March 2017 Summaries

Microsoft has announced plans to shut down CodePlex and is collaborating with the CodePlex team to facilitate the migration of projects to GitHub, while continuing to support SVN clients for users preferring it over Git. Over the years, Microsoft has made substantial contributions to open source on GitHub, with over 16,000 contributors positively impacting both its ecosystem and the broader open source community. The transition aims to welcome CodePlex projects to GitHub, enhancing their integration into the open source landscape.

GitHub now allows users with administrative privileges to disable repository and organization-wide Projects if they are not being utilized, catering to the fact that not every team manages their work in the same manner. Admins can disable Projects by navigating to the settings of a repository or organization and unchecking the appropriate boxes. This action hides the Projects tab from navigation, removes Projects from Issue and Pull Request sidebars, and makes Project-related events inaccessible via API requests. However, Projects can be re-enabled at any time, restoring them to their previous state. For more guidance, users can refer to the help documentation and the Projects API page.

GitHub emphasizes the importance of work/life balance by recognizing the creative pursuits of its employees outside of work, such as contributing to open source projects, art, or activism, and supports this through a unique employee intellectual property (IP) agreement. This agreement, known as the Balanced Employee Intellectual Property Agreement, has been open-sourced to encourage transparency and innovation while addressing legal barriers. Unlike typical IP agreements that often assign creative control to employers, GitHub's agreement allows employees to retain control over their creations unless they are directly related to company projects or developed with company resources or endorsement. This approach aligns with California's laws, which generally do not enforce non-compete covenants, contributing to the state's thriving tech industry. GitHub invites others in the tech industry to adopt similar practices and learn more through their open-source repository.

Researchers recently announced SHAttered, the first collision of the SHA-1 hash function, prompting GitHub to implement measures to detect and reject any Git content involved in collision attacks. This action ensures that GitHub cannot be used to perpetrate such attacks, as Git relies on SHA-1 hashes to name and link data objects, making collisions a potential security risk if they were to occur. While accidental collisions are extremely unlikely, a deliberate collision attack could allow a malicious actor to create a pair of similar objects that appear identical to a signer but differ in content. GitHub's new detection code, developed by Marc Stevens and Dan Shumow, identifies patterns left by collision-generating techniques, thwarting attempts to exploit the SHA-1 algorithm's weaknesses. Although no Git collisions have been observed yet, GitHub is collaborating with the Git project to integrate collision detection into future releases and plans to transition to a more secure hash algorithm to further safeguard against these vulnerabilities.

Data science education, as exemplified by Mine Çetinkaya-Rundel at Duke University, emphasizes equipping students from diverse academic backgrounds with the skills to analyze a wide range of datasets rigorously. Her course, Master Statistics with R, focuses on reproducible computation using tools like R Markdown, RStudio, Git, and GitHub, allowing students to document and replicate their data analysis processes. Çetinkaya-Rundel's pedagogical approach encourages students to engage with real-world data quickly and efficiently, fostering an environment where they can experiment and explore beyond assigned tasks. By integrating Git from the start, students gradually learn version control, which enhances their collaborative skills and prepares them for future professional opportunities, as they gain familiarity with tools commonly used in the field. Her instructional methods not only prepare students academically but also provide them with practical experience that can be leveraged in internships and research positions.

In a recent update, GitHub enhanced its repository overview pages by adding open source licenses, providing users with brief descriptions and overviews of popular licenses like MIT, Apache, and GPL, to clarify what can and cannot be done with the project. This additional metadata, sourced from choosealicense.com and available via the license API, aims to assist users in making informed decisions about licenses, though GitHub advises consulting legal professionals for specific legal issues. Ben Balter, Chief of Staff for Security at GitHub, who has previously managed various roles including overseeing enterprise offerings and community management, authored this update. Balter's extensive contributions include shipping over 500 features to enhance privacy, compliance, and safety, as well as promoting open-source adoption among government entities worldwide.

Humans require a minimum of 3.5 mugs of water daily, and the 18-ounce Contribution Mug is designed to support even the most rigorous hydration routines. This versatile mug can hold a variety of contents such as coffee, tea, water, ice cream, cereal, soup, or even a pet goldfish, offering users the freedom to choose how they use it without judgment. The Contribution Mug is available for purchase in the GitHub Shop, with the text authored by Natalie Siskin.

GitHub's decision to use Markdown for user content has led to the development of GitHub Flavored Markdown (GFM), a customized version built on the Sundown parser to address Markdown's inconsistencies across platforms. To enhance standardization, GitHub has released a formal specification of GFM based on CommonMark, which aims to provide a consistent Markdown syntax widely used online. This transition involved creating a specification for GFM-specific features like tables and task lists, ensuring compliance with the CommonMark standard. The implementation included a new backend based on the cmark parser, which, despite being slower than Sundown, offers improved security and functionality by generating an Abstract Syntax Tree (AST) for Markdown. To address potential rendering issues with existing content, GitHub normalized user comments, ensuring minimal impact on the user experience during the migration to CommonMark compliance. This extensive process ensured that all Markdown content on GitHub now adheres to a standardized and pragmatic approach, with ongoing efforts to align with the final CommonMark specification.

In celebration of the third anniversary of its Bug Bounty Program, GitHub launched a promotional bounty period in early 2016, expanding the program's scope to include GitHub Enterprise, which led to the discovery of several critical security vulnerabilities. The first prize went to a report on a SAML authentication bypass, while other prizes were awarded for remote code execution and server-side request forgery vulnerabilities. Despite a decrease in overall reports compared to previous years, there was an increase in session handling bugs and sensitive data exposure incidents, reflecting evolving security challenges. Transitioning to the HackerOne platform in April 2016 improved the program's efficiency, with GitHub maintaining a quick average response time of 16 hours and resolution time of 28 days. The program not only rewards researchers but also supports charitable donations, with bounties being matched by GitHub and donated to organizations like Doctors Without Borders and the Electronic Frontier Foundation. The company also sponsored events to encourage participation from underrepresented groups, demonstrating an ongoing commitment to community engagement and improving security practices.

