January 2014 Summaries

GitHub has launched the GitHub Bug Bounty program to enhance the security of its services by engaging with security researchers and hackers to identify and report vulnerabilities. The program incentivizes these efforts by offering monetary rewards ranging from $100 to $5000, based on the severity and potential impact of the discovered vulnerabilities on its users. The bounty amounts are determined by factors such as the prevalence of the affected browser, with more critical vulnerabilities in widely-used browsers like Chrome earning higher rewards. Currently, the program covers a subset of GitHub's products and services, with plans to expand its scope. Further information and guidelines are available on the GitHub Bug Bounty site.

GitHub has introduced GitHub Guides, a new resource aimed at providing in-depth tutorials to assist users with complex concepts related to Git and GitHub that cannot be easily answered through a quick search. Currently, four guides are available covering topics such as understanding the GitHub workflow, getting projects onto GitHub, mastering issues, and mastering Markdown. These guides intend to focus on workflows and project communication rather than technical details like stack traces. The initiative, authored by Zach Holman, is expected to expand with more tutorials and writeups over time, similar to the existing GitHub Guides channel on YouTube.

Melissa Severini participated in the 9th installment of the Passion Projects talk series in December 2013, where she discussed the complexities of managing people within a startup environment and offered advice on emergency preparedness. The event included a panel discussion and a musical performance by Mara Hruby, with photography provided by Mona Brooks of Mona Brooks Photography. The talk and panel discussion were documented in a video, and the event was summarized by Manisha Sharma.

GitHub has expanded its image proxying strategy by including HTTPS images in addition to non-HTTPS images, using a custom node server called camo, to enhance user privacy and improve performance. This change ensures that browser information is not disclosed to third-party services, thereby protecting user privacy. By routing images through a CDN, users can expect faster load times and fewer instances of broken images on the platform. This update is part of a broader effort to enhance security and performance across GitHub, as highlighted by related open-source updates like camo SSL proxying and changes to html-pipeline.

GitHub has introduced redesigned conversations to enhance the user experience by making interactions more meaningful and streamlined. Comments are now more prominent and highlighted, while non-comment elements like commits and issue references are subdued to improve focus on essential content. Management tools for Issues and Pull Requests have been consolidated into a sidebar, allowing users to efficiently handle labels, milestones, notifications, and assignments in one place, with the ability to manage labels directly on Pull Requests. Additionally, titles and state indicators for Issues and Pull Requests have been repositioned to a more visible header for easier identification. These updates aim to improve usability and focus in navigating GitHub repositories.

In November 2013, the third annual Dodgeball Tournament was held, successfully raising funds for four non-profit organizations with contributions from participating teams. The event's highlights are captured in an accompanying video, and those interested in participating in future tournaments are encouraged to express their interest by emailing [email protected]. The announcement was made by Kami Richey, also known by the handle @kamzilla.

GitHub has enhanced the accessibility of its YouTube content by adding English closed captions to all videos on both the main GitHub channel and the GitHub Guides channel, utilizing the non-profit open-source project Amara. In addition to English, the GitHub Foundations series now features Japanese captions, marking the beginning of a broader effort to make their videos accessible to non-English speakers. The initiative seeks to engage volunteers from around the world to contribute translations in various languages through Amara’s Volunteer Platform, inviting interested individuals to join the GitHub team on Amara and use its in-browser subtitling tool to assist in this effort.

GitHub has introduced new features to streamline the management of organizations, catering to both large private companies and small open-source projects, enhancing organization, security, and ease of use. Organization owners now have the ability to add members and teams directly from the organization's profile, while a unified list of all members helps maintain oversight, including the status of two-factor authentication for private organizations. Team management has been simplified with quick search capabilities and easy exit options, emphasizing the role of teams in access control and collaboration through team mentions. These updates aim to improve the user experience and security, with ongoing updates promised for the future.

In November 2013, Ligaya Tichy delivered an inspiring talk during the 8th installment of the Passion Projects series, motivating attendees to engage in more charitable giving and providing a structured plan to enhance their philanthropic efforts in 2014. The event, enriched by a performance from Emily Jane White and captured in photographs by Mona Brooks, was well-received and memorable, with a full video of the talk and panel discussion available for viewing.

In 2014, GitHub announced a leadership change with cofounder Chris Wanstrath stepping into the role of CEO, while Tom Preston-Werner, another cofounder, assumed the position of President. This transition was made to leverage their individual strengths effectively, with Chris focusing on leading the company and defining its vision, and Tom concentrating on research, development, and growth opportunities. Despite the formalization of these roles, GitHub maintained its flexible approach to role definitions, emphasizing that titles were primarily used for clarity in communicating responsibilities internally and externally. The shift had already been informally in place for several months prior to the public announcement, and both leaders expressed enthusiasm for the company's future in the new year.

Kasima, Southgate, Muan, and Dice are hosting an evening event in Tokyo featuring food, likely pizza, and drinks, with possible talks included. The gathering will take place at Hatch Co-Work with Kids, which has generously provided the space for the occasion. Scheduled for 7:00 PM on January 27th, the event invites friends to join, and attendees can secure their free tickets through a provided link.

