March 2020 Summaries

In late February, GitHub encountered multiple service interruptions totaling over eight hours due to unexpected database load variations and configuration issues within its mysql1 database cluster. These events highlighted the need for improved operational readiness, observability, and performance testing, particularly concerning ProxySQL's scalability and integration with other systems. As a result, GitHub implemented immediate changes such as data partitioning, which notably reduced load and queries on the mysql1 cluster. Additionally, the company is pursuing long-term strategies including auditing database reads, enhancing feature flag usage, completing functional partitioning, refining dashboards, and exploring further data partitioning and sharding opportunities to bolster scalability and reliability. These efforts aim to stabilize the platform and build capacity for future growth, ensuring trust and dependability for GitHub's users.

GitHub's Security Bug Bounty program has reached significant milestones, having paid over $1,000,000 to researchers since transitioning to HackerOne in 2016, with $590,000 of that awarded in the last year alone. The program has seen a 40% increase in submissions, maintaining an average response time of 17 hours. Notable vulnerabilities discovered include an OAuth flow bypass and remote code execution through command injection, both of which were swiftly addressed. The scope of the bug bounty has expanded with new features like GitHub Actions and mobile applications, and live-hacking events like H1-702 have resulted in significant payouts for critical findings. GitHub's private bug bounty programs allow for early detection of vulnerabilities in upcoming features, and the Security Lab bounty program encourages community contributions to enhance the security of open-source software globally.

GitHub Desktop aims to streamline the user experience for individuals and organizations by simplifying the setup process and reducing cognitive overhead, particularly for those working behind a proxy. The latest update, version 2.4, automates configurations, allowing users to push or pull repositories without manual setup, and introduces an easy way to create issues directly from the application using menu items or keyboard shortcuts, enhancing workflow efficiency. A dark theme option, now out of beta, offers automatic switching based on the time of day, thanks to community contributions. Feedback is encouraged to further refine the tool, with future updates focusing on simplifying releases and integrating GitHub.com functionalities into local workflows.

Repository administrators have a range of responsibilities, including managing access for organization members, outside collaborators, and teams, which has been simplified with a redesigned access page. The new design introduces a search bar and consolidates the Teams and Collaborators sections, allowing admins to filter by member type and manage access more efficiently. Understanding how permissions are inherited has been improved with a mixed roles warning that clarifies if a user's permission level exceeds their assigned role. Additionally, scalability issues have been addressed by introducing pagination, reducing timeouts by about 45% for repositories with large numbers of collaborators. The changes aim to enhance the admin experience by making access management more intuitive, efficient, and scalable, with updates visible when logging into a repository with admin privileges.

GitHub Sponsors offers a structured approach for individuals and organizations to receive funding for open source work, providing guidance on signing up and managing sponsorships. Individuals with a GitHub account can apply to become sponsored developers, sharing details about their open source contributions to determine eligibility for the GitHub Sponsors Matching Fund. Organizations with or without a bank account can also register for sponsorships, with the latter needing a fiscal host like Open Source Collective. The guide explains how to display sponsorship profiles and external funding options on project repositories using a FUNDING.yml file, making it easier to receive financial support. It also addresses the responsibility of sponsored developers to handle their own taxes, as GitHub does not deduct taxes from sponsorship payments. Additionally, it outlines how to credit other team members by updating the FUNDING.yml file to include their profiles, enabling collaborative acknowledgment.

Amid the challenges posed by the COVID-19 pandemic, a global community of scientists, government officials, journalists, programmers, and citizens has collaborated on various open-source projects with the goal of understanding and responding to the crisis. Notable efforts include the creation of widely-used COVID-19 datasets by institutions like Johns Hopkins University and the University of Washington, which provide real-time tracking and detailed patient data for research and public use. The COVID-19 Tracker project, initiated by The Atlantic and Related Sciences, emerged as a comprehensive source for U.S. testing and infection data. Additionally, initiatives like Folding@home and Nextstrain focus on epidemiological research and potential vaccine development, while visualization tools such as the Novel Coronavirus Infection Map and COVID-19 Dashboards offer insights into the virus's spread. Community-driven projects, like Italy’s real-time infection tracking and Wuhan2020's data service, exemplify the open-source ethos, while DIY projects like low-cost ventilators highlight grassroots innovation. GitHub has played a significant role in supporting these efforts, providing resources and platforms for collaboration, leading to a rapid increase in COVID-19-related projects and contributors, with over 6,000 contributors supporting more than 3,000 projects globally.

