GitHub Security Lab audited DataHub: Here’s what they found
The GitHub Security Lab audited DataHub, an open source metadata platform, and discovered several vulnerabilities in the platform’s authentication and authorization modules. These vulnerabilities could have enabled an attacker to bypass authentication and gain access to sensitive data stored on the platform. ⌘ Read more

GitHub Desktop 3.2: Preview your pull request
GitHub Desktop helps you feel confident in your Git and GitHub workflows. ⌘ Read more

Why Python keeps growing, explained
A deep dive into why more people are using Python than ever, its key use cases, and why it’s still so popular 30-plus years after it was first released. ⌘ Read more

GitHub Availability Report: February 2023
In February, we experienced three incidents that resulted in degraded performance across GitHub services. This report also sheds light into a January incident that resulted in degraded performance for GitHub Packages and GitHub Pages and another January incident that impacted Git users. ⌘ Read more

GitHub Actions Importer is now generally available
We’re excited to announce the general availability of GitHub Actions Importer. GitHub Actions Importer helps you plan, forecast, and automate migrations from Azure DevOps, CircleCI, GitLab, Jenkins, and Travis CI to GitHub Actions. This product is an extension of the official GitHub CLI and is available for free to any GitHub user starting today. Migrating […] ⌘ Read more

GitHub Actions: Introducing faster GitHub-hosted x64 macOS runners
Speed up your GitHub Actions jobs on macOS with all new, faster GitHub-hosted macOS runners for x64. ⌘ Read more

How to build a consistent workflow for development and operations teams
Explore how using GitHub and HashiCorp together enables enterprises to develop and ship to their customers faster and more secure with consistent workflows and actions. ⌘ Read more

10 things you didn’t know you could do with GitHub Codespaces
Unlock the full potential of GitHub Codespaces with these 10 tips and tricks! From generating AI images to running self-guided coding workshops, discover how to optimize your software development workflow with this powerful tool. ⌘ Read more

Secret scanning alerts are now available (and free) for all public repositories
Secret scanning alerts are now generally available for all public repositories. Admins can now turn on the alert experience with one click. ⌘ Read more

3 ways to meet compliance needs without slowing down agility
Learn how to enable developer productivity and collaboration while staying secure and compliant. Stay compliant without slowing down your business. From security to CI/CD, automate every step of your software workflow—so your developers can stay focused on what matters most: building. ⌘ Read more

Measuring government policy on open source with a new dataset
Policymakers around the world are developing policies that impact how software gets built and who gets to build it, see the latest now. ⌘ Read more

The code that wasn’t there: Reading memory on an Android device by accident
CVE-2022-25664, a vulnerability in the Qualcomm Adreno GPU, can be used to leak large amounts of information to a malicious Android application. Learn more about how the vulnerability can be used to leak information in both the user space and kernel space level of pages, and how the GitHub Security Lab used the kernel space information leak to construct a KASLR bypass. ⌘ Read more

Responsible AI pair programming with GitHub Copilot
GitHub Copilot boosts developer productivity, but using it responsibly still requires good developer and DevSecOps practices. ⌘ Read more

Update on the future stability of source code archives and hashes
A look at what happened on January 30, what measures we’re putting in place to prevent surprises, and how we’ll handle future changes. ⌘ Read more

** Moon maker **
I recently re-read Peter Naur’s“Programming as theory building”. Afterwards I set out to write my own text editor. The paper posits that it’s really hard, if not impossible, to fully communicate about a program and sort of gestures at the futility of documentation…what spun around inside my head as I read was that our primary programming medium — text files — is silly. Like, some folks would totally 100% s … ⌘ Read more

So I looked up how to do it. It did not work. I Git cloned https://github.com/dgoulet/torsocks and followed the build instructions. I tried using it and got Looking up check.torproject.org1676676356 PERROR torsocks[16470]: socks5 libc connect: Connection refused (in socks5_connect() at socks5.c:202)

ICYMI: CodeQL enhancements
Learn about CodeQL’s improved user experience and enhancements that let you scan new languages, detect new types of CWEs, and perform deeper analyses of your applications. ⌘ Read more

2022 Transparency Report
Looking back over a year’s worth of developer-first content moderation and, new in this report, making our data more accessible to researchers. ⌘ Read more

Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git apply` or `git clone` against untrusted patches or repositories. ⌘ Read more