GitHub has introduced a feature to enhance collaboration by allowing users with push access to edit or view files directly on a Pull Request's (PR) branch while in the "files changed" tab, streamlining the process of making and reviewing changes. After editing, users are seamlessly returned to the PR's diff for continued review, facilitating a smooth workflow without leaving the PR's context. The update ensures that links always point to the latest version of files on the branch, allowing for efficient web-based iteration and discussion. Additionally, users can create a permanent link to a specific version of a file by pressing the 'y' key, which changes the page's URL to the SHA of the latest commit, ensuring the link remains valid even if the branch undergoes further changes.

GitHub experienced a DNS infrastructure outage on January 8th, resulting in 42 minutes of downtime for all services and an additional 1 hour and 35 minutes for a subset of repositories. This disruption was caused by a bug in the rollout procedure for firewall and router configuration changes aimed at improving defenses against DNS amplification attacks. The issue led to connection timeouts and corrupted DNS zone files due to a circular dependency between GitHub's internal provisioning service and DNS, which was exacerbated by memory exhaustion on certain fileservers. Full service was restored by manually resolving these issues, and GitHub is committed to preventing future incidents by reviewing their infrastructure, improving configuration management, decoupling internal and external DNS systems, and implementing process accounting controls. The company acknowledges the importance of maintaining trust and is working to enhance service stability and performance for its users.

CSS selectors, akin to SQL statements in backend development, play a crucial role in frontend development by being used extensively in JavaScript and offering opportunities for optimization due to their declarative nature. Modern web applications utilize thousands of selectors, requiring browsers to employ advanced techniques to efficiently match and process these selectors, such as WebKit's RuleSet. SelectorSet, a JavaScript implementation, enhances this by quickly indexing selectors using keys derived from significant parts of the selectors, optimizing the matching process. Document delegated events in jQuery, particularly through functions like $.fn.on, benefit from this optimization, allowing event handlers to trigger for new elements without reloading the page, a necessity in patterns like pjax. While extensive use of document delegated event handlers can be controversial due to potential performance drawbacks in deeply nested DOMs, the SelectorSet technique can significantly enhance performance. Despite these advancements, the hope remains for browsers to natively support efficient processing of CSS selectors and declarative event handlers, as the current solutions are workarounds for existing limitations.

In Salt Lake City this weekend, attendees of SkiPHP, ng-conf, or visitors to the area have two social opportunities to connect with tech enthusiasts, Elizabeth Barron and Alyson La. The first event is a Drinkup at The Leprechaun Inn on Friday, January 17, from 9-11 pm, offering a variety of alcoholic and non-alcoholic beverages. The second event is a Skateup at The Gallivan Center on Saturday, January 18, from 5-7 pm, where admission is complimentary, but preregistration is requested to manage ticket purchases. Participants can enjoy skating or simply engage with fellow attendees at these gatherings.

Jen Myers participated in the seventh installment of the Passion Projects talk series in December 2013, where she emphasized the significance of not needing to be an expert and taking responsibility for one's own learning and growth, both personally and professionally. The event included a talk by Myers and a panel discussion, and it is accompanied by a video and photos, with coverage provided by Manisha Sharma.

Patchwork is an upcoming workshop hosted at GitHub's San Francisco headquarters, designed to teach participants about Git and GitHub in a collaborative environment. Scheduled for January 29th from 6:30 to 9:00 PM, the event aims to foster learning and community building among attendees, with guidance from GitHub employees and other open source contributors serving as mentors. Participants will have the opportunity to work hands-on with Git concepts, such as creating forks and branches, and will leave with a pull request merged, equipping them to further engage with open source projects. The event promises a supportive atmosphere with snacks and networking opportunities, and those interested can sign up either as attendees or mentors.

In late 2013, GitHub celebrated reaching the impressive milestone of 10 million repositories by hosting a party at its San Francisco headquarters. The event featured music by GitHub’s own DJs, @leehuffman and @nakajima, and offered an array of local food and beverages for attendees. The celebration aimed to bring together the GitHub community for an evening of enjoyment and networking, with an invitation for guests to RSVP in advance.

Kasima Tharnpipitchai and a colleague, known by the handle @southgate, are making a stop in Chiang Mai, Thailand, as part of their tour to discuss "How GitHub Builds GitHub." The event, scheduled at CUBE on Sirimungklajarn Soi 11, will take place on Wednesday, January 22, with the talk beginning at 7:00 PM followed by drinks at 8:00 PM. Attendees are invited to either join for the informative session or simply for the social gathering, with a particular invitation extended to superfans in the northern region of Thailand.

Leslie Bradshaw delivered an insightful presentation in September 2013 as part of the Passion Projects talk series, where she discussed her experiences in the tech industry, emphasizing the importance of creating healthy work environments and maintaining focus amidst numerous distractions. The event included a video of her talk and a panel discussion, and it was well-received by attendees, thanks in part to photographs captured by Mona Brooks. The talk was documented by Julie Ann Horvath.

