May 2020 Summaries

GitHub Actions provides developers with a platform to automate workflows, connect with familiar tools, and foster creativity in software development. Adam Dobrawy, a passionate computer science enthusiast, leveraged GitHub Actions to create GitHub Push, an action that automates the committing of changes to a Git repository, eliminating the need for a virtual machine and reducing administrative costs. This innovation allows for seamless integration with tools like Asana, enhancing task management and documentation processes. Despite challenges such as build times, Adam found solutions through the use of JavaScript, which reduced execution time significantly. He values the integration capabilities of GitHub Actions, particularly the use of GITHUB_TOKEN, and emphasizes the importance of community collaboration in open-source projects. Adam plans to further develop solutions that facilitate continuous deployment and enhance user experience in cloud services, demonstrating the potential of GitHub Actions in streamlining development workflows and encouraging community engagement.

Summer of Making is a global, free, remote summer program for teenagers aged 13-18, organized by Hack Club to foster community and innovation among students amid limited access to traditional facilities due to quarantine. Running for six weeks starting in July, the program provides participants with hardware support, mentorship from industry professionals, and access to developer tools, enabling them to build projects like Arduino robots and open-source games. Hack Club, a student-led network of computer clubs, supports this initiative by offering a platform for students to connect, collaborate, and showcase their creations. The program also seeks mentors from various professional backgrounds to guide students, highlighting the transformative impact of Hack Club's community in helping students explore and develop their technology interests.

The Octopus Scanner incident highlights a significant security threat to the open-source supply chain, focusing on malware that specifically targets the NetBeans Integrated Development Environment (IDE) to spread itself through infected build processes and artifacts. Initially discovered by security researcher JJ, the malware was found in multiple GitHub-hosted repositories, unbeknownst to their owners. It operates by embedding malicious payloads in NetBeans project files and build artifacts, which then execute upon each project build, potentially spreading the infection to downstream systems that clone or use these artifacts. Despite its low detection rate, the malware employs sophisticated techniques to ensure persistence and evasion, including modifying build scripts and using obfuscation methods. GitHub's Security Incident Response Team (SIRT) worked to contain the spread without penalizing the repository owners, who were likely unaware of the compromise. This incident underscores the importance of robust security measures in the software supply chain, prompting GitHub and the broader security community to enhance detection and prevention strategies.

GitHub has transitioned its Support Community to the Discourse open-source platform to enhance user experience with several new features. This move emphasizes the importance of open-source software and allows the community to benefit from a variety of community-created plugins, themes, and UI components. The platform now offers robust Markdown support, including CommonMark with GitHub-flavored extensions, for a seamless editing experience similar to GitHub itself. The new responsive design ensures an improved experience across all devices, including mobile and tablets, and introduces various user experience improvements such as easier post navigation, enhanced search functionality, and customizable reading experiences. These changes aim to make the Support Community more intuitive and engaging for both new and existing members.

GitHub Classroom has integrated with online integrated development environments (IDEs) like Repl.it and Microsoft MakeCode Arcade to facilitate coding assignments for students across different devices without software conflicts. These online IDEs allow students to work within a web browser, enabling them to start assignments quickly and collaborate in real-time, regardless of their device. Repl.it supports multiple programming languages and offers features like private and public assignments, and real-time group collaboration through its Multiplayer sessions, while MakeCode Arcade provides an accessible interface for developing retro arcade games using block programming, supporting a variety of physical computing devices. These integrations allow educators to manage student assignments effectively and utilize GitHub's collaboration features to track both individual and group work, streamlining the teaching process and enhancing the learning experience.

GitHub has introduced a feature within its Security Advisories called advisory credits, allowing maintainers to formally acknowledge and thank contributors who help identify vulnerabilities, create fixes, or provide support. This feature was developed in response to feedback from maintainers who expressed a desire to recognize contributors' efforts more visibly. When editing a Security Advisory, maintainers can add credits by searching for a GitHub user and assigning them a credit, which the recipient can choose to accept or decline. Once accepted, the credit is displayed both in the repository and the GitHub Advisory Database, acknowledging the collaborative efforts that are crucial to securing open-source software. This initiative aims to celebrate the contributions and collaborations within the community, highlighting the importance of collective effort in maintaining software security.

In the article, two GitHub employees, Cindy Alvarez and Simon Taranto, share their experiences and strategies for balancing work and parenting during the COVID-19 pandemic. Both emphasize the importance of flexible work schedules and open communication with their partners to manage childcare and work commitments effectively. They discuss the challenges of working from home with children and highlight the value of asynchronous communication and supportive networks like GitHub's #parents Slack channel. Cindy and Simon also stress the necessity of self-care activities, such as exercise and maintaining connections with friends and family, to manage stress and maintain productivity in this challenging environment. Their insights offer a practical perspective on navigating remote work while juggling family responsibilities.

In April, GitHub.com experienced three significant service interruptions, resulting in 5 hours and 36 minutes of degraded services due to various misconfigurations affecting internal routing, database connections, and networking switches. The first incident was caused by a misconfigured software load balancer, the second by database connection issues during data partitioning efforts, and the third by an erroneous networking configuration that propagated excessive routes. These disruptions highlighted gaps between staging and production environments, prompting GitHub to enhance its engineering processes by building a network staging environment for continuous integration and focusing on comprehensive software coverage. GitHub is committed to improving reliability and has pledged to address these issues to maintain user trust.