GitHub Copilot now has a better AI model and new capabilities
We’re launching new improvements to GitHub Copilot to make it more powerful and more responsive for developers. ⌘ Read more

GitHub Copilot for Business is now available
GitHub Copilot is the world’s first at-scale AI developer tool and we’re now offering it to every developer, team, organization, and enterprise. ⌘ Read more

Yout amicus: fighting for developers’ right to innovate
Our mission to accelerate human progress through developer collaboration requires us, from time to time, to fight against legal developments that would needlessly impair developers’ right to innovate. That’s why GitHub has filed an amicus brief in the appeal of Yout LLC v. Recording Industry of America, Inc. ⌘ Read more

Release Radar, Festive Edition · December 2022 – January 2023
Welcome to our special edition of the Release Radar 🎄. Between Christmas festivities, end of the year parties, Chinese New Year, or simply enjoying some time off, almost everyone has been celebrating – us too! Now we’re taking a moment to celebrate these awesome open source projects that shipped major version releases during December and […] ⌘ Read more

The technology behind GitHub’s new code search
A look at what went into building the world’s largest public code search index. ⌘ Read more

How to mitigate OWASP vulnerabilities while staying in the flow
Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities ⌘ Read more

Ludum Dare 52 staff picks 🕹
We’ve got ten top games from the latest Ludum Dare game jam plus source code for you to check out. Pun intended. ⌘ Read more

Europe’s chance to be a leader in the age of AI
Below are my prepared remarks delivered at the EU Open Source Policy Summit in Brussels on Feb 3rd. ⌘ Read more

How the GitHub Docs team uses GitHub Projects
Explore how the GitHub Docs team uses GitHub Projects for content coordination, reviews, and publishing. ⌘ Read more

Enabling branch deployments through IssueOps with GitHub Actions
What if developers want to leverage branch deployments but don’t have a full ChatOps stack integrated with their repositories? We wanted to set out to find a way for all developers to be able to take advantage of branch deployments with ease, right from their GitHub repository, and so the branch-deploy Action was born! ⌘ Read more

Announcing the launch of the All In for Maintainers DEI Resource Hub
The DEI Resource Hub is a vetted collection of resources, tools, and best practices designed to help open source maintainers create and maintain inclusive and diverse open source communities. ⌘ Read more

Open source’s impact on the world’s 100 million developers
We’re taking a look at how open source software has evolved on GitHub, and how the role of a maintainer and contributor has changed alongside the massive growth in open source software. ⌘ Read more

GitHub Availability Report: January 2023
In January, we experienced two incidents, one that resulted in degraded performance for Packages and Pages and another that impacted Git users. ⌘ Read more

Skilling for the future: How GitHub is advancing diversity, equity, and inclusion within open source communities
In the coming months, we’re scaling, expanding, and launching new programming to further DEI within open source communities. ⌘ Read more

Action needed for GitHub Desktop and Atom users
Update to the latest version of Desktop and previous version of Atom before February 2. ⌘ Read more

just found out about wiregui - https://github.com/Devsfy/wiregui
I have to test this one.

Bypassing OGNL sandboxes for fun and charities
Object Graph Notation Language (OGNL) is a popular, Java-based, expression language used in popular frameworks and applications, such as Apache Struts and Atlassian Confluence. Learn more about bypassing certain OGNL injection protection mechanisms including those used by Struts and Atlassian Confluence, as well as different approaches to analyzing this form of protection so you can harden similar systems. ⌘ Read more

Setting the foundations for compliance
Laying the groundwork for developer-enabled compliance. ⌘ Read more

100 million developers and counting
There are now 100 million developers around the world using GitHub. Here’s what this means—and why it’s just the beginning. ⌘ Read more

Introducing the GitHub Bug Bounty swag store
We’re excited to share the newest addition to our GitHub Bug Bounty Program! ⌘ Read more

Pwning the all Google phone with a non-Google bug
It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code execution and root on a Pixel 6 from an Android app. ⌘ Read more

@abucci@anthony.buc.ci So.. The issue is that its showing the password by default? Would making an alias to always include the -c help? We can probably engage Jason with a PR to enable a more hardened approach when desired. I’ve spoken to him before and is generally a pretty open to ideas.

