December 2014 Summaries

GitHub announced that it would remove RC4 support from its SSL configuration on both the website and API starting January 5th, 2015, due to several cryptographic vulnerabilities associated with RC4 that could compromise data security. This change means that users accessing GitHub via Internet Explorer on Windows XP will lose access because Windows XP supports only outdated SSL ciphers and is no longer supported by Microsoft, possessing a critical security flaw in its SSL implementation. Users are advised to upgrade to a newer version of Windows or, if that is not feasible, switch to using Chrome or Firefox for accessing GitHub on Windows XP. Despite these changes, the git client from git-scm.com remains functional on Windows XP.

A critical security vulnerability affecting all versions of the official Git client and related software has been disclosed, which allows attackers to execute arbitrary commands on client machines by crafting malicious Git trees. This vulnerability impacts Git clients on case-insensitive or case-normalizing filesystems, specifically targeting those running on OS X (HFS+) and Microsoft Windows (NTFS, FAT), while Linux clients remain unaffected if operating on case-sensitive filesystems. GitHub and GitHub Enterprise users are urged to update their Git clients immediately and exercise caution when interacting with repositories from untrusted sources. GitHub has taken measures to block malicious trees on its platform and has scanned existing content for potential threats. Updated versions of GitHub for Windows and Mac, as well as the Git core and libraries like libgit2 and JGit, have been released with security fixes. Further details are available through the official Git mailing list announcement and the git-blame blog.

GitHub has enhanced its mobile experience by enabling search functionality on mobile devices, allowing users to easily find repositories, developers, and project issues while on the go. This improvement aims to accommodate users who need to access GitHub from their phones, whether for business purposes or casual browsing, using GitHub's powerful search syntax to streamline the process.

Unified and split diffs have been enhanced with syntax highlighting, providing color-coded insights that help clarify the meaning and structure of code changes. This improvement facilitates better comprehension of code modifications in commits, pull requests, or review comments, enhancing the review process. Users can see this feature in action on repositories like dotnet/corefx, as noted by Adam Roben.

GitHub has joined the LOT Network, an organization aimed at reducing patent litigation by protecting members from patent trolls, who exploit patents to force settlements or shutdowns of projects. Patent trolling, which targets successful and innovative projects including open-source software like Linux and Git, poses a significant threat to innovation. The LOT Network counteracts this by granting all members a license to any patent sold to a troll, thereby diminishing the trolls' capacity to leverage patents for litigation. As the network expands, the number of patents available to trolls decreases, undermining their business model. GitHub is also hosting the LOT agreement as an open-source project, encouraging community contributions to enhance its effectiveness. By inviting more companies to join the LOT Network, GitHub aims to create a robust defense against patent trolls and foster a safer environment for innovation.

GitHub's Status API enhances code quality by integrating pull request statuses into the conversation timeline, allowing developers to view results from multiple continuous integration (CI) systems simultaneously, including platform tests, security checks, and code coverage analyses. This update enables users to track the historical changes in pull request statuses via icons next to commits. Developers interested in setting up custom statuses can refer to the Status API documentation and a guide for building personal CI services. Additionally, several services utilize the Status API to help maintain clean code, verify test success, and ensure contributor agreement to Contributor License Agreements (CLAs).

Patchwork hack night, scheduled for December 10, 2014, at Polygon in Atlanta, is a workshop aimed at beginners interested in learning Git and GitHub, requiring no prior coding experience. Participants will engage in hands-on activities to create their own open-source projects, culminating in a merged Pull Request and a square on their contributions graph, fostering confidence to further engage with the open-source community. The event will feature a GitHub designer and local mentors to provide guidance, starting with a talk from a GitHubber about their programming journey, followed by group activities focusing on the Hello World tutorial, and concluding with a community member's lightning talk. Attendees can RSVP to learn Git and GitHub, while experienced mentors are encouraged to join and assist newcomers. Food and refreshments will be provided, and mentors will receive preparatory details via email before the event.

GitHub.com has introduced organization-level webhooks, which send events for all repositories within an organization and include new events such as repository creation and team membership. This feature streamlines the integration process for those extending GitHub into internal systems, as it allows for configurations across multiple repositories to be managed centrally. The introduction of organizational-level events presents new opportunities for developers creating applications that interact with GitHub, expanding the potential for innovative integrations. For further information, users are encouraged to consult the updated webhook developer guide.

GitHub is celebrating the holiday season with a limited edition Octocat Holiday Ornament available in the GitHub Shop, alongside other Octocat-themed items. Customers can enjoy a 25% discount on the new ornament, the Octocat Figurine, and all shop items this Cyber Monday, December 1st, using the code CYBERCAT2014. To ensure delivery by Christmas, the deadline for international orders using Priority Mail International is December 8th, while domestic orders must be placed by December 18th. The initiative draws inspiration from the tradition of collecting holiday ornaments and is part of GitHub's ongoing celebration of special moments.