Hacker News Reader

Comment by onion2k | Hacker News Reader

First of all, physically restricting access to a local network pretty much makes the benefits of using Git redundant. Ignoring that though..

I don't think there are many companies who have the depth of info security knowledge that Github can draw upon. You might believe that running your own server and locking it down to your local network (as best your team can do that) is better, but I'd rather trust Github even if that means my code is available online. While the chance of being victim to a non-specific attack is far higher (Github is a much bigger target; I'm affected if they're attacked), the chance of someone targeting my code and actually getting it are far, far lower because Github is better at making things secure than I am, and they have people who are paid to make sure things stay that way.

A policy of only having your code on Github has it's flaws but making sure it's secure isn't one of them.

View on HN

> I don't think there are many companies who have the depth of info security knowledge that Github can draw upon

That's true and I believe in that as well. However, GitHub also poses a much larger attack surface than any single company and it's safe to assume that once someone is in, they're going to get _everything_. Apart of that, you're also vulnerable to having GitHub disgruntled employees accessing your data, and the inherent vulnerability in having a remotely accessible repo in the first place.

I think google protected your data from employees. Can't github do the same ?

It makes sense that Google protects your data from most employees, but there's always a core of employees that have everything accessible. It's probably a small operational core in Google (still probably way bigger than the entire headcount of Github).

It depends I know that old school telcos use security Vetting for people with wide access to systems and this is DV Developed Vetting or TS (in American usage)

And our Internal security team (BT Security) was bad news if you where investigated - they have a ferocious reputation

Just because they have a policy against these thing doesn't mean they don't happen:

http://www.wired.com/2010/09/google-spy/

>Google acknowledged Wednesday that two employees have been terminated after being caught in separate incidents allegedly spying on user e-mails and chats.

>David Barksdale, 27, was fired in July after he reportedly accessed the communications of at least four minors with Google accounts, spying on Google Voice call logs, chat transcripts and contact lists

>In the case of one 15-year-old boy Barksdale met through a technology group in Seattle, Washington, he allegedly tapped into the boy’s Google Voice call logs after the boy refused to tell him the name of his new girlfriend. Barksdale then reportedly taunted the boy with threats to call the girl.

>Barksdale also allegedly accessed contact lists and chat transcripts of account holders and, after one teen blocked him from his Gtalk buddy list, reversed the block. A source told Gawker that Barksdale’s intent didn’t appear to be to prey on minors for sexual purposes, but simply to goad them and impress them with his level of access and power.

> First of all, physically restricting access to a local network pretty much makes the benefits of using Git redundant.

No, it doesn't. Why should it?

> "I don't think there are many companies who have the depth of info security knowledge that Github can draw upon."

I recall at least two vulnerabilities that GitHub was exposed to. The mass-assignment one from Rails (which they didn't fix until after they were the poster-child for it), and the cross-site one, which prompted them to use github.io.

I suspect their security teams are better now but you're still taking it on faith. By using 3rd-party services, you are increasing your exposure, not diminishing it. Someone who wants to attack you specifically will do so regardless.

Parent post is not concerned with security, but with availability.

Availability is a security concern. Not as important as confidentiality and integrity, perhaps, but still within the security remit.

GitHub enterprise

Reply on news.ycombinator.com