this post was submitted on 24 Jul 2024
225 points (95.5% liked)

Open Source

31129 readers
404 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
Cloak@lemmy.ml
kevincox@lemmy.ml
CrypticCoffee@lemmy.ml
Lettuceeatlettuce@lemmy.ml
225
Anyone can Access Deleted and Private Repository Data on GitHub (trufflesecurity.com)
submitted 3 months ago by communism@lemmy.ml to c/opensource@lemmy.ml
41 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] MajorHavoc@programming.dev 79 points 3 months ago* (last edited 3 months ago) (2 children)

Misleading title.

~~If my thing was public in the past, and I took it private, the old public code is still public.~~

That's... How the Internet works anyway.

Edit: See Eager Eagle's better explanation below.

TL;DR - be careful who you allow to fork your private repos. And if you need to take a public repo, which has forks, private, consider archiving the repo and doing all the new work in a new repo. Which is arguably the reasonable thing to do anyway.

Still a misleading title. This isn't a way to break into all or even most of your private repositories.

[–] morph3ous@lemmy.world 29 points 3 months ago (1 children)

That is not exactly what they are saying. You could create a private fork of a public repo and the code in your private fork is publicly accessible.

[–] eager_eagle@lemmy.world 28 points 3 months ago

I don't think you can create private forks from public repos (the fork is public upon creation). This is more like the opposite:

If there's a private repo that is forked and the fork is made public, further changes to that original private repo become public too, despite the repo remaining private and the fork not being synced.

[–] hedgehog@ttrpg.network 12 points 3 months ago (1 children)

Misleading title.

The title literally spells out the concern, which is that code that is in a private or deleted repository is, in some circumstances, visible publicly.

What title would you propose?

If my thing was public in the past, and I took it private, the old public code is still public.

The “Accessing Private Repo Data” section covers a situation where code that has always been private becomes publicly visible.

[–] where_am_i@sh.itjust.works 1 points 3 months ago

the title is dyslexic at best