April 2020 Summaries

Brian Douglas shares insights on enhancing productivity and engagement in open-source projects on GitHub, emphasizing the importance of forming connections within the community and using tools like GitHub's contribute feature to find beginner-friendly issues. He highlights the utility of project boards for tracking issues, subscribing to relevant conversations to stay updated, and leveraging automation through GitHub Actions to streamline project maintenance. Douglas also discusses the benefits of curating topics to organically attract contributors and suggests utilizing saved replies for efficient communication. He encourages the use of the triage role for onboarding new contributors and invites readers to explore advanced GitHub features at the virtual GitHub Satellite event.

DevSecOps is an evolution of the DevOps approach that integrates security into the development and operations pipeline, emphasizing the importance of addressing security vulnerabilities early in the development process to ensure safer applications. This approach advocates for a developer-first mentality, where developers are empowered to address vulnerabilities during code review, reducing the occurrence of costly fixes later in production. The shift involves prioritizing high-quality, impactful bug reports while minimizing false positives, as demonstrated by improved bug fix rates at companies like Facebook and Pinterest through the integration of static analysis and automation. Overcoming entrenched habits and fostering collaboration between security and development teams is crucial, with security becoming a shared responsibility throughout the organization. This cultural shift is supported by tools and workflows that developers are familiar with, ensuring security is an inherent part of the development process from the outset, as seen in practices at Dow Jones.

The text details a technical exploration of use-after-free vulnerabilities discovered in the Web Audio module of Google Chrome, focusing on a specific bug triggered by a data race. It describes the intricacies of how the Web Audio API operates, particularly the roles of BaseAudioContext, AudioNode, and AudioHandler in creating and managing audio processing graphs. The document explains how a vulnerability, initially reported by Kaspersky researchers and further analyzed by Google Project Zero, can be exploited through a data race condition when accessing AudioHandler objects. The author delves into the conditions necessary for triggering the bug, including garbage collection timing and thread synchronization challenges, and provides insight into potential methods for achieving a consistent exploit by manipulating memory pressure and using AudioWorkletNode for timing control. The analysis emphasizes the complexity and difficulty of reliably exploiting this vulnerability, highlighting the necessity of precise timing and repeated attempts to achieve the desired outcome.

GitHub's remote work culture, which predates the COVID-19 pandemic, emphasizes strong communication, empathy, and intentional practices to maintain collaboration and trust within its globally distributed teams. Dana Lawson, VP of Engineering, Product, and Sha Ma, VP of Community and Ecosystem Engineering, share insights on humanizing remote work through genuine communication, empathy for personal disruptions, and the importance of written communication. They highlight the use of modern tools and diverse communication channels to align teams, the need for flexible scheduling, and the benefits of asynchronous communication for teams spread across time zones. Strategies such as the buddy system for new hires and encouraging the use of video in meetings help foster connection, while emphasizing the global nature of GitHub's operations enhances the sense of community among employees. Both leaders express a deep appreciation for the global connectivity and collaboration that remote work facilitates, viewing it as a pathway to advancing human progress and creating better products.

A GitHub staff member shares personal experiences and practical tips for newcomers to Git and GitHub, emphasizing the importance of experimenting with both GUI and CLI tools for git commands to find what suits individual preferences. They highlight the significance of setting up dotfiles for terminal customization, creating a GitHub Pages site for practical experience, and understanding the GitHub Flow for collaboration. To address the challenge of merge conflicts, they recommend practicing in a controlled environment and utilizing GitHub's user interface for resolution. The author encourages making open source contributions, starting with documentation, and suggests taking classes or tutorials to enhance learning. The post concludes with an invitation to share GitHub productivity tips on social media using the hashtag #GitHubProtips.

GitHub has made its new web notifications experience the default for all users, replacing the classic interface to enhance productivity and responsiveness across repositories, organizations, or teams. The updated system allows for customizable workflows and integrates seamlessly with GitHub Mobile, ensuring notifications are accessible and organized consistently. The transition was informed by user feedback collected during a beta phase, revealing that users are more engaged, reading notifications 2.5 times more frequently and 15 hours sooner when mentioned. GitHub remains committed to refining this feature by adding more filters and controls based on ongoing user feedback.

