January 2017 Summaries

GitHub's introduction of Topics offers an innovative way to connect similar repositories by using labels that facilitate subject-based exploration of projects according to type, technology, and more. By clicking on a particular topic, users can discover related repositories, and adding topics to one's own repositories can increase their visibility. The suggestion of topics for public repositories is driven by machine learning and natural language processing, although users are encouraged to reject irrelevant suggestions to help refine the model. As GitHub continues to enhance this feature, it aims to expand the role of Topics in project discovery, inviting users to engage with and benefit from this new tool.

GitHub Classroom, launched in 2015, has become a valuable tool for educators like Geoff Schmit, who integrates it into his AP Computer Science curriculum at Naperville North High School. Geoff emphasizes the importance of teaching students real-world engineering skills, such as source control and unit testing, using pre-filled repositories to streamline their learning process. By simplifying the assignment management process through GitHub Classroom, students can focus on coding without the technical hurdles of setting up environments. Geoff's approach, inspired by educational theorist Dr. Mitchell Resnick, involves creating assignments with "low floors, wide walls" to encourage creativity and engagement beyond the minimum requirements. This method has fostered a classroom environment where students feel free to take risks and collaborate, as their work is largely practice-focused and not heavily graded, which enhances their learning experience and willingness to explore new concepts.

GitHub's Community & Safety engineering team is dedicated to ensuring user safety and building community management tools by reviewing new features to prevent potential abuse and harassment. A checklist has been developed to address concerns around explicit consent, audit log trails, and minimizing abuse. The team emphasizes explicit consent for interactions, illustrated by features like Repository Invitations, and asks critical questions to protect users from harassment. An audit log trail is crucial for providing support staff with context and accountability in case issues arise. To minimize abuse, strategies include limiting 0-day account access to high-risk features and considering reputation systems for user privileges. This comprehensive approach aims to build safer products and enhance user trust and satisfaction.

CARTO has been added to the GitHub Student Developer Pack, providing students with a robust platform for analyzing and predicting insights from location data through a suite of geospatial tools, services, and APIs. This includes CARTO Builder, a user-friendly web-based tool for exploring location data, and CARTO Engine, which offers comprehensive geospatial functionalities. Additionally, a Mobile SDK is available for creating custom map applications across various mobile platforms. Students benefit from 350MB of database storage, synced tables, and monthly credits for location data services, among other features. The Student Developer Pack aims to provide students with free access to leading developer tools from various technology companies.

The "Recover Accounts Elsewhere" feature allows GitHub users to associate their accounts with their Facebook profiles to facilitate account recovery in scenarios where two-factor authentication methods become inaccessible, such as losing a phone or U2F key. By integrating with Facebook, GitHub provides an alternative proof of account ownership that complements traditional methods like confirmed email access and valid SSH keys. The underlying "Delegated Account Recovery" process involves encrypting and digitally signing a recovery token, which Facebook stores securely until needed. During a recovery, Facebook countersigns the token, which GitHub then verifies to confirm the account owner's identity without exchanging any personally identifiable information between the platforms. This approach aims to improve security and privacy by mitigating risks associated with database dumps and SQL injection vulnerabilities, while GitHub also plans to open-source a Ruby library to assist in implementing this recovery process. The feature is part of a joint bug bounty program with Facebook to ensure ongoing security improvements and is seen as a potential replacement or complement to traditional password resets. Moreover, future plans include reciprocal recovery options between Facebook and GitHub, enhancing the overall account recovery process.

Starting January 31, 2017, GitHub introduced a Delegated Account Recovery feature that allows users to link their GitHub account with their Facebook account, providing an alternative recovery option in case of two-factor authentication lockouts. This feature is particularly useful if a user loses their phone or token and does not have a backup, enabling them to regain account access through Facebook. Previously, users needed to prove account ownership via a confirmed email address and a valid SSH private key to disable two-factor authentication. To utilize this new recovery method, users must save a token on GitHub's security settings page and confirm its storage. If a lockout occurs, users can contact GitHub Support and use Facebook to initiate the recovery process, offering a convenient alternative to traditional methods.

Pull request reviews facilitate collaborative software development by allowing team members to share responsibilities and provide targeted feedback. Enhancements in pull request management now include the ability to filter by review status, making it easier to identify which pull requests require attention. Users can utilize the Reviews filtering menu to find pull requests awaiting review, those on protected branches, approved ones ready for merging, and those needing changes. Additionally, pull requests can be filtered by specific reviewers, and users can quickly access those previously requiring their review. These updates are also reflected on the global pull request dashboard, offering a comprehensive view of all pull requests awaiting feedback across repositories and organizations.

The GitHub Extension for Visual Studio enhances the development workflow by enabling users to manage pull requests directly within Visual Studio, eliminating the need to switch between windows. This extension introduces a new pull request window that allows users to review code, make modifications, and push updates back to GitHub. It also supports collaboration on forked branches for upstream repository contributors. Users can install the extension from the Visual Studio gallery or download it from the official website. Initially released as an open-source project under the MIT license, the extension encourages community involvement through issue logging and contributions, spearheaded by Sara Ford.

