March 2018 Summaries

Recent updates to organization project permissions provide enhanced flexibility for workflow management, allowing teams to collaborate more effectively and broaden their collaborative networks. The changes introduce more granular permissions, enabling organizations to decide which members can view or edit specific projects, including the ability to invite external collaborators without adding them to the organization directly. Additionally, there is now the option to create public projects at the organization level, which allows for sharing roadmaps or managing issues that span multiple repositories. These updates aim to foster greater transparency and collaboration both within and outside the organization, with existing permissions remaining unchanged unless modified by the user.

The latest release of GitHub Enterprise, version 2.13, offers enhanced features to improve team collaboration, manage permissions, and create custom tools. Key updates include team discussions for non-code related conversations, commit co-authors to attribute contributions accurately, and seamless admin capabilities with built-in authentication and extended pre-receive hooks. Users can also implement hotpatching for clustering without downtime and utilize Grafana in the Monitor Dashboard for detailed performance analysis. Additionally, GitHub Apps are now fully integrated, allowing teams to customize workflows using GitHub APIs. Further information on these updates can be accessed through release notes or upcoming webcasts.

GDC 2018 marked the release of the GitHub for Unity Beta, a package designed to aid Unity game developers by integrating GitHub's version control features within the Unity environment. This package enhances the development process by providing Git support directly in Unity, eliminating the need to use the command line. A key update includes the integration of Git LFS and file locking, which allows developers to manage large asset files more efficiently and prevents accidental overwriting through file locking. The package is compatible with Unity 5.4 and above on both Mac and Windows and supports GitHub authentication, including two-factor authentication. It offers extensive Git management features, such as user configuration, repository operations, and branch management, along with visual indicators for file locking. As an open-source tool, it encourages community contributions through feedback and bug reporting on its GitHub repository.

As projects increase in size and complexity, ensuring thorough code reviews can be challenging, but implementing a multiple reviewer requirement for pull requests helps safeguard important projects from unwanted changes. This feature allows users to specify the exact number of reviewers needed for each pull request by adjusting the settings under "Protected branches" in a repository. Once set, the number of required reviewers and the status of their reviews are displayed in the sidebar and merge section of pull requests to the protected branches, enhancing the review process and project integrity.

Hundreds of Git enthusiasts gathered in Barcelona for Git Merge 2018, a conference focused on the popular version control tool, with additional participants joining via live stream. The event fostered collaboration among business leaders, source control teams, and developers, supporting the progression of Git and its contributors. All ticket proceeds were donated to the Software Freedom Conservancy to aid in the improvement and defense of free and open-source software. The conference featured workshops led by GitHub and Praqma experts on Git-related topics and included a keynote by Brett Smith of the Software Freedom Conservancy emphasizing the importance of free software for the future. Notable speakers from companies like Mozilla and Microsoft discussed various subjects, including refactoring, automation, and Git's future. The event was supported by sponsors dedicated to advancing open-source software.

Hovercards provide a convenient way to gain insight into collaborators on open source projects or team endeavors by hovering over a contributor's avatar or username, revealing detailed information about the individual, such as their profile details, organizational team memberships, and contribution status. This feature emphasizes the importance of maintaining an up-to-date personal profile to ensure accurate representation on the hovercard. Currently, hovercards are supported by REST and GraphQL APIs, with these features in preview, and there's anticipation for their availability in a future GitHub Enterprise release.

Tracking changes in code dependencies, particularly security vulnerabilities, has become increasingly complex as developers often use existing code libraries. GitHub's security alerts system actively notifies project maintainers when vulnerabilities in libraries like RubyGems for Ruby and npm for JavaScript are detected, offering patched versions to resolve issues. These alerts rely on standardized lists of vulnerabilities, such as the Common Vulnerabilities and Exposures (CVEs), and since their launch, have helped resolve over 450,000 vulnerabilities in public repositories by encouraging maintainers to update or remove risky dependencies. Within a week of detection, around 30% of vulnerabilities are resolved, and 15% of alerts are dismissed, with most unresolved cases belonging to inactive repositories. GitHub has introduced regular vulnerability digest emails to further support maintainers and security teams in addressing these issues promptly. The initiative marks the beginning of enhanced code safety measures, with future plans to integrate more data for improved code checking and generation.