GitHub Actions, a CI/CD and automation tool, has seen rapid adoption since its general availability, offering features like artifact and dependency caching, self-hosted runners, and an extensible Actions API. The platform allows developers to automate workflows by utilizing a vast array of pre-existing actions available in the GitHub Marketplace, which has grown significantly with over 3,200 actions. This growth is fueled by contributions from the community and partnerships with companies like DigitalOcean, Tencent Cloud, and Docker. GitHub Actions is particularly beneficial for teams and enterprises, providing features such as shared self-hosted runners and custom runner labels, which help optimize resource usage and streamline workflow management. The platform continues to enhance its offerings with improved daily developer experiences and plans to introduce more security and compliance features, including GitHub Enterprise Server integration. GitHub encourages developers to explore their resources, such as the GitHub Learning Lab, and participate in upcoming virtual events to further engage with the community and expand their automation skills.

GitHub Satellite is hosting a virtual event on May 6, featuring a full day of free product talks, protips, and code-powered musical performances across two live stream tracks for work and play. Attendees can tune in for any or all of the 12-hour event, with sessions available on demand afterward. The event includes a lineup of inspiring speakers such as Luca Cipriani, Ivan Pashchenko, Alexandra Cardenas, Maya Kaczorowski, and Sam Aaron, covering topics from automating testing with GitHub Actions to securing software dependencies and live coding performances. Additionally, workshops on May 7 are available for a $50 fee, with proceeds going to COVID-19 response efforts. Attendees can expect to gain insights into software development, security, and creative coding from experts while enjoying engaging performances and discussions.

Scheduled reminders have transitioned out of beta and are now available to help teams manage and expedite code reviews by sending daily notifications of pending pull requests directly to their Slack channels. This feature allows teams to customize the frequency and filters of these reminders to prioritize important reviews and minimize delays, ultimately improving workflow efficiency. In addition to team notifications, organization account members can also receive personalized reminders and real-time Slack updates about pull requests that need attention or are ready to merge, aiding in faster completion of their tasks. The scheduled reminders feature is accessible to organizations that have installed and enabled the GitHub and Slack integration.

Git has released version 2.26.2 to address a vulnerability in the credential helper mechanism that was not fully resolved in the previous update, v2.26.1. This vulnerability could allow a malformed URL to create a credential pattern with blank fields, potentially causing credential leaks to untrusted sources. While some credential helpers, like Git's own store and cache helpers, are vulnerable, others like the Git Credential Manager for Windows are unaffected. Users are advised to upgrade to v2.26.2 to secure against these issues, and in the interim, avoid using credential helpers with untrusted repositories. GitHub has implemented additional protective measures, including blocking malicious .gitmodules and preparing a new release of GitHub Desktop to mitigate the exploit. The discovery and analysis of these vulnerabilities were credited to Carlo Arenas and Jonathan Nieder from Google.

GitHub's remote work culture is deeply rooted in asynchronous communication, which aligns with the open-source community's workflow. This approach emphasizes flexibility and reduces the need for simultaneous collaboration, allowing for better life balance, especially during unexpected home-working situations. Ben Balter, a Senior Product Manager at GitHub, underscores the importance of cultural guidelines for effective remote communication, highlighting the need for meaningful discussions through appropriate channels like Zoom for high-fidelity interactions. Feedback should be thoughtful, avoiding unnecessary comments and providing context to minimize cognitive load on collaborators. The use of emojis and GIFs aids in conveying tone in digital communications, while efficient setups, like good microphones and world clocks, enhance remote work productivity. The series continues to explore best practices for remote work, encouraging the sharing of these insights to assist those new to the environment.

Jason Etcovitch shares insights into enhancing productivity and efficiency through innovative uses of GitHub's API, Actions, and Probot. GitHub Actions serve as a versatile tool for automating tasks within repositories, allowing users to run custom code in response to events, while Probot provides a framework for building GitHub Apps that react to webhook events. He highlights features such as creating dynamic content with pinned Gists, automating branch deletions post-merge, and using GraphQL for retrieving detailed resource information. Additionally, Etcovitch emphasizes the utility of URL extensions for accessing avatars and commit diffs, encouraging developers to explore and share their own tips through the #GitHubProtips initiative.

