News for hackers. Stuff that matters.

A comment on Results of the GitHub Investigation.

Re:Results of the GitHub Investigation by brandon272 on Monday April 21, 2014 @04:05PM (#7623401)
It sounds like Mrs. Preston-Werner was a regular presence at the GitHub office and, according to Horvath, had extensive access to private information throughout GitHub's systems despite the fact that she wasn't an employee. If true, that should certainly be a privacy and security concern to any GitHub customer or user.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by kybernetyk on Monday April 21, 2014 @04:52PM (#7623758)
> If true, that should certainly be a privacy and security concern to any GitHub customer or user.

We left github private repo hosting when they got VC funding. Because of such a scenario where we could be competing with a company that was funded by the same VC that gave GH money.

Now in a perfect world that shouldn't be a problem because the VC should never access private user data. But well ... as you see it's not a perfect world and if a wife of an employee can browse through customer data than why shouldn't this be true for the guy who gave GH a few million dollars?

[ Parent | on HN ]
Re:Results of the GitHub Investigation by codeka on Monday April 21, 2014 @05:51PM (#7624196)
She apparently had access to employee data, not customer data. In my experience, businesses will often play a little fast-and-loose with employee data - far more so than customer data.

Though I agree it presents a bad image of GitHub's access control in general.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by atmosx on Monday April 21, 2014 @05:29PM (#7624030)
You moved into a direct competitor or you rolled up your own infrastructure?

I'm curious because if the company is not large, doesn't seem like much of a hassle having your own depository server.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by jc4p on Monday April 21, 2014 @05:41PM (#7624122)
Not the person you replied to, but we're a large company and we're using Gitlab internally, it even hooks up to LDAP which is fantastic. We still use some private Github projects too.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by kybernetyk on Monday April 21, 2014 @07:47PM (#7624768)
We rolled our own. Git hosting is pretty straight forward. And Gitlab makes it even simpler.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by matdes on Monday April 21, 2014 @05:48PM (#7624171)
Gitlab is a FOSS self hosted alternative to github.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by mhd on Monday April 21, 2014 @05:15PM (#7623941)
Wouldn't that rule out any corporation, too? Not much difference between VCs and large shareholders.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by jemeshsu on Monday April 21, 2014 @04:15PM (#7623467)
I was hoping Github would address this. But the whole post is about HR issues and having an inclusive work environment.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by jamesaguilar on Monday April 21, 2014 @04:40PM (#7623667)
There was never much chance that they were going to be completely open about their findings. It would only made an eventual lawsuit against them more likely to succeed, while likely not doing anything to make people feel better about what happened. The removal of TPW is a pretty huge move either way.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by debt on Monday April 21, 2014 @04:27PM (#7623562)
Yeah I'm curious about this myself. Doesn't this create a pretty serious security situation? GitHub isn't a small startup anymore, I would assume they'd have some pretty serious security precautions in place.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by TazeTSchnitzel on Monday April 21, 2014 @04:39PM (#7623654)
They also handle plenty of trade secrets, I'd bet. They have private repos.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by drgath on Monday April 21, 2014 @06:02PM (#7624252)
With so many self-hosted Github alternatives, and even Github Enterprise (self-hosted Github), I don't feel sorry for anyone having trade secrets stolen if they were hosting via private repos on Github.com.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by awnird on Monday April 21, 2014 @04:21PM (#7623523)
This is incredibly troubling. How can anyone trust GitHub, knowing that non-employees regularly had access to private information?
[ Parent | on HN ]
Re:Results of the GitHub Investigation by GauntletWizard on Monday April 21, 2014 @05:08PM (#7623887)
What about de-facto board members? Tom was on GitHub's board, it was/is a small company, I don't get how "founder's wife" is not a suitably trusted position. I mean, clearly a bad call in this case, but hindsight is 20/20, and in my small business the husbands of my co-founders are de-facto employees (And in fact board members with significant proxy voting power, simply by state law of common property).