Thousands of educators utilize GitHub to share and manage course materials, distribute assignments, and monitor student progress, often open-sourcing their content for broader use. The platform hosts a variety of educational repositories, including both Massive Open Online Courses (MOOCs) and unique lessons from individual teachers, allowing new educators to adapt and reuse these resources. A curated list of popular courses on GitHub, selected based on the number of forks and stars, features offerings like Ada Developers Academy’s Jump Start and Textbook Curriculums for aspiring software developers, React From Zero for learning React, and Hear Me Code’s Python Lessons aimed at women. Additionally, repositories such as Stanford's TensorFlow Tutorials and the Deep Learning Specialization on Coursera offer extensive deep learning resources. The GitHub Education Community provides a more comprehensive list and additional resources for educators interested in expanding their computer science teaching materials.

GitHub has officially deprecated the ability to create anonymous gists as of March 20, while ensuring that all existing anonymous gists will remain accessible. Users are encouraged to create a GitHub account to continue utilizing the gist feature, with further information available through the provided documentation. This change aims to streamline the use of gists by linking them to user accounts, as explained by Chad Humphries in the announcement.

GitHub Universe, the prominent product and community conference, is set to take place this year at the Palace of Fine Arts on October 16-17, offering expanded sessions, demonstrations, and networking opportunities for developers. Attendees can secure early bird tickets for $99, with super early bird pricing available until April 20, though tickets are expected to sell out quickly. The event is also seeking speakers to contribute to breakout sessions focused on the tools, people, and businesses that drive software development, encouraging individuals to submit proposals to share their insights.

At SIGCSE 2018, the GitHub Education team focused on themes of communication, iteration, and real-world tools in computer science education, featuring special sessions where teachers and students shared their experiences with Git and GitHub. Teachers discussed the learning curve associated with Git but emphasized its benefits in enhancing classroom engagement and real-world applicability. Ming Chow from Tufts University, Dr. Mine Çetinkaya-Rundel from Duke University, and Dr. John David Dionisio from Loyola Marymount University provided insights into their GitHub workflows. Students from various universities, including the University of Nottingham and the University of California, Riverside, discussed how GitHub Education has positively impacted their learning experiences outside the classroom. GitHub Education also offers lesson plans, tutorials, and best practices to help educators incorporate Git and GitHub into their teaching, with monthly updates available for those interested.

GitHub is raising concerns about the European Union's proposed Article 13 of the Copyright Directive, which mandates code-sharing platforms to monitor all uploaded content for potential copyright infringement. This proposal, originally targeting music and video streaming platforms to bridge a perceived "value gap," inadvertently affects software developers by imposing upload filters that may hinder the sharing of open-source code. GitHub highlights the issues of privacy infringement, free speech constraints, and the ineffectiveness of content detection tools, which could particularly burden small and medium-sized businesses. False positives in identifying copyright violations can disrupt software development by removing crucial code dependencies, impacting reliability and costs. GitHub is actively engaging with EU policymakers and encourages developers to voice their concerns, emphasizing the importance of excluding software repositories from the directive to maintain the integrity and innovation of the software industry.

GitHub's Security Bug Bounty program marked its fourth anniversary with significant growth in 2017, evidenced by an increase in both the number of resolved reports and total payouts, which rose to $166,495 from $95,300 in the previous year. The program, which expanded to include GitHub Enterprise in its scope, saw a boost in valid report rates from 6% to nearly 15%, attributed partly to re-evaluated payout structures and initiatives like private bug bounties and researcher grants. These initiatives aimed to engage researchers more effectively, particularly in areas of critical enterprise authentication. Operational efficiencies improved with the integration of chat-based workflows and APIs, reducing average response times to 10 hours and expediting the process of rewarding bounties. Looking forward to 2018, GitHub plans to further enhance the program by expanding private bounties and research grants, and exploring ways to secure its services while maintaining researcher engagement.