GitHub Sponsors has expanded its availability to Mexico, allowing developers with a bank account in Mexico or in any of the other 31 countries where the program is no longer in beta to sign up and receive financial support for their open-source work. The platform has introduced several enhancements to improve the experience of sponsored developers, including a guide for getting started, an activity feed to track sponsorships, the ability to export sponsor data for better financial management, and automation through webhooks for various sponsorship events. Community-driven projects are also contributing to the improvement of the platform, with tools like alexellis/sponsors-functions and jasonetco/is-sponsor-label-action adding functionalities such as forwarding sponsorship events to Slack and labeling issues based on sponsorship status.

GitHub has successfully acquired npm, ensuring that the public npm registry remains free and accessible to the millions of developers who rely on it. With npm now integrated into GitHub, the focus will be on engaging with the community, investing in the registry's infrastructure and platform, and enhancing the core user experience. This acquisition marks a new chapter for npm and aims to provide robust support to the JavaScript community, as detailed in blog posts from both GitHub and npm.

New versions of the Git project have been released to address a security vulnerability in the credential helper mechanism affecting versions 2.26 and older, which allows arbitrary data injection into the credential helper protocol stream via a malformed remote URL. Users are advised to upgrade to version 2.26.1 to mitigate the risk, and if unable to update immediately, to avoid running git clone with untrusted repositories and using the credential helper. GitHub has also implemented measures to protect against these attacks, including changes to prevent malicious .gitmodules files and a scheduled GitHub Desktop release, as well as patching GitHub Enterprise to address the vulnerability. The vulnerability was discovered by Felix Wilhelm of Google Project Zero, and the fixes are being incorporated into supported release series with further updates planned.

GitHub has been targeted by a phishing campaign that deceives users into clicking malicious links under the guise of account changes or unauthorized activity, leading to credential theft through fake login pages. The attackers exploit compromised domains and utilize tactics like URL-shortening and PHP-based redirects, aiming to capture credentials and bypass two-factor authentication unless hardware security keys are used. Once credentials are stolen, attackers may create personal access tokens or authorize OAuth applications to maintain access, often downloading private repository contents. GitHub is actively monitoring for phishing sites, filing abuse reports, and enhancing security features, encouraging users to reset credentials, use hardware security keys, and employ password managers for protection. Users are advised to verify URLs and report phishing attempts to GitHub Support, with several known phishing domains already identified and taken offline.

GitHub has announced that it is making private repositories with unlimited collaborators available for free to all users, granting access to core features such as CI/CD, project management, and code review without requiring a paid plan. Previously, organizations needed to subscribe to a paid plan for private development, but this change aims to eliminate cost barriers and allow more developers to collaborate efficiently on the platform. Additionally, GitHub has reduced the price of its paid Team plan from $9 to $4 per user per month, providing cost savings for existing customers who will see their bills automatically reduced. For teams requiring advanced or enterprise features, paid plans are still available, offering options such as code ownership and SAML support.

GitHub has embraced remote work for over a decade, which has equipped it well to handle the increased virtual collaboration necessitated by the COVID-19 pandemic. With a workforce that is both diverse and globally distributed, GitHub focuses on ensuring that its employee experience remains consistent regardless of location. This is achieved through robust communication tools like GitHub, Slack, and Zoom, and by offering remote work benefits comparable to those of office-based employees. GitHub places a strong emphasis on collaboration, clear communication, and creating a sense of belonging through shared interests and inclusive practices. The company supports career growth for remote employees and has developed its recruiting and employee programs to be systematic and free from discrimination. GitHub's commitment to diversity and inclusion is evident in its unique interview process, and its approach to remote work is designed to support employees worldwide by considering local contexts and providing necessary resources. The company advises others to intentionally foster connection and belonging within distributed workforces, showcasing their commitment to remote work through practices like virtual interviews.

