 0), pack-reused 0Receiving objects: 100% (3/3), done.Mac-mini:~ bruce$That works simply because I can "ssh wsl". No other setup required.No special "server" needed. That's the entire point of git. It's a distributed version control system, not a centralised one like CVS or SVN or most others that came before it. Any user can push or pull branches or commits from any other user.

author: DiTBho
author_rank: Super Contributor
timestamp: July 28, 2024, 03:21:36 am
content: Quote from: brucehoult on July 27, 2024, 07:41:32 pmgit server exposed to the internetmeansweb-git interface, therefore it also implies http server, running PHP/Python mod + PHP/Python programsSSHd, exposed to the internet(optionally) GITd exposed to the internethigh security policies (1)a system to collect { requests, notes, comments, bugs reports, ... } usually using a PHP/Python mod (2)a way to provide and manage pull requests (3)(1) if you expose on the internet, you have to pay much more attention, and they are things that with distros like Gentoo you don't find already set up, you necessarily have to review carefully and in every single detail, so say "I'll make a git server" that only runs in your own infranet and never goes on the public internet, it makes a huge difference also in how to compile and configure each single dependency.(2) git itself only allows you associate your email with your commits, which is nice, but then you still need something to public interesting comments, notes, and various bug issues.(3) "pull request" is not features of Git itself, it's a feature offered by Github. So, you need to provide a similar mechanism!This, because usually, you do not have permission to clone and push someone else's repository on the internet, so you "fork" it into your own Github repositoryThen you can clone your own Github repository and push your commits thereIf you want your commits to go into the original author's repository, you first define another origin for that repository - called "upstream" - and then you send a "pull request"

author: DiTBho
author_rank: Super Contributor
timestamp: July 28, 2024, 03:29:41 am
content: Quote from: brucehoult on July 27, 2024, 07:41:32 pmsure, when you compile from sources, there are flags to be enabledCode:dev-vcs/git blksha1 curl gpg iconv nls pcre perl safe-directory webdav cgi cvs doc highlight keyring mediawiki perforce selinux subversion test tk xinetd+webdav: Adds support for push'ing to HTTP/HTTPS repositories via DAV+ cgi: Install gitweb too...

author: DiTBho
author_rank: Super Contributor
timestamp: July 28, 2024, 03:38:43 am
content: Code:git config --global user.email "<...@...>"git config --global user.name "<....>"

author: DiTBho
author_rank: Super Contributor
timestamp: July 28, 2024, 03:45:37 am
content: GITd: exposing to internet, also impliesGit-on-the-Server-Git-Daemon.

author: mfro
author_rank: Regular Contributor
timestamp: July 28, 2024, 08:42:44 am
content: A strange article, IMHO.If you don't want to have something publicly available, you probably shouldn't put it on a service whose main purpose is to make things publicly available first place.

author: DiTBho
author_rank: Super Contributor
timestamp: July 28, 2024, 11:48:54 am
content: Quote from: mfro on July 28, 2024, 08:42:44 amyes it's a bit contradictory, but that's how it is...