Edit: I looked it up; California, too, is a community property state. Theresa was absolutely an effective board member.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by gamblor956 on Monday April 21, 2014 @06:36PM (#7624426)
That's not how community property works. Teresa effectively owned an indivisible half of Tom's Github stock via the community property laws, but this does not make her a board member. Board members are selected by the company pursuant to various legal mechanisms not subject to community property laws because a board position is not a "property."
[ Parent | on HN ]
Re:Results of the GitHub Investigation by dsl on Monday April 21, 2014 @05:43PM (#7624141)
You should really get a better lawyer.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by wankerrific on Monday April 21, 2014 @06:08PM (#7624283)
Most corporate startup lawyers have founder's spouses sign release forms for to clearly indicate that they do not have some claim to ownership or equity.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by cmapes on Monday April 21, 2014 @11:31PM (#7625640)
This.

I just drafted a stock purchase agreement for my business partner and I on our new startup and one of the basic boilerplate additions to the stock purchase / vesting agreement is a spousal agreement to the terms of the purchase.

The communal property law only relates during a divorce were the shares are split up between the couple by the courts. Any decently written stock purchase agreement has a first right of refusal for the company to purchase back those shares in the event of an involuntary transfer.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by brandon272 on Monday April 21, 2014 @04:26PM (#7623555)
Well, we don't know that. It's an allegation by one person which hasn't been confirmed as being true by GitHub. And presumably after this incident, if it is true, they'll have better security policies going forward.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by theorique on Monday April 21, 2014 @05:13PM (#7623918)
This is incredibly troubling. How can anyone trust ${CLOUD_OR_HOSTING_COMPANY}, knowing that ${PERSONS_OR_SOFTWARE} regularly had access to private information?

Be paranoid. Encrypt it if you don't want people to snoop.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by onotarti on Monday April 21, 2014 @04:37PM (#7623636)
In my experience it is pretty common for people who bring work home with them not to be super-meticulous about preventing access to the content of the work by their families. How many people do you know who sound-proof their home office so their wife can't eavesdrop on their business calls?
[ Parent | on HN ]
Re:Results of the GitHub Investigation by epochwolf on Monday April 21, 2014 @04:51PM (#7623751)
I think I should point out this is a fireable offense in a number of companies. I work with sensitive information every day. I'm pretty sure if allowed someone outside the company to use my machine for anything, I would be fired.

My dad works for IBM doing mainframe repair and installation. He's seen his coworkers fired for allowing unauthorized individuals to use their company laptops. They've gone even further in the last few years in making unauthorized software a fireable offense.

Granted, two data points isn't a lot but there are companies that have enforced policies to prevent sensitive information from leaking.

I should also point out both my dad and I do significant amounts of work from home and we are both required by our companies to use full disk encryption.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by danielweber on Monday April 21, 2014 @04:58PM (#7623809)
Without going to the extreme of secret+ classifications -- in which case you cannot take things home without a secure home office, and move things between them in secure containers -- I don't think employees are fired for failing to lock their home office against their spouse or soundproofing their office against their spouse.

Which is different from saying that the company would fire them if the spouse used their inside-access to harm the company in any way.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by rhizome on Monday April 21, 2014 @04:54PM (#7623770)
My girlfriend works on disclosure projects at a company you've heard of and who regularly has highly-anticipated announcements. I have no idea what she works on, even when she's working from home in the same room as me[1].

1. http://www.officedepot.com/a/browse/laptop-privacy-filters/N...

[ Parent | on HN ]
Re:Results of the GitHub Investigation by dfc on Monday April 21, 2014 @04:47PM (#7623712)
I think that people that can and do bring work home are employed in fields where one does not need to be super meticulous about preventing access to the work.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by kfcm on Monday April 21, 2014 @09:35PM (#7625235)
You would think wrong.

