GitHub Source Code Leak

Hi folks, I&#x27;m the CEO of GitHub.<p>GitHub hasn&#x27;t been hacked. We accidentally shipped an un-stripped&#x2F;obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago. It shares code with github.com. As others have pointed out, much of GitHub is written in Ruby.<p>Git makes it trivial to impersonate unsigned commits, so we recommend people sign their commits and look for the &#x27;verified&#x27; label on GitHub to ensure that things are as they appear to be.<p>As for repo impersonation – stay tuned, we are going to make it much more obvious when you&#x27;re viewing an orphaned commit.<p>In summary: everything is fine, situation normal, the lark is on the wing, the snail is on the thorn, and all&#x27;s right with the world.

Commit message was &quot;felt cute, might put gh source code on dmca repo now idk&quot; <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201104050026if_&#x2F;https:&#x2F;&#x2F;github.com&#x2F;github&#x2F;dmca&#x2F;tree&#x2F;565ece486c7c1652754d7b6d2b5ed9cb4097f9d5" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201104050026if_&#x2F;https:&#x2F;&#x2F;github...</a>

It&#x27;s unlikely this is a &quot;leak&quot; per se - the source code can be straightforwardly recovered from the trial version of Github Enterprise, see e.g. <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13875993" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13875993</a> or (more comments) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13346866" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13346866</a><p>EDIT: Anyone looking to try doing this, please support open alternatives instead: <a href="https:&#x2F;&#x2F;gitea.io&#x2F;en-us&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gitea.io&#x2F;en-us&#x2F;</a>

OP mirror <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201105011435&#x2F;https:&#x2F;&#x2F;resynth1943.net&#x2F;articles&#x2F;github-source-code-leak&#x2F;" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201105011435&#x2F;https:&#x2F;&#x2F;resynth19...</a><p>Zipped source (140 MB) mirror <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201104050247&#x2F;https:&#x2F;&#x2F;codeload.github.com&#x2F;github&#x2F;dmca&#x2F;zip&#x2F;565ece486c7c1652754d7b6d2b5ed9cb4097f9d5" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201104050247&#x2F;https:&#x2F;&#x2F;codeload....</a>

Stated without proof: I firmly believe this is related to the youtube-dl takedown. Look at the repo it was committed to as well as the timing.<p>Similar things happened with Sony over Other OS. Sadly I bet there will be further attacks and leaks as time goes on here.

It is a bit sad that the dmca repo gets targeted, because it&#x27;s an optional extra that github is doing to show publicly when DMCA notices are received.

I saw Github&#x27;s code as a consultants years ago, and I always thought it was crazy that they would ship the whole thing to us. But then I thought, how many employees do they have? Probably enough that security should not rely on the secrecy of the code anymore.

It never sat well with me how GitHub itself was not open-source. Is it a fundamental mistrust of the very technology that made the platform possible?

Whenever I&#x27;ve worked on large proprietary products we would joke we should leak our source to tie up our competitors for years trying understand it...

&gt; impersonating Nat Friedman using a bug in GitHub&#x27;s application.<p>This is not a bug, it&#x27;s a part of how Git fundamentally works. If you want to mitigate it you have to sign your commits. GitHub <i>could</i> only attribute commits in the UI if they&#x27;re signed, but I suspect that this is considered too much friction to enable.

The reasons the guy who says leaked it:<p><a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;jnpufo&#x2F;using_the_same_trick_as_the_one_with_youtubedl_i&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;jnpufo&#x2F;using_t...</a><p>Using the same trick as the one with youtube-dl, I uploaded the entire GitHub backend source code to GitHub&#x27;s own DMCA repo. Maybe now not only GitHub can have the chance to fix the &quot;bug&quot;, but the entire community as well? ;)

I&#x27;m guessing this is just a dump of the GitHub Enterprise source? Apparently it&#x27;s never been all that hard to decrypt - e.g. <a href="https:&#x2F;&#x2F;gist.github.com&#x2F;iscgar&#x2F;e8ea7560c9582e4615fcc439177e22b7" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;iscgar&#x2F;e8ea7560c9582e4615fcc439177e2...</a>

Has anyone gotten this running? I&#x27;d thought it might be easy since it uses Docker, but docker-compose appears to be trying to pull a dependency called &quot;git-daemon-server&quot; from a URL that requires authentication.

&gt; Some users, such as Drew DeVault, suggest Microsoft is attempting to centralise open-source.<p>Of course Drew DeVault thinks this way. He&#x27;s trying to monetize his own github-like product, the sourcehut, so less people using GitHub means more people using sourcehut.