GitHub Actions enables users to automate workflows by integrating with familiar tools, allowing for innovative projects such as deploying to any cloud or building containers. In a series of interviews with early adopters, Shohei Ueda shared his journey from a computer science student in Japan to a creator of various GitHub Actions, including Hugo setup and mdbook Action. Ueda's passion for static site generators, particularly Hugo, led him to develop actions that automate building and publishing static sites to GitHub Pages, initially using Docker and later transitioning to TypeScript for greater flexibility and platform compatibility. He emphasizes the benefits of action sharing and matrix building in GitHub Actions and encourages the open-source community to share their projects and knowledge. Ueda also highlights the importance of using TypeScript for its strict type system and cross-platform support, which simplifies the development of reliable actions. The article invites readers to explore GitHub Actions further through resources like the Learning Lab course and the GitHub Marketplace while promoting an ongoing GitHub Hackathon.

Git 2.26 introduces several significant updates and features contributed by over 64 developers, including 12 new contributors. The release makes protocol version 2 the default for network fetch operations, enhancing efficiency by allowing clients to specify which references they're interested in, reducing unnecessary data transfer from servers. New configuration options such as --show-scope and wildcard support for credential URLs enhance usability and flexibility in managing settings. The sparse-checkout feature is improved with a new add mode, allowing users to add directories incrementally without re-specifying them each time. Performance enhancements include faster git grep operations across historical revisions and optimized partial clone operations using bitmap machinery. Additionally, both interactive and non-interactive rebases now use the "merge" backend, offering a more consistent experience when handling conflicts. These updates, along with improvements in worktrees and interaction with fsmonitor-like tools, aim to streamline Git's functionality and user experience.

The GitHub Student Developer Pack, which provides students with access to over a hundred premium tools and services, has enabled numerous innovative projects, including LATE, an open-source planning tool developed by Rensselaer Polytechnic Institute sophomore Frank Matranga. Originally conceived in high school, LATE has become a campus sensation, with 87 students testing it and over 600 on the waitlist, thanks to support from Rensselaer's open-source community and the Pack's resources. The Pack facilitated the project's development by offering tools for hosting, email communication, error tracking, and more, all of which were accompanied by comprehensive documentation and tutorials that eased the learning curve for Frank and his team. This experience not only advanced Frank's technical skills but also shifted his career aspirations towards project management, showcasing the transformative potential of the GitHub Student Developer Pack for student innovators worldwide.

The GitHub Security Lab team, led by Nico Waisman, navigates the complex emotional journey of vulnerability research with the aim of enhancing open source software (OSS) security beyond mere bug fixes. Recognizing the limitations of addressing single vulnerabilities, the team leverages GitHub's extensive OSS hosting capabilities to scale their efforts, aiming to convert individual vulnerability discoveries into numerous bug fixes. They focus on establishing community-driven workflows and feedback loops with developers and security experts to tackle vulnerabilities at scale, acting as facilitators to bolster the security of widely-used software. The team's collaboration with organizations like CERT exemplifies their strategy to empower others in the security community to contribute to a more secure OSS ecosystem.

Educators transitioning to remote teaching can utilize GitHub Classroom to manage online coding assignments effectively. The platform offers features like automated distribution, student participation tracking, progress checking, and autograded assignments, facilitating a seamless shift to digital learning. Through webinars and guides, GitHub Classroom provides support for creating private assignments, project ideas, and student assessments. Instructors can create organizations to house all course repositories, utilize starter code, and apply for GitHub Education benefits, which enable the creation of unlimited private repositories. Teachers can set up individual or group assignments, using tools like autograding and feedback pull requests to enhance student learning experiences. The platform also allows educators to review student submissions and progress efficiently, offering a streamlined approach to remote education.

GitHub announced the general availability of its mobile app for iOS and Android, offering a fully-native experience that allows users to manage tasks, respond to comments, and review and merge pull requests directly from their mobile devices. Following a successful beta phase, where testers engaged with nearly one hundred thousand pull requests and numerous team interactions, the app is now accessible via Google Play and the App Store for individual, Team, and Enterprise Cloud plans, with plans to support Enterprise Server later in the year. The mobile app aims to provide a seamless notification experience, enabling users to efficiently organize tasks, give feedback, and maintain workflow continuity from anywhere. GitHub is committed to further enhancing the app by adding new features and APIs.