I found this app that was created by the gopass author that does copy by default and has a tui or GUI mode https://github.com/cortex/ripasso

Unpacking the value of open source and code collaboration
We’re more excited than ever about what the future holds and the role open source will continue to play in solving critical societal challenges. ⌘ Read more

Sunsetting Subversion support
On January 8, 2024, GitHub will remove support for Subversion. ⌘ Read more

Bringing GitHub Actions to GitHub Mobile
How to tap into the power of GitHub Actions from anywhere with GitHub Mobile! ⌘ Read more

Unlocking security updates for transitive dependencies with npm
How Dependabot integrated with npm to address security vulnerabilities on transitive dependencies and increase the likelihood of success for JavaScript security updates by 40%. ⌘ Read more

How GitHub coordinates product releases with GitHub Projects and GitHub Actions
When teams work cross-functionally, good things happen. See how our teams use GitHub Projects to coordinate and ship new products and features. ⌘ Read more

@kdx@kdx.re: I suggest you to try twtwt client, it’s also written in C: https://github.com/win0err/twtwt

Remediation made simple: Introducing new validity checks for GitHub tokens
GitHub now tells you whether GitHub tokens found by secret scanning are active so you can prioritize and escalate remediation efforts. ⌘ Read more

Dependabot alerts are now visible to more developers
Default settings will allow developers with write and maintain access to see and resolve Dependabot alerts. ⌘ Read more

Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows. ⌘ Read more

3 common DevOps antipatterns and cloud native strategies that can help
Explore how GitHub and cloud native strategies can help you address common DevOps pipeline and team antipatterns. ⌘ Read more

Game Off 2022 winners 🏆
All of the winners and some of the best games from Game Off 2022. ⌘ Read more

New GitHub CLI extension tools
Support for GitHub CLI extensions has been expanded with new authorship tools and more ways to discover and install custom commands. Learn how to write powerful extensions in Go and find new commands to install. ⌘ Read more

A smarter, quieter Dependabot
Dependabot is getting a little smarter—and, a little quieter—by reducing bot-based noise from repositories based on your interaction with Dependabot. ⌘ Read more

Passwordless deployments to the cloud
Discovering passwords in our codebase is probably one of our worst fears. But what if you didn’t need passwords at all, and could deploy to your cloud provider another way? In this post, we explore how you can use OpenID Connect to trust your cloud provider, enabling you to deploy easily, securely and safely, while minimizing the operational overhead associated with secrets (for example, key rotations). ⌘ Read more

Introducing required workflows and configuration variables to GitHub Actions
Now, you can standardize and enforce CI/CD best practices across all repositories in your organization to reduce duplication and secure your DevOps processes. ⌘ Read more

GitHub Discussions just got better with Category Forms!
Category Forms allow maintainers to create templates for their GitHub Discussions, which means that users can start new discussions with all the necessary information already included. ⌘ Read more

Default setup: A new way to enable GitHub code scanning
Default setup is a new way to automatically set up code scanning on your repository, without the use of a .yaml file. ⌘ Read more

GitHub Availability Report: December 2022
In December, we did not experience any incidents that resulted in degraded performance across GitHub services. This report sheds light into an incident that impacted customers using GitHub Packages and GitHub Pages in November. ⌘ Read more

GitHub and the Ekoparty 2022 Capture the Flag
Learn about the design behind, and solutions to, several of GitHub’s CTF challenge for Ekoparty’s 2022 event! ⌘ Read more

GitHub’s top 10 blog posts of 2022
As the year winds down, we’re highlighting some of the incredible work from GitHub’s engineers, product teams, and security researchers. ⌘ Read more

What’s with all the ducks?
What in the world do rubber ducks have to do with programming? And why were they everywhere at GitHub Universe? A lot of you asked, so I’m here to help explain. ⌘ Read more

@prologic@twtxt.net see where its used maybe that can help.
https://github.com/sour-is/ev/blob/main/app/peerfinder/http.go#L153

This is an upsert. So I pass a streamID which is like a globally unique id for the object. And then see how the type of the parameter in the function is used to infer the generic type. In the function it will create a new *Info and populate it from the datastore to pass to the function. The func will do its modifications and if it returns a nil error it will commit the changes.

The PA type contract ensures that the type fulfills the Aggregate interface and is a pointer to type at compile time.

