I'd be interested in hearing from the cited number of people. If it's like 5 randos, then that's quite possibly a misremembering, or even conceivably the victims of some unrelated code theft. If it's a few dozen people, well that would have very different implications.

One more person:

https://news.ycombinator.com/item?id=39770776

Seems worth tracking publicly. Maybe I should create a GH rep.... er... hm...

Maybe worth posting leaked Windows, Apple, Intel, Steam, The Wicher codes on GH as private repos and then seeing who will sue whom first.

I went through my private repos and the only one I found was one where I had forked a project, called `documentation`, and my fork made it into the Software Heritage archive. Sometime between then and now I deleted my fork and cloned a private repo with the same name. I confirmed the Software Heritage archive only has the one that was public and not the private one. I feel like we'd be hearing much louder alarm bells if the Software Heritage archive included private code given how many people rely on private GitHub repos.

That person is unable to provide us with a repo name either.

Considering private repos used to require a paid subscription misremembering seems likely.

It used to be public by default, and enough people got confused by this that AWS & Github used to specifically scan repo's for accidentally public AWS credentials.

None of my private repos are included in the software heritage project.

Nor mine. But if anyone in the year 10,000 needs to run a 4-digit LED segment display as a clock with a 1st-gen Raspberry Pi, they'll have the code to do it.

That’s really funny to think about. By then today’s internet may be the equivalent of the little NES machine you can buy with all the games on it.

He said year 10,000 not year 2052 tho

This is a really big claim. I think we need specifics on this - I'm inclined to think this is people not understanding the GitHub public/private repo model (or misremembering the history of their repos) over GitHub deliberately leaking private code to third parties.

I agree that might be the case. Since I do not personally know the author, I elected to use “may” in the submission title. Hopefully we get a definitive answer from those involved.

Still, the post continues to be useful for those who want to opt-out regardless.

I would use "claim" rather than may until it's substantiated.

Reads a bit weirder, but changed.

I have personally experienced this. The person who did it didn’t realise the significance of the repo being “public only for a couple of hours”. I’m also inclined to believe it’s misremembering / misconfiguring.

I would give it a 50:50 chance.

The other option is that the scraper got lucky with a tiny glitch (whatsoever).

On the one hand I bet github does everything to keep stuff secure, on the other hand I can't believe there wasn't a single glitch in the last few years.

And if there was a glitch then regular automated scrapers are a pretty likely siphon.

Heck I should check if any of my private repository show up.....

> a tiny glitch

That's not "a tiny glitch". What you described is "GitHub may show your private repo to strangers randomly" which is a even more serious issue than they appearing in an archive some time later.

Right: exposing private source code in this way is a showstopper bug for GitHub, and a major scandal if they've been covering it up.

A lot of companies pay GitHub a LOT of money to securely host their code. A breach like this is a way bigger story than just another "AI is training on your data!" thing.

I continue to doubt that private repos being exposed like this actually happened here.