I don't think this is necessarily true. Microsoft's org, like any large org, has a large number of users with access. Its security is dependent on each one of those many accounts being secure.

A smaller org, or an individual, can secure their repositories much more easily as there's fewer entrypoints.

They haven't mentioned whether this hack was achieved by compromising individual account credentials, or by compromising the Github platform itself. If it's the latter, you may be right, but I suspect it's more likely the former.

Ultimately, your weakest point ends up being humans who are prone to mistakes. You can mitigate some of those mistakes with technology but you can't mitigate all of them. So SaaS may help shore up certain attack vectors but it may increase focus on the remaining vectors and may potentially make failure points more significant (more impact for a security breach from a large provider vs less impact of a security breach from systems of independent providers). Some of that can be mitigated with smart designs, but you lose some advantage of traditional "security through obscurity" which has some value (though it shouldn't be relied on as a failsafe).

Those are only somewhat aligned, as anyone with a dispute about terms of service can tell you.

> which can be a bit much for one person who's self-hosting

If your repo serves one person, why do you need your repo to be hosted in public at all? `git init` and a backup are all you need.

What makes you think you can do a better job than Microsoft or github?

Here's the security of the "cloud":

https://arstechnica.com/information-technology/2012/03/hacke...

Why on earth should a maintained server that just runs git over ssh be less secure?

1: https://keybase.io/blog/encrypted-git-for-everyone

0: https://blog.zoom.us/wordpress/2020/05/07/zoom-acquires-keyb...

One can just encrypt the .git folder and wrap the git client to handle the encryption/decryption on use. It's always a question where and how well do you keep the keys.

You’re absolutely right about the deltas. Initially I had one secrets file per environment, but as my projects grew I ended up breaking them out to a file per environment-project. Both for storage reasons and because it’s difficult to modify one encrypted file from multiple branches without writing plaintext secrets to disk.

This, if true, is almost definitely a compromise and use of a single users' access credentials, which were then rotated (thus the attacked losing access).

I'm not saying that credential stuffing isn't a large-scale problem (I strongly believe that it is, and have even dedicated time to some potential solutions in the past), but jumping from "someone lost their credentials" to "omgz github can't be trusted!" is a bit of a disingenuous leap.

How do we have a concrete answer if this is not true?

It happened to Cisco as well a while back, I have a copy of that source somewhere.

I don't know where you are but the bulk of the jurisdictions would not look favorable upon you. I agree that your loose interpretation of the law might work out in your favor. But just like downloading copyrighted material is illegal so is downloading copyrighted data from a source that you know does not have the option to legally give you a license to copy or use that data. So from one aspect of the law you are in the clear, from another this is an open-and-shut case of copyright violation and on top of that you will have to work real hard to prove that you weren't the one to steal it in the first place using the 'upload to someplace anonymous, then download it again' trick to whitewash the data.

Some risks are worth taking, this particular one I'd think long and hard about it if the counterparty is the proverbial 800 pound gorilla.

In terms of criminal law, it is favorable to me. Source: I was criminally accused and have a court judgement clearing me of wrongdoing for possessing information that was stolen by 3rd parties and published online before I obtained it.

>So from one aspect of the law you are in the clear, from another this is an open-and-shut case of copyright violation

I am satisfied that merely possessing stolen information and not distributing or profiting from it is not a copyright violation if the source code can even be copyrighted.

>But just like downloading copyrighted material is illegal so is downloading copyrighted data from a source that you know does not have the option to legally give you a license to copy or use that data

I have not agreed to be bound by any licenses from Cisco before downloading the data nor did I necessarily know what it was before downloading a zip from a file sharing site.

I'm happy to discuss this over email if you want me to reach out for debate.

How many companies, in terms of Market Cap are currently relying on GitHub Private Repo for their source code?

And how does very large enterprise, or financial institution ( Which is like the foundation of modern day society ) handle their source code? I presume they wont use Github for anything important?