GitHub's exploration of Content Security Policy (CSP) and its subsequent enhancements demonstrate a proactive approach to web security, focusing on identifying and mitigating vulnerabilities beyond CSP's capabilities. By collaborating with Cure53, GitHub uncovered potential bypasses in their existing CSP policy and implemented additional defense strategies, such as restricting image sources and transitioning to an XHR approach for Google Analytics. They also improved CSRF protection by introducing per-form tokens and same-site cookies, countering potential exfiltration of sensitive data through injections. The company addressed gaps in their CSP by proxying Gravatar images and removing third-party sources from their img-src list, and they tackled dangling markup attacks with a nuanced mitigation strategy. Despite challenges like the peculiarities of the <plaintext> tag, GitHub's efforts have sparked broader discussions on browser-level security improvements. Their ongoing commitment to enhancing web security is further evidenced by their bug bounty program, encouraging research into bypassing their CSP policy to uncover novel vulnerabilities.

Improved blame view in GitHub allows users to trace the evolution of any part of a file without needing to review its entire history, which is particularly useful for debugging or understanding code changes. This feature enhances the ability to see what a file looked like before specific modifications, providing a more efficient way to track changes. For further details on utilizing git blame to follow alterations in a file, users can refer to the GitHub Help documentation.

Flatiron School now offers a free month of their Community-Powered Bootcamp through the Student Developer Pack, providing a flexible, self-paced online course in web development for beginners. This bootcamp mirrors the comprehensive curriculum of their Web Developer Program, covering essential topics such as HTML, CSS, JavaScript, Node.JS, React, and Ruby on Rails, aiming to equip students with in-demand skills and technical literacy. During the free month, students can engage with a supportive community, build a portfolio, and access 24/7 assistance, with the option to continue the program for a monthly fee of $149 USD. The Student Developer Pack also grants students complimentary access to developer tools from various technology companies, enhancing their learning experience.

Git Merge 2017, set to take place in Brussels in February, is designed to be an inclusive and supportive event for the diverse Git community, with all proceeds going to the Software Freedom Conservancy to support FLOSS projects. The event emphasizes accessibility by offering scholarships, including discounted student tickets and free tickets for individuals from underrepresented groups in tech. Ten percent of event tickets are reserved for scholarships, distributed through local partner organizations like Rails Girls Belgium and Operation Code, which aid women in tech and military veterans, respectively. For the first time, Git Merge is also accepting individual scholarship applications through the Travis Foundation’s Diversity Tickets program, with applications closing on January 13th, providing an opportunity for a broader, more diverse audience to participate.

GitHub historically used Redis in two primary ways: as a transient LRU cache for storing computation results and as a persistent store for data not stored elsewhere. Recently, the company decided to disable Redis persistence to reduce operational costs, leverage MySQL expertise, and improve performance by eliminating I/O latency. The transition involved replacing persistent Redis with GitHub::KV, a MySQL key/value store, for most use cases. Migrating activity feeds posed challenges due to high write operations, necessitating changes in how data was written and read. By batching and throttling writes and experimenting with schema designs, GitHub successfully migrated feeds to MySQL without adding new servers. The data-driven approach led to a reduction in write operations and ensured the system's capacity to handle the load. The project highlighted the need for a solution that works across GitHub's platforms, resulting in improved efficiency and performance. The Platform and Infrastructure teams played a crucial role in this transition, and GitHub is seeking engineers to join their efforts in building a resilient platform.

Celebrating its third anniversary, the GitHub Bug Bounty Program is offering increased rewards for identifying severe bugs during January and February, with higher payouts corresponding to the severity of the bugs discovered. The program maintains its usual process, where hackers and security researchers report vulnerabilities through a responsible disclosure process, with bounties typically ranging from $500 to $10,000 USD, determined by the severity of the issues. In addition to the standard rewards, standout reports will receive bonus rewards and limited edition t-shirts, with the top 15 submitters of the most severe bugs eligible for these special prizes. The program now includes GitHub Enterprise, allowing researchers to seek out bugs within Enterprise as well, with promotional bounties available for significant discoveries. Participants can find more details on the GitHub bounty site, with the assurance that all valid submissions will receive standard bounties, ensuring everyone who contributes benefits from their efforts.

GitHub has introduced a new feature in the “Graphs” tab, allowing users to visualize the relationships between repositories through a dependents graph. This tool is particularly useful for open source maintainers as it helps them understand the community connected to their projects and identify other projects that rely on their repositories, including both forks and non-fork dependencies. It provides a list of the latest repositories that depend on a user's repository and offers filtering options to differentiate between packages (other repositories that are gems) and applications (public repositories using the gem). Currently, this feature supports Ruby gems, with plans to extend it to other package ecosystems in the future, and detailed guidance is available in their help guide.