The Godot GDC Meetup is set to take place at GitHub's headquarters in San Francisco on Thursday, March 22, 2018, featuring discussions and presentations from prominent figures in the game development community. Juan Linietsky, the Lead Developer of Godot Engine, will provide insights into Godot's development process and the collaborative efforts of its extensive developer community. Leaf Corcoran, the Founder of itch.io, will discuss the deployment of Godot games on itch.io using command line tools and APIs for effective data management. The event invites game developers of all experience levels to bring their laptops for a night of engaging talks, demos, and networking opportunities.

GitHub is hosting its annual GDC Party at their headquarters in San Francisco on Tuesday, March 20, from 7 pm to midnight, coinciding with the Game Developers Conference (GDC). The event will feature games from the Global Game Jam, celebrating their 10-year anniversary, and attendees are encouraged to bring their own devices to showcase their work. Drinks, wifi, and Octocat stickers will be provided, and GDC badges or proof of registration are required for entry. The event is open to all ages, though those over 21 will need a valid photo ID to consume alcohol. Early arrival is recommended due to the potential for reaching capacity quickly.

Patchwork is an upcoming event in Orlando designed for beginners to Git and GitHub, as well as mentors eager to assist others in learning these tools. The workshop offers a casual, hands-on experience where participants can choose from various learning modules, including GitHub 101, 102, and 103, focusing on different aspects of GitHub usage. It encourages a self-directed approach with community mentors available for guidance, and attendees will gain practical experience by completing tasks like merging pull requests. The event is set for April 11, 2018, at Canvs in Downtown Orlando, a venue that ensures accessibility and inclusivity. Participants are encouraged to RSVP and are required to have a GitHub account prior to attending. Food and refreshments will be provided, and the event is a chance for newcomers to engage with the open-source community while enjoying a relaxed atmosphere.

The third annual International Conference on Game Jams, Hackathons, and Game Creation Events (ICGJ) took place on March 18, 2018, at GitHub's headquarters in San Francisco. Organized by Global Game Jam, the event served as a platform for educators, researchers, professionals, and organizers involved in game jams and hackathons to gather and share insights. The conference featured a comprehensive schedule that included papers, presentations, lightning talks, and game showcases, providing attendees with valuable opportunities for networking and learning. Senior Program Manager at GitHub Developer Relations, Lee Reilly, played a key role in organizing the event, leveraging his expertise in supporting developer communities and managing programs.

February witnessed a flurry of notable releases across various tech projects, including Asciinema 2.0, Phaser 3, webpack 4.0.0, Next.js 5, and HaxePunk 4.0. Asciinema 2.0 introduced a new asciicast v2 file format that enhances memory usage and allows session continuation after interruptions, while Phaser 3, after a year-and-a-half of development, features a major internal rewrite for game development. Webpack 4.0.0, known for its impressive speed improvements, offers new defaults for development and production modes, providing efficiency in building static bundles. Next.js 5 integrates webpack features with support for TypeScript and CSS loaders, enhancing server-rendered React applications, and HaxePunk 4.0 introduces custom shaders and improved device input systems for game development across multiple platforms. These releases highlight the ongoing innovation and collaboration within the open-source community, driven by developers and supported by platforms like GitHub.

