It used to be that it would only nag you to sign up or log in when trying to view extended profile attributes. Now it just requires you to log in to even view someone's name and function. It shows up in the search results alright, some day I should find a UA changer to spoof Google and see if they do IP checking or just UA header checking, but generally, they made it completely locked-in now, whereas it was semi-open (at least to view) before. It was a user-configurable setting whether your profile could be viewed by people who are not signed in, and now it's just a completely walled garden.
It's not in particular Microsoft that concerns me (although their embrace of Git, this seems inevitable for a company like that, considering its history), but that GitHub is now losing its appeal; it being independent from the big players.
as for Skype, its completely ruined. I have it installed but I am scared to open it. Horrible GUI. Constant updates and generally just useless now.
I think that's his point. He's saying that LinkedIn has the opportunity to do lots of interesting things, and appears to be squandering it.
It used to be that it would only nag you to sign up or log in when trying to view extended profile attributes. Now it just requires you to log in to even view someone's name and function. It shows up in the search results alright, some day I should find a UA changer to spoof Google and see if they do IP checking or just UA header checking, but generally, they made it completely locked-in now, whereas it was semi-open (at least to view) before. It was a user-configurable setting whether your profile could be viewed by people who are not signed in, and now it's just a completely walled garden.
It went from seemed like a ~reasonable security architecture, to outright enabling the monitoring and forwarding of all user conversations. Ugh.
I honestly don't know a single professional who still updates or cares about LinkedIn. I have no doubt that it still has the momentum from late comers and straggers, but...eh.
Mind you, it was on the outs long before Microsoft bought it. Not its fault, but it just hit the no longer novel curve.
"with the vast resources it has available to it now"
This part is almost parody, and reeks of comical self delusion (or astroturfing). It is the rally cry of how so many of Microsoft's purchases faded to black.
I, for one, would definitely stay away from any open source project that's still hosted on a Microsoft-owned GitHub.
Binaries could be backdoored, potentially, but with the trend towards deterministic reproducible builds I don't see this happening.
A hash collision in git lets you show somebody one change, then substitute it for a different change (with the same hash) in a version others see that appears (to the first person) to be the same code.
This is a very narrow opportunity. It is _probably_ viable for a very powerful adversary (such as the NSA) to successfully trick someone working with binary blobs, like firmware for a black box. You can imagine a developer who (unusually) assiduously checks the firmware they're provided to see that it works as intended, then uploads a new version to github, and the NSA trap is sprung, they substitute a modification with the same hash but different firmware that, perhaps, causes your billion dollar spy satellite to point its cameras at the sun, destroying it.
But if the developer is less assiduous this was all pointless, just send the "burn spy sat" firmware to the original developer and lie.
Or if the spy camera owners decide not to take this mysterious last-minute update, or they try it on their ground-based prototype first to check it works... bzzt, your hugely expensive SHA-1 trick was a waste of time.
Yes, SHA-1 is broken. Nobody should use it for anything new, and things that already use it should have been migrating already _before_ the official announcement from Google et al. But, Merkle-Damgard hashes have done this before, and will do it again, and so we know how this goes. You get a collision but don't get anything else, critically you don't get second-pre-image.
This means, the NSA doesn't gain a way to substitute other stuff in a repo. They can only _collide_ their own things, by carefully choosing the inputs. So a plan where you just replace the _real_ firmware can't work.
Also, the nature of this MD attacks smashes up the input state, which for git will usually be source code. A mysterious anonymous contributor is surprising enough, but when their proposed patch adds dozens of bytes of what seems to be binary noise, you know something is up. That's why my example attack above involved firmware, where this might be less suspicious.
So yes, Git should have transitioned off SHA-1, and a window of opportunity for bad guys does exist, but it's not the sort of gaping window you imagine.
I had the same problem. Microsoft Live process didn't feel very intuitive or smooth either.
More mitigation work is just what i needed. The skype one took years, many failures, and resulting in the use of several tools instead of one. Not a win.
It's not a big deal, it's just work that I don't want to do. Espacially since I love github.
And combining that data with LinkedIn’s data would be valuable indeed.
There, Microsoft shines. So, we will just have to wait and see what they do. My guess is the main thing they will do is make it super easy to deploy to azure from the github UI.
At some point Microsoft told me I had to change my password for Skype. The "Reset your password" process failed 6 times in a row. I eventually had to create a new, Microsoft ID, to use Skype. I lost all of my old contacts and had to slowly recreate my address book. This is really one of the worst transitions I can recall.
Meanwhile, I act as adviser to a number of entrepreneurs, and the biggest trend of the last year has been "I want to do _______ for professionals, since LinkedIn isn't doing it." The lost opportunities for LinkedIn are very sad.