The transition of the GitHub JavaScript SDK from the legacy "github" module to the modernized "@octokit/rest" reflects a journey of extensive restructuring and automation to enhance maintainability and adaptability. Initially inherited as a sizeable, monolithic codebase, Gregor Martynus spearheaded the transformation by introducing scripts for automatically updating API endpoints, decomposing the library into smaller, modular plugins, and implementing comprehensive testing to ensure reliability. This restructuring allowed for separating authentication strategies into distinct packages, reducing overall code complexity, and enhancing user flexibility across various JavaScript environments. The updated architecture not only ensures full coverage of GitHub's REST API endpoints but also integrates best practices for pagination, throttling, and request retries, positioning the library as a comprehensive solution for modern JavaScript applications. As the project evolved, it embraced TypeScript for improved code validation, and with version 17, it stands poised to support all authentication strategies and GraphQL requests, thanks to the foundational work laid by previous contributors and the ongoing efforts of the Octokit team.

The GitHub Actions Hackathon, held entirely online, attracted global participation and resulted in over 700 submissions showcasing creativity and innovation in automating workflows. Participants created a diverse range of GitHub Actions, such as checking website statuses, posting on Reddit, and recognizing contributions with Slack emojis. Notable entries included Action Cats, which rewards pull requests with cat gifs, Actions Label Commenter for automating issue management, and Misspell Fixer for correcting code typos. The event emphasized the open-source nature of these tools, allowing others to freely use and adapt them. Participants were thanked for their involvement, with SWAG packs promised for eligible contributions. The success of the hackathon has set the stage for future events, with updates to be shared on GitHub's Hackathon website and social media channels.

This blog post, written by Lee Reilly, shares a collection of GitHub tips and tricks accumulated over a decade of experience working in various roles at the company. It covers a range of topics including browser extensions, URL hacks, keyboard shortcuts, and advanced Markdown formatting techniques to enhance the GitHub user experience. Among the highlights are the fuzzy file finder, the Octotree browser extension for easier navigation, and useful notification tools. The post also provides insights into linking code snippets, optimizing Markdown for creative purposes, and engaging in URL-hacking to explore new projects. Additionally, it humorously touches on personalized metrics and even an exercise app that generates Morse code through laptop movements. The content is peppered with lighthearted dad jokes and encourages readers to share their own GitHub tips on social media.

Open Source in the Social Sector, a paper by GitHub Social Impact’s Open Source for Good program, explores the role of open-source software (OSS) in advancing societal issues tackled by non-governmental organizations. The research project involved literature reviews, surveys with over 350 participants, and 55 qualitative interviews to understand the use and contribution dynamics of OSS within the social sector, categorizing participants as consumers, producers, or funders. The findings highlight how OSS can enhance programmatic work and operations in the social sector by integrating Agile and Human-Centered Design principles, creating custom technology deployments like mobile public health applications, and streamlining funding for infrastructure. The paper offers actionable insights for technology implementers, funders, developers, and platform providers, aiming to inform ongoing and future projects such as the MERL Center while serving as a resource for both the social sector and open-source communities to leverage the gathered information.

In an interview celebrating Git's 15th anniversary, GitHub's Jeff King speaks with Git maintainer Junio Hamano about his journey with Git, starting shortly after Linus Torvalds announced its first version in 2005. Hamano reflects on his initial involvement, driven by a desire to support Torvalds' efforts and help him return to kernel development. He became Git's maintainer through dedication and collaboration within a diverse community of developers. Hamano highlights features like rename detection and line origin tracking, expressing pride in the collaborative development culture that emerged. Despite some regrets over early design choices, such as the command line syntax for "git diff," he appreciates Git's impact on software development, particularly its distributed nature that allows developers to refine their work in private before publicizing it. This distributed approach has helped programmers improve their skills over time. Hamano also expresses fondness for the "tig" tool and encourages engagement with Git's development community through its mailing list and GitHub repository.

A seasoned GitHub user shares productivity tips and tricks to enhance the GitHub experience, emphasizing the use of tools like Magic Markdown tables for easy table conversion and efficient bug-fixing methods on corporate websites. They highlight the importance of using GitHub notifications as a primary communication tool over email for better transparency and collaboration. To streamline workflow, the author has developed Chrome extensions such as Markwrap for quick markdown linking, GitHub Red Alert for notification alerts, and GitHub Open All Notifications for managing pending tasks. Additionally, they use GitHub Projects to manage a personal and professional to-do list, and recommend utilizing semantic navigation for a quick overview of code review complexity. Encouraging community engagement, the author invites others to share their GitHub productivity tips on social media.