GitHub Gives 2022: Creating positive, lasting contributions in our communities
This year, we took GitHub Gives, our company-wide giving campaign, to new heights and wanted to share our learnings to provide best practices in programming a successful hybrid giving campaign for employees. ⌘ Read more

Increase developer productivity, save time on developer onboarding, and drive ROI in 2023
Forrester’s Total Economic Impact™ study dives into how GitHub Enterprise Cloud and GitHub Advanced Security help businesses drive ROI, increase developer productivity, and save time on developer onboarding. ⌘ Read more

How we use GitHub to be more productive, collaborative, and secure
Our engineering and security teams have done some incredible work in 2022. Let’s take a look at how we use GitHub to be more productive, build collaboratively, and shift security left. ⌘ Read more

I switched from twtxt client to twtwt (https://github.com/win0err/twtwt). It’s a pre-alpha version now, but it works pretty well and so much faster than the official twtxt client by @buckket@buckket.org. Feel free to check it out :-)

one that i think is pretty interesting is building up dependent constraints. see here.. it accepts a type but requires the use of a pointer to type.

https://github.com/sour-is/ev/blob/main/pkg/es/es.go#L315-L325

[Video] How has open source changed in the last 10 years?
What’s the state of open source and how has it changed over the last decade? GitHub’s VP of Developer Relations, Martin Woodward, tackles that question and more in a 2022 keynote. ⌘ Read more

Release Radar · November 2022 Edition
We promised we’d be back soon and here we are! There has been an incredible amount of open source projects shipping major version releases before the year wraps up. I can’t believe we are all saying that now. “When the year wraps up!” or “See you next year!” What happened to 2022? Well, we know […] ⌘ Read more

Leaked a secret? Check your GitHub alerts…for free
GitHub now allows you to track any leaked secrets in your public repository, for free. With secret scanning alerts, you can track and action on leaked secrets directly within GitHub. ⌘ Read more

GitHub Advanced Security customers can now push protect their custom patterns
With just one click, admins in GitHub Advanced Security organizations can protect their custom patterns on push. ⌘ Read more

Raising the bar for software security: next steps for GitHub.com 2FA
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Learn more about our approach, when we’ll begin our rollout, and what you can expect as we begin requiring 2FA. ⌘ Read more

Creating an accessible search experience with the QueryBuilder component
GitHub’s search inputs have several complex accessibility considerations. Let’s dive into what those are, how we addressed them, and talk about the standalone, reusable component that was ultimately built. ⌘ Read more

Highlights from Git 2.39
Another new release of Git is here to end the year! Take a look at some of our highlights on what’s new in Git 2.39. ⌘ Read more

Release Radar · October 2022 Edition
Before you say it, yes, the October Release Radar was supposed to be shared in November. But with Hackatoberfest, GitHub Universe, Turkey Day, and in real life (IRL) conferences returning to their pre-COVID frequency, we’ve all been so busy. And our community has been hustling to ship all kinds of open source projects. We wanted […] ⌘ Read more

I started reading the proposal to introduce operator overloading in Go version 2 that I like to see: https://github.com/golang/go/issues/27605 Now a few hours later I ended up at this gem. Write a program that makes 2+2=5: https://codegolf.stackexchange.com/questions/28786/write-a-program-that-makes-2-2-5 There are some awesone solutions. :-)

Experiment: The hidden costs of waiting on slow build times
How much does it really cost to buy more powerful cloud compute resources for development work? A lot less than you think. ⌘ Read more

Git Commit Uruguay: Lowering barriers to make software development more inclusive and diverse
We delivered two different courses specifically designed to help students in the lowest-income neighborhood of Montevideo, Uruguay learn how to use GitHub and understand the value of open source. ⌘ Read more

Hello from GitHub’s new Chief Product Officer
GitHub is in an exciting phase of our journey as the developer community grows significantly every day, and the needs of the community grow and change with it. Today we’re introducing our new Chief Product officer. ⌘ Read more

Circling back to the IsPreferred method. A hasher can define its own IsPreferred method that will be called to check if the current hash meets the complexity requirements. This is good for updating the password hashes to be more secure over time.

func (p *Passwd) IsPreferred(hash string) bool {
	_, algo := p.getAlgo(hash)
	if algo != nil && algo == p.d {

		// if the algorithm defines its own check for preference.
		if ck, ok := algo.(interface{ IsPreferred(string) bool }); ok {
			return ck.IsPreferred(hash)
		}

		return true
	}
	return false
}

https://github.com/sour-is/go-passwd/blob/main/passwd.go#L62-L74

example: https://github.com/sour-is/go-passwd/blob/main/pkg/argon2/argon2.go#L104-L133

Hold up now, that example hash doesn’t have a $ prefix!

