How so? It refutes that right there in the advisory:

> Okta does not rely on the confidentiality of its source code as a means to secure its services.

Would it be more professional for them to host their code in a public repo?

It might be, yes. With the right protections on pull requests.

Did they decide that that was their strategy before or after this breach occurred?

They were trying to keep their source code secure, and they failed. Not a great look for a company that ask you to trust them with all of your user accounts.

Yes? What do they have to gain from the code not being public?

Competitive advantage?

That's not a bad point. GitHub is convenient, yes, but if you manage security for companies that are collectively worth billions, you want to minimize your attack surface.

In my experience, security is usually an afterthought in most tech companies. Just look at how many MongoDB instances in production were running on open ports with the default password, which was... no password.

At my jobs, employees routinely share passwords in Slack or use simple passwords.

Frankly, as an employee, security is not my problem.

Solving security issues and maintaining secure systems isn't your problem, but adhering to company policy most certainly is, and the policy almost certainly forbids you from sharing passwords (especially via Slack.)

Unless you're in a tiny or ass-backward company that doesn't even have a policy that covers such things.

They have a policy, but there is nobody who cares to enforce it.

It always amazes me how many companies host their source code in “the cloud” visible to external companies, accessible from the public internet, only a single bug/security vulnerability/human error away from being leaked. The companies I’ve worked for so far host their source code on their own servers, which are physically under their control, and aren’t accessible from the public internet. Add on top of it that functionally GitHub/GitLab don’t hold a candle to code review functionality of Gerrit, project management of Redmine/Jira; and the only explanation is that those companies really, really don’t want to hire 1/2 sysadmins to manage their infrastructure.

Companies host data a lot more valuable than source code in the cloud. Developers like to think we’re the center of the business, but access to a company’s Salesforce or NetSuite instance is a lot more economically valuable than access to a company’s GitHub org.

Those things are no less incredible to me than GitHub. (Also not used at the companies I’ve worked for so far.)

An alternative to using own servers, which are not feasible for every company would be isolated and encrypted GitLab/GitHub deployments as described here: https://dev.to/flxflx/setting-up-a-confidential-gitlab-333h

Companies with hundreds of sysadmins and billions of revenue or moving to the cloud... It has nothing to do with the cost of a handful of additional engineers.