Autograding tools are increasingly being integrated into computer science education to manage large classes and improve student outcomes. Professors like Dan Wallach from Rice University and Mike Zamansky from Hunter College have found that these tools not only save time by automating grading processes but also allow educators to provide more meaningful feedback on aspects that require human insight. By offering immediate feedback, autograding enhances student performance, as observed by Wallach, who noted a 20% improvement in grades. These tools also help reduce grading bias, providing a consistent and objective assessment, and can alleviate student stress by offering clear, impartial feedback. While Zamansky believes autograding is particularly beneficial for basic assignments, he acknowledges it accelerates students' path to proficiency. GitHub Classroom is highlighted as a platform that incorporates autograding, enabling educators to run tests on student submissions and provide constant feedback, thus enhancing the educational experience.

GitHub has swiftly adapted to the evolving global COVID-19 outbreak by prioritizing the safety and productivity of its employees and ensuring the resilience of its platform for developers worldwide. The company has transitioned its workforce to remote work, provided paid family leave, restricted business travel, and continued to pay hourly workers despite reduced services. GitHub is committed to maintaining its community's trust by ensuring robust security measures, including extensive data backups and redundancy, and providing uninterrupted customer support. The platform is integral to many business continuity plans and contributes to COVID-19 mitigation efforts. GitHub encourages engagement with its Social Impact Team's initiatives, such as the Open Source for Good program, to support public health projects.

GitHub has announced its acquisition of npm, a key player in the JavaScript ecosystem known for its extensive registry of over 1.3 million packages and 75 billion monthly downloads. This acquisition aims to enhance npm's infrastructure, ensuring it remains fast, reliable, and scalable to support the growing JavaScript community. GitHub plans to improve the user experience by investing in npm's core features, such as the npm v7 CLI, and introducing new functionalities like Workspaces and enhanced authentication processes. The integration of GitHub and npm will focus on improving open-source software security and enabling traceability from GitHub pull requests to npm package updates. Moreover, GitHub is committed to supporting npm's paying clientele and facilitating the transition of private npm packages to GitHub Packages, allowing npm to concentrate on being a premier public JavaScript registry. GitHub also plans to engage with the JavaScript community for feedback and future direction, while exploring opportunities to incorporate GitHub Sponsors into npm's framework.

GitHub Education has introduced new features to enhance the teaching of computer science through its platform, GitHub Classroom, and the newly launched GitHub Teacher Toolbox. With the integration of autograding in GitHub Classroom, educators can automate parts of the grading process, allowing them to focus more on providing personalized feedback and addressing complex student queries. This feature also enables students to receive immediate feedback, promoting iterative learning. The GitHub Teacher Toolbox offers educators free access to 35 industry-standard tools, such as Arduino and Name.com, to enrich classroom experiences. These initiatives aim to support teachers in integrating real-world developer tools into their curriculum, making technology education more accessible and effective worldwide.

Innersource is a methodology that applies open source development practices to closed source projects within companies, fostering collaboration, transparency, and efficiency across globally distributed teams. This approach encourages teams to make their code accessible, promoting a culture of openness that enhances code quality, speeds up the delivery process, and allows for the discovery and reuse of existing code. Companies like Ford, Zendesk, and Nationwide have embraced innersource to break down silos, improve security, and facilitate innovation by enabling self-service project creation. By adopting these practices, organizations can leverage the collective expertise of their workforce, reduce redundancies, and maintain high standards of security and quality, ultimately transforming the way proprietary software is developed across industries.

Comcast Open Source Program Manager Shilla Saebi emphasizes the critical importance of engaging with open source to avoid being left behind, a sentiment echoed by many enterprises that are increasingly investing in open source to drive innovation at scale. The benefits of open source engagement include accelerated development, as organizations can leverage the global community’s resources and ideas, leading to faster innovation than any single entity could achieve alone. Open source also enhances code security by allowing more contributors to identify potential vulnerabilities, thereby improving overall safety. Furthermore, it aids in recruiting and retaining talent, as top developers are drawn to companies actively participating in open source projects, which also improves developer tools and productivity. Organizations like Stripe and Comcast demonstrate that active participation in open source not only improves their products but also reduces costs by utilizing existing code and focusing resources on unique features, thus marking a strategic shift in how software is developed and encouraging enterprises to lead in this collaborative ecosystem.

In response to the evolving COVID-19 pandemic, GitHub has prioritized the health and safety of its employees and community while maintaining its global operations. The company has paused all non-essential travel and encourages remote work, leveraging its established systems for virtual collaboration as a distributed team. GitHub's offices remain open, with flexible work-from-home options and enhanced cleaning measures, particularly in San Francisco and Europe. Additionally, GitHub has shifted its annual Satellite conference to a virtual format on May 6, 2020, to continue fostering community engagement without physical gatherings. These measures aim to support the community and prevent disruptions while closely following guidance from health organizations.