Very wrong.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by dfc on Monday April 21, 2014 @10:54PM (#7625505)
You know a lot of people that bring work home because the living room has better reading light than the SCIF?
[ Parent | on HN ]
Re:Results of the GitHub Investigation by sliverstorm on Monday April 21, 2014 @11:44PM (#7625681)
No, people bring work home because they need to put in some extra hours, but do not wish to stay at the office until 9PM.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by dfc on Tuesday April 22, 2014 @12:11PM (#7628523)
So you know a lot of people that take things out of the SCIF because they do not want to stay late?
[ Parent | on HN ]
Re:Results of the GitHub Investigation by sliverstorm on Tuesday April 22, 2014 @03:34PM (#7629857)
Depends on what you mean by SCIF. Coworkers bring confidential paperwork/documents home, and remote access over remote desktop software is blessed. However you might get a phonecall from security if you started downloading lots of confidential data directly to your home computer.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by brandon272 on Tuesday April 22, 2014 @12:14AM (#7625766)
There's a pretty big difference between sound proofing your office and giving your wife unfettered access to the corporate network.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by nfoz on Monday April 21, 2014 @04:57PM (#7623803)
How can you "trust" GitHub knowing that employees regularly have access to private information?
[ Parent | on HN ]
Re:Results of the GitHub Investigation by mindslight on Monday April 21, 2014 @04:49PM (#7623733)
Why does anyone trust _______, knowing that employees regularly have access to your private information?
[ Parent | on HN ]
Re:Results of the GitHub Investigation by marshray on Monday April 21, 2014 @05:16PM (#7623950)
That's the $BB++ cloud question, isn't it?

In short, many vendors go to great expense to vet, audit, and limit the number of employees who could potentially access customer data. Some will geo-locate physically separate systems under separate administration according to regional necessity.

Disclosure: works for such a vendor.

[ Parent | on HN ]
Re:Results of the GitHub Investigation by mindslight on Monday April 21, 2014 @10:29PM (#7625419)
Sure, but this can only be appreciated if the relationship is large enough to have an explicit non-changeable contract and routine auditing. From any lone consumer's point of view, "cloud" providers are black boxes that will probably try to limit the damage a rogue employee can do, but any methods or promises can change overnight based on business needs.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by _delirium on Monday April 21, 2014 @08:29PM (#7624972)
Especially knowing that x% of those employees will have left the company in 5 years, and y% of those will have taken private copies of customer data with them.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by venomsnake on Monday April 21, 2014 @05:35PM (#7624080)
i don't trust them. I simply have no choice.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by carlosdp on Monday April 21, 2014 @04:31PM (#7623601)
I thought the allegation was she had access to internal chat, not customer data.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by bryanlarsen on Monday April 21, 2014 @04:42PM (#7623681)
Access to internal chat may have given her access to much of GitHub through HuBot. https://hubot.github.com/
[ Parent | on HN ]
Re:Results of the GitHub Investigation by malandrew on Tuesday April 22, 2014 @01:56AM (#7626059)
Access to emails is one thing. Access to the internal public banter and coordination of work hardly strikes me as worrying based on all the discussions I've seen at my current place of work and past places of work. Any information sensitive enough to keep from your significant other is probably too sensitive for a shared internal conversation system available to all employees. Yeah, there's stuff that you wouldn't want your competitors to know, but for most everyone else with no skin in the business/industry is fairly irrelevant information.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by bryanlarsen on Tuesday April 22, 2014 @09:55AM (#7627616)
HuBot let's githubbers deploy code to production, amongst lots of other things. In other words, access to internal chat is a much bigger deal at GitHub than it is at your workplace.
[ Parent | on HN ]
Re:Results of the GitHub Investigation by malandrew on Tuesday April 22, 2014 @02:10PM (#7629304)
I would certainly hope that you can only tell hubot to do something like that if you have the correct permissions. Hubot should not be accepting deploy code commands from anyone except those with the sufficient privileges. If that isn't the case, that needs to be fixed asap.
[ Parent | on HN ]