GitHub has open-sourced a tool named Licensed, which is designed to help developers manage and verify the licenses of open-source software (OSS) dependencies within their projects. Licensed operates by identifying, caching, and checking license metadata for dependencies across various programming languages and package managers, ensuring compliance with OSS license requirements. It offers flexibility to work within both monolithic and individual project repositories by using configuration files to enumerate dependencies and store metadata. By caching metadata in a source control repository, it provides an audit trail of dependency changes and simplifies the process of updating and distributing licenses. Licensed integrates into GitHub's development workflow, providing continuous integration (CI) checks to ensure compliance and facilitate collaboration with subject matter experts when changes occur. The tool is designed to be extensible, allowing for the addition of new dependency sources to accommodate projects using unsupported languages or frameworks. Future enhancements aim to streamline its integration into developer workflows and expand support for additional dependency sources.

GitHub Classroom offers educators a structured way to create and manage group assignments, enhancing collaboration among students by mimicking professional development environments. Through GitHub Classroom, teachers can create group exercises by leveraging GitHub teams, reusing existing student teams, and managing assignments via a shared repository. Educators need to set up a GitHub organization with private repository access, prepare an exercise repository, and have a student list ready. The process involves creating group assignments, inviting students through unique links, and forming student groups either by reusing existing ones or establishing new ones. Each student team is provided a shared repository, allowing them to collaborate through commits, branches, pull requests, and issues. Educators can review student progress through GitHub's "Insights" tab, which offers detailed analytics on student collaboration, and provide feedback on commits or via issues. The platform's structure maintains confidentiality and supports enhanced interaction, making it an effective tool for fostering teamwork in educational settings.

git-sizer is an open-source tool designed to help developers manage and optimize Git repositories by providing size metrics and identifying potential issues related to repository structure and content. It assesses various properties of a Git repository, such as the number of objects, uncompressed size, number of commits, and references, which can affect performance even if the overall disk usage isn't excessive. By analyzing these factors, git-sizer helps users understand if their repository is pushing Git's limits, potentially causing slower operations, and suggests improvements for better efficiency. The tool is particularly useful when setting up a repository or migrating from another version control system, where establishing good practices early can prevent future complications. The Linux kernel is cited as an example of a large but well-balanced repository that operates efficiently within Git's capabilities. Users are encouraged to engage with the git-sizer project by reporting bugs or contributing to its development.

Saved replies, a feature available for nearly two years, allows users to quickly respond to multiple issues and pull requests, now enhanced with keyboard shortcuts for increased accessibility. By pressing Ctrl followed by a period while composing or replying, users can activate their saved replies and select their preferred response using a number, such as Ctrl 2. If a saved reply ends with a # or @, it will attempt to autocomplete an issue or pull request number, or a username. Further details and guidance on using these features can be found in the documentation, as explained by Mike McQuaid.

Git LFS v2.4.0, the latest version of the open-source Git extension for managing large files, introduces several significant updates, including a complete reimplementation of its pattern matching engine, which now supports character ranges and classes, and aims to standardize pattern meanings for future releases. The update also features a unified progress meter that aligns with Git's style, providing clearer and more focused feedback during file transfers by displaying a moving average rate and omitting the count of "skipped" objects. Furthermore, Git LFS v2.4.0 enhances its API by including affected references in requests, paving the way for contributions from pull request owners, and offers additional features such as new commands, improved Linux support, and NTLM SSPI authentication on Windows, thanks to the contributions of the open-source community.

On February 28, 2018, GitHub.com experienced a temporary outage due to a distributed denial-of-service (DDoS) attack that exploited a vulnerability in memcached instances accessible over the internet, resulting in an unprecedented amplification factor of up to 51,000 times. The attack, which peaked at 1.35Tbps, was mitigated by GitHub's network monitoring system that detected an anomaly and shifted traffic to Akamai for additional edge network capacity, effectively resolving the issue within minutes. GitHub emphasizes its commitment to enhancing its infrastructure's resilience by expanding transit capacity, developing automated intervention strategies, and working with partners to block and filter such attacks. The company is focused on improving its response times and is committed to continuously analyzing incidents to better protect its users' workflows and projects.