Comment by stopthe
17 hours ago
So often recent breaches involve Github in one way or another. How is it still considered a sane choice to host anything proprietary there? If your business is built around open source, ok, put a mirror on Github. But CI/CD, gitops, FDEs' stuff have no place on a public cloud. C-level execs may not know bits from bytes, but by now they should've understood that this is akin to storing ammonium nitrate in the open air.
This wasn't GitHub's fault in any way.
Github personal access tokens are security footguns. This is an apparently old and forgotten image containing a token from 2023 and it the token gets you admin acces to their repos.
So many security breaches involve Linux in one way or another. Your argument doesn't really work.
That was not an attack on Github itself. GH made enormous impact in the open source movement and is still beneficial for every software engineer by providing a free and very useful service.
Meanwhile, for a software business, Github is a wide and deep attack vector and nobody seems to be concerned about it.
Of course the same can be said about any other public git hosting, especially if it combines CI/CD, artifact distribution, identity and trust management.
So many security breaches involve the internet in some way. Maybe we should just turn it off.