GitHub is now implementing a formal specification for GitHub Flavored Markdown (GFM) across all user-generated content on its platform, including comments, wikis, and repository files, to improve integration and preview capabilities for third-party software. This initiative is based on CommonMark, which aims to unify various Markdown dialects and includes custom features like tables, task lists, and autolinking specific to GitHub. The company has also open-sourced a reference implementation in C, derived from the original cmark parser, to support these features. The change is designed to align with existing real-world Markdown usage, so most GitHub documents should remain unaffected, although some with more obscure features might render differently. More details can be found in GitHub's Engineering Blog.

The GitHub Education team hosted a social event at the Tap House Grill in Seattle, WA, on March 9, 2017, from 6 to 9 PM, coinciding with the SIGCSE conference, an annual event by the Association for Computing Machinery focused on computer science education. Attendees, including GitHub users and SIGCSE participants of all ages, were invited to enjoy food, drinks, and billiards while mingling with the GitHub team members, such as @johndbritton, @sanicki, and @mozzadrella. The event aimed to foster community interaction and networking opportunities among educators and technology enthusiasts, with a Facebook RSVP available for interested participants.

A new feature allows organizations to specify who can dismiss code reviews on a protected branch, enhancing the quality control process in team code reviews. Over the past year, updates to pull requests have been implemented to facilitate feedback and ensure high-quality code integration. These updates include the ability to leave, manage, request, and dismiss reviews, as well as protect branches and limit merging rights. By restricting review dismissals, teams can ensure that significant feedback is addressed, either by completely removing the ability to dismiss reviews on a protected branch or by limiting this ability to designated users or teams within the branch protection settings of any organizational repository.

GitHub for Unity is an extension designed to integrate Git and GitHub into the Unity Editor, facilitating collaboration and project management for Unity game developers, including artists and programmers. By supporting Git LFS v2.0, it enables the versioning of large binary assets and introduces file locking to manage complex file merges, providing a more seamless workflow for game development. The extension aims to unify GitHub and Unity workflows, with plans to release it as open-source and available in the Unity asset store. The project, supported by Emil “AngryAnt” Johansen, invites feedback from users to refine its development, with an alpha release anticipated soon.

Git LFS v2.0.0 introduces several new features, including file locking, which allows users to lock files they're working on to prevent others from making changes, thereby avoiding merge conflicts and lost work on non-mergeable files, especially useful for large teams handling binary assets. Improvements in the transfer queue have made file uploads and downloads faster, more efficient, and resilient to failures, while optimizations in Git and filesystem operations have enhanced push and pull operations by allowing them to run concurrently with tree scans. The update also includes enhancements to the file tracking mechanism, which now respects .gitignore directories, thus increasing operational efficiency. Since its inception, Git LFS has seen substantial community contributions, with over 1,008 pull requests, and the team is seeking feedback on the new file locking feature as part of their ongoing development roadmap. Additionally, a GitHub plugin for Unity has been announced, integrating GitHub workflows with Unity and supporting Git LFS and file locking.

Automated testing tools like Travis CI and GitHub Classroom are transforming the educational landscape by providing timely feedback and streamlining the grading process, particularly in programming courses. Omar Shaikh, a lecturer at San Francisco State University, improved the workflow of his C++ course by integrating these tools, enabling students to identify and rectify mistakes efficiently, thereby enhancing their learning experience. The approach involves creating test cases using tools like Google's Gtest, setting up assignments in GitHub Classroom, and enabling Travis CI to monitor student progress by running tests on their code submissions. This system not only allows students to receive immediate feedback but also aids instructors in efficiently identifying and addressing areas where students struggle. Renée Hendricksen, a seasoned Ruby teacher, supports this method, highlighting that it encourages students to understand errors early and follow a structured problem-solving approach. This teaching strategy, which emphasizes a "test-first" method, allows students to develop problem-solving skills while instructors can focus on higher-level feedback regarding code quality and style.

GitHub has launched a new Business offering on GitHub.com that includes features such as SAML single sign-on, automated provisioning and deprovisioning, 24/5 support, and a 99.95% uptime guarantee, all priced at $21 per user per month. This new package aims to enhance team productivity by providing seamless integration with popular identity providers like Ping Identity, Okta, OneLogin, Azure AD, and Shibboleth, while maintaining existing functionalities such as unlimited private repositories, pull requests, and project management tools. The offering is designed to improve security and efficiency by reducing administrative overhead and facilitating growth without the need for manual user management. GitHub Enterprise users, who require on-premises hosting, benefit from recent updates that enhance performance, reliability, and pull request efficiency. An upcoming webcast will provide further details on the new features and how teams can leverage GitHub for their projects.

GitHub Enterprise 2.9 introduces several new features and enhancements aimed at improving reliability, flexibility, and collaboration for both developers and administrators. The release includes support for load balancers to enhance deployment reliability and a new hosting option on Google Compute Engine for increased installation flexibility. Developers benefit from enhancements to pull requests, including the ability to resolve merge conflicts directly in the UI, request and track reviewers, dismiss invalid reviews, and utilize the "Rebase and merge" option to avoid merge commits. Organization-wide Projects allow teams to manage work across repositories more efficiently, while improvements like searchable commit messages and progressively loaded diffs enhance the overall user experience. Users are encouraged to upgrade to GitHub Enterprise 2.9 to take advantage of these features and review the release notes for additional updates.