1) It is extremely unlikely that this was actually pushed to the github&#x2F;dmca repo. Github has a bug where you can make commits to forked&#x2F;&quot;networked&quot; repo&#x27;s appear as if they&#x27;re in the original repo.<p>2) They most certainly did not &quot;impersonat[e] Nat Friedman using a bug in GitHub&#x27;s application&quot;; they impersonated him using a design feature in Git.

What are the business risks to a company like Github when their source code has been released in the wild? Startups treat their code like IP, but I imagine it&#x27;d still be incredibly difficult for a competitor to try and build the same tool&#x2F;features even if they have the code as a &quot;cheat sheet&quot; of sorts. Are there other risks (i.e. security vulnerabilities) it causes?

Now maybe someone will actually make a &quot;hack&quot; with a UI that looks like this...<p><a href="https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;De17PIKXUAE27W6.jpg:large" rel="nofollow">https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;De17PIKXUAE27W6.jpg:large</a><p>...and show that making it work in any browser, even text-based ones (as far as possible), is not hard.

&gt; We accidentally shipped an un-stripped&#x2F;obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago.<p>I&#x27;d love to hear more about that.

A classy move here would be to make a bunch PRs to fix bugs in the codebase, inspiring Nat and Co. to just Open Source it all :) I know nothing about their revenue model of how it relies on proprietary code, of course, but it&#x27;s fun to imagine.

What is the legality of &#x2F;looking&#x2F; at this code in order to study how a large corporation with a large code base writes a Rails app?<p>I&#x27;d love to study it but not if just viewing it is a gray area

There&#x27;s a really strange phenomenon that I experience on the internet where I think news is much older than it really. This is quite a striking example of that. I read this title today and immediately thought &quot;that&#x27;s old news&quot;. But it turns out that I read this only yesterday and in comment, not even an article. It&#x27;s strange how my brain seems to store this information quickly, but doesn&#x27;t have enough time to timestamp it.

I wouldn&#x27;t say it was a bug in GitHub&#x27;s application that allowed someone to impersonate Nat, it&#x27;s just that the author of the commit (which can be changed easily&#x2F;set manually in git) matched his name&#x2F;email.<p>How many people can actually push to that repo? I wonder if it would be easy to figure out who actually did it...

Can we finally see wich WebComponents are being used now? Github forcing WebComponents is a serious design flaw.

Github, via extension of its owner Microsoft, is owned by some of the most regressive, monopolistic, oligarchic&#x2F;kleptocratic, big-finance forces on the planet - the likes of Blackrock, Berkshire, Gates, etc. It is very much in their interest to centralize and control open source&#x2F;free software (free as in freedom), and they have a well established track record of doing just that, by any means necessary. To say it more poignantly: Microsoft is a direct driver of perverse wealth inequality, endless wars and centralisation of power which effectively destroys any resemblance of democracy everywhere. Behind the clean corporate facade, they are just another mafia. If you support this system - by hosting your code on Github and buying MS products - you are de-facto supporting this techno-dictatorship.

Tangentially lated<p>I&#x27;m wondering when one of the 1000s of services with write access to 100s of thousands of github run repos gets hacked or tokens expropriated and lots of repos suddenly get malicious commits.<p>I saw the headline and assumed this was a leak of someone else&#x27;s source via stolen tokens.

<a href="https:&#x2F;&#x2F;anonfiles.com&#x2F;Jax980m9p6&#x2F;dmca-565ece486c7c1652754d7b6d2b5ed9cb4097f9d5_zip" rel="nofollow">https:&#x2F;&#x2F;anonfiles.com&#x2F;Jax980m9p6&#x2F;dmca-565ece486c7c1652754d7b...</a>

I had always heard GitHub was running on Rails - but I always thought &quot;sure some section of it is&quot;. Not ALL on rails - with models and controllers in there.

Is there a torrent for this?

Is there an open-source alternative to GitHub that has all of the (A) Features and (B) UI Niceness that GitHub had 10 years ago?

Tbh I think it&#x27;s quite interesting that the by far biggest open source platform is in itself not open source. Why?

it looks like they have already taken the source code down, which sucks cause i would have LOVED to look at it. github has some of the smartest developers in the world working for them and i would love to pour over the code and see the thought process involved in creating the github backend.

If anyone wants to share their thoughts on the code quality I would be happy to read them.

I don&#x27;t suspect I&#x27;ll ever see a more ironic headline in my entire life.

Now that the damage is done, GitHub can go release the source code and own it.

Probably de-obfuscated source code from a Github Enterprise vm

What&#x27;s up with all this source codes leaking online?

Would downloading a local copy be considered illegal?

Lots of small perl oneliners for a ruby shop :)

Wait Github isn&#x27;t open source? The irony.

Where can we find the code?

I hope that I won&#x27;t need to search in a thousand of githubs for each npm packet I need in near future.

7.5 billion dollars well spent.