Well for this there is the option for a hash type to set itself as a fall through if a matching hash doesn’t exist. This is good for legacy password types that don’t follow the convention.

func (p *plainPasswd) ApplyPasswd(passwd *passwd.Passwd) {
	passwd.Register("plain", p)
	passwd.SetFallthrough(p)
}

https://github.com/sour-is/go-passwd/blob/main/passwd_test.go#L28-L31

Here is an example of usage:

func Example() {
	pass := "my_pass"
	hash := "my_pass"

	pwd := passwd.New(
		&unix.MD5{}, // first is preferred type.
		&plainPasswd{},
	)

	_, err := pwd.Passwd(pass, hash)
	if err != nil {
		fmt.Println("fail: ", err)
	}

	// Check if we want to update.
	if !pwd.IsPreferred(hash) {
		newHash, err := pwd.Passwd(pass, "")
		if err != nil {
			fmt.Println("fail: ", err)
		}

		fmt.Println("new hash:", newHash)
	}

	// Output:
	//  new hash: $1$81ed91e1131a3a5a50d8a68e8ef85fa0
}

This shows how one would set a preferred hashing type and if the current version of ones password is not the preferred type updates it to enhance the security of the hashed password when someone logs in.

https://github.com/sour-is/go-passwd/blob/main/passwd_test.go#L33-L59

I made a thing. Its a multi password type checker. Using the PHC string format we can identify a password hashing format from the prefix $name$ and then dispatch the hashing or checking to its specific format.

GitHub Copilot is generally available for businesses
GitHub Copilot for Business is officially here with simple license management, organization-wide policy controls, and industry-leading privacy—all for $19 USD per user per month. ⌘ Read more

GitHub Availability Report: November 2022
In November, we experienced two incidents that resulted in degraded performance across GitHub services. This report also sheds light into an incident that impacted Codespaces in October. ⌘ Read more

New npm features for secure publishing and safe consumption
Now you can create tokens with fine-grained permissions for automating your publishing and organization management workflows. And a new code explorer allows you to view content of a package directly in the npm portal. ⌘ Read more

ICYMI: A look back at GitHub Universe 2022
Catch up on everything we announced and see what else happened during this year’s GitHub Universe conference that took place November 9-10. ⌘ Read more

GitHub, accessibility, and the disability divide
We just published our vision for GitHub accessibility at accessibility.github.com. Here’s the TL;DR: the prime directive of the GitHub accessibility program is to empower people with disabilities to build cool technology. ⌘ Read more

Introducing Mona Sans and Hubot Sans
Learn how to use and express yourself with GitHub’s open source variable fonts, Mona Sans and Hubot Sans. ⌘ Read more

How empowering developers helps teams ship secure software faster
AppSec expert Niroshan Rajadurai says putting developers at the center of everything will enable you to meet your security goals. ⌘ Read more

An enterprise account is coming to all Enterprise customers
Administrators, or enterprise owners, have the increased responsibility of managing their account and keeping it secure. We are excited to introduce what is new with enterprise accounts and what is coming soon. ⌘ Read more

To infinity and beyond: enabling the future of GitHub’s REST API with API versioning
We’re introducing calendar-based versioning for our REST API, so we can keep evolving our API, whilst still giving integrators a smooth migration path and plenty of time to update their integrations. ⌘ Read more

git-bug

Distributed, offline-first bug tracker embedded in git, with bridges

Interesting!

Exciting New GitHub Features Powering Machine Learning
Discover the exciting enhancements in GitHub that empower Machine Learning practitioners to do more. ⌘ Read more

Octoverse 2022: 10 years of tracking open source
How is open source changing the world and impacting businesses? In this year’s Octoverse report, we identified three big trends to watch. ⌘ Read more

The power of GitHub in the palm of your hand
GitHub Mobile helps keep work going while you’re going. Untether yourself from your office. ⌘ Read more

A better way to search, navigate, and understand code on GitHub
Reading code is a hugely important task for developers. That’s why we built GitHub’s new code search—to help developers search, navigate, and understand code written by them, their team, and the world. ⌘ Read more

The journey of your work has never been clearer
In July, we launched the general availability of GitHub Projects, and now we are excited to bring you even more features designed to make it easier to plan and track in the same place you build! ⌘ Read more

Oh wow! 😳 Looks like Mastodon are planning to add support for Twtxt in Add support for Twtxt protocol 😅