Following an announcement about improvements to their SSL setup, the text discusses the complexities of deploying forward secrecy and updating cipher lists, emphasizing the importance of supporting TLS 1.2 to enable further enhancements. It addresses the transition away from the RC4 cipher due to vulnerabilities, favoring AES GCM for its broader support and security. The text explores the role of session resumption in forward secrecy, contrasting session IDs, where the server tracks state, with session tickets, which encrypt state information and facilitate sharing across servers. In the context of GitHub, session tickets were initially enabled by default due to HAProxy's settings, leading to potential security concerns if the session ticket key were compromised. Ultimately, the decision was made to disable session tickets and rely on session IDs to ensure forward secrecy while maintaining performance, recognizing the limitations of session tickets in their specific setup. The contribution of Jeff Hodges in identifying initial setup oversights is acknowledged.

GitHub Pages has introduced significant enhancements by utilizing a global Content Delivery Network (CDN) to serve sites, which ensures faster loading speeds by delivering cached pages from the nearest physical server. Additionally, GitHub Pages now benefits from Denial of Service (DoS) mitigation services similar to those used for GitHub.com. Users employing subdomains or A records may need to adjust their configurations to take full advantage of these updates. Those using default subdomains are automatically covered, while custom subdomain users need to point their CNAME records to username.github.io. For apex domains, switching to a DNS provider supporting ALIAS records is recommended to leverage the CDN and DoS protection fully. If this is not feasible, using A records will still provide DoS protection but without the CDN benefits. Detailed configuration guidance is available in GitHub's help article.

GitHub has introduced Traffic analytics to provide detailed insights for repository owners and contributors, allowing them to access data on their repositories' visitors and their activities. The feature can be accessed via a new link on the graphs page of a specific repository, offering information on visitor sources and viewing patterns. This new tool aims to enhance users' understanding of their repositories' reach and engagement, with GitHub's own experience revealing interesting and sometimes surprising insights. The update, announced by Justin Palmer, is part of GitHub's efforts to enhance user experience as they start 2014 with new features.

@kasima and @southgate are spending the winter in Thailand and inviting people to join them for two events in Bangkok. On January 14th, they will be giving a talk on "How GitHub Builds GitHub" at the bkk-web meetup. Additionally, on January 16th, they are hosting an informal gathering with drinks on a rooftop at the Bangkok Bar, located on the 8th floor of The Opus Building in Thong Lo Soi 10, where attendees can enjoy conversations about local culture, such as tuk tuks and traditional Thai dishes like หอยทอด, as well as GitHub's mascot.

GitHub's Game Off II, an annual game jam announced in October, has revealed its winners, who will receive iPad Airs, while runners-up will get GitHub swag. The winning games include "Transcube," a 2D puzzle platformer based on transforming into different blocks; "Swap," a tile-based puzzle game with character-switching mechanics; "Psiral," a turn-based strategy game involving wizards; "Protocol 390," which involves survival tactics; and "Heal Em’ All," where players explore graveyards to heal zombies. Runners-up feature diverse games like "CHANG€," about supermarket cashiers, "Color Quest," an infinite runner game, "Room For Change," an action RPG, and others such as "Custom Tetris," "Hyperspace Garbage Collection," and "MEGA GIRL.git." The event was judged by industry professionals and will return in 2014, offering a platform for developers to showcase their creativity through open-source game development.

An invitation is extended for a drinkup event to celebrate the new year, featuring hosts @achiu, @jch, and @thedaniel, scheduled for Tuesday, January 7th, at 8 PM at Lucky Baldwin’s Trappiste Pub & Cafe in Pasadena, specifically at the location on Colorado and Allen, not the one in Old Town. The hosts will cover the cost of drinks for attendees. The event, organized by Jerry Cheung (@jch), encourages participants to engage in conversation and enjoy the convivial atmosphere.

Join the first Passion Projects talk of 2014 on Thursday, January 9th, featuring Dana McCallum, a senior engineer at Twitter and co-founder of Lambda Ladies, who is also a licensed commercial pilot. Dana has played key roles at Twitter, including leading the development of Twitter’s API and helping create their advertiser API, and she now focuses on social graph infrastructure. As a prominent advocate for women in engineering and the LGBT community, she has been instrumental in forming advocacy teams and served as a delegate on women’s issues with the U.S. Department of State in India. The event, organized by Manisha Sharma, will take place at GitHub HQ in San Francisco, offering limited space that requires registration, with food, beverages, and a live performance by Running In The Fog to complement the talk.

GitHub has announced that GitHub for Mac now supports CAS authentication with GitHub Enterprise starting from version 11.10.328, streamlining the sign-in process for users. The updated process involves opening GitHub for Mac's Preferences, navigating to the "Accounts" tab, and entering the URL for the GitHub Enterprise server. If the server uses single sign-on, the username and password fields will be disabled, and clicking "Sign In" will direct the user to a web browser to complete the process. Successful authentication will redirect users back to GitHub for Mac, now signed in. Users experiencing issues or having feedback are encouraged to contact support.