Organization secrets enhance security and efficiency by allowing sensitive information, such as access tokens, to be stored and managed at the organization level within repositories. This system reduces manual duplication and the risk of workflow failures due to outdated secrets by enabling easy sharing, updating, and automatic synchronization across multiple repositories. Organization admins can control which repositories have access to these secrets and update them as needed, ensuring seamless management. Additionally, the GitHub Actions API now supports organization secrets, facilitating the integration of automated provisioning processes for both public and private repositories within organizations on specific GitHub plans.

Sarah Vessels, a GitHub engineer, shares her strategy for managing large pull requests by initially coding all changes in a single branch and later extracting smaller, more focused branches for review. This approach allows her to maintain creative flow and verify that her code functions as expected before organizing it into bite-sized, easily reviewable segments. Vessels uses git cherry-pick and GitHub's pull request features to separate atomic changes into distinct branches, ensuring thorough testing and reducing the cognitive load on reviewers. By "daisy-chaining" these smaller branches, she creates a sequence where each branch builds on the previous one, allowing for efficient merging once dependencies are resolved. This method balances her desire for an uninterrupted coding process with the need for manageable and well-reviewed code integration, ultimately improving team collaboration and code quality.

GitHub has been transitioning parts of its Rails monolith to Go, focusing on performance-critical components, such as the new authorization service "authzd," which interacts directly with production MySQL databases. This transition has uncovered challenges, including a persistent "Invalid connection" error within the Go MySQL driver, attributed to the aggressive idle timeout settings on GitHub's MySQL servers. The error was resolved by implementing a connection health check using non-blocking reads, which reduced overhead and improved service availability. Additionally, GitHub addressed a context handling issue in the Go MySQL driver that caused request timeouts to be ignored, necessitating a significant refactor to ensure context awareness throughout the connection lifecycle. A critical data race issue was also identified, related to the driver returning borrowed memory during SQL queries, which could lead to corrupted data when contexts were canceled mid-query. The solution involved implementing a double buffering technique to prevent data corruption without significant performance regressions. These improvements, now part of the Go MySQL driver's 1.5.0 release, highlight the complexities of deploying a new programming language at scale and GitHub's commitment to enhancing the Go ecosystem.

The 46th Ludum Dare competition concluded with a remarkable turnout of 13,000 participants who created nearly 5,000 games in just 72 hours, centered around the theme "keep it alive." Highlighted games from this event include "Tower Defence of the Heart" by Terry Cavanah, "Flock for Feast" by Antti Haavikko, and "Flippy Fish" by Axel Signargout and team, among others, showcasing a variety of genres and creative interpretations of the theme. The games, available across multiple platforms such as Web, Windows, macOS, and Linux, demonstrate the diverse talents of developers working with different engines like Unity, Godot, and TIC-80, and offer both entertainment and source code for experimentation. The event, celebrated for its community spirit and innovation, is scheduled to return from October 2-5, 2020, inviting more developers to join in the creative challenge.

GitHub's transition to remote work has been a varied experience for its teams, particularly those previously based entirely in office environments like the finance and IT departments. While the company has long embraced remote-first practices, the shift necessitated by the pandemic posed challenges and opportunities for teams less accustomed to working from home. Employees like Leithia Williams, Shannon Hines, and Adnan Alam describe adapting to new routines, emphasizing the importance of asynchronous communication, empathy, and maintaining a work-life balance. The finance team, initially anxious about remote month-end closings, found success and questioned the necessity of returning to office-based processes. Meanwhile, the IT team faced increased support requests while learning to balance professional and personal dynamics in a home setting. Despite the challenges, GitHub employees express gratitude for their supportive work environment, acknowledging the emotional and social difficulties of prolonged remote work but also recognizing their fortunate circumstances compared to other industries.

GitHub offers a variety of tips and features aimed at enhancing user productivity and efficiency, as shared by GitHub's Luke Hefson. Key strategies include using issue template configuration to streamline planning and tracking processes, with notable projects like VS Code and React already benefiting from these practices. Hefson also highlights the art of deep linking to specific content within GitHub repositories, which can enhance navigation and sharing. Additional tips include leveraging search queries using @me for personalized tracking and employing Markdown formatting to organize comments efficiently. Users with write access can create new issues directly from comments, enhancing project management. Hefson encourages the sharing of GitHub tips on social media, fostering a community of knowledge exchange.

GitHub Insights, a new product previewed at GitHub Satellite, aims to provide meaningful development metrics and is a result of collaboration with the team from development analytics startup Gitalytics, which recently joined GitHub. The Gitalytics team is enthusiastic about aligning with GitHub's mission to promote transparency, collaboration, and developer advocacy. Transitioning from a startup environment to GitHub, the team has adapted to a largely remote working setup, emphasizing transparent communication and shared goals. This shift allows them to focus more deeply on product development, targeting both large and small engineering teams, and balancing speed with the advantages of scale. They acknowledge the responsibility of creating a product that can significantly influence software development practices and are committed to evolving GitHub Insights into a social, extensible platform that embodies their values and vision.

GitHub Sponsors, initially launched in beta for organization accounts to receive funding, is now available in 32 regions, aiming to support open-source projects by allowing organizations to receive financial backing. This initiative, which incurs no payment processing fees, ensures that 100% of donations go directly to the sponsored projects, thereby benefiting developers and maintainers who advance technology through open source. Over 500 organizations participated in the beta, and with positive feedback, GitHub Sponsors seeks to expand its reach further. The platform has already facilitated significant contributions to projects like Homebrew and ESLint, enhancing their capabilities and reducing fundraising efforts. Organizations can join by setting up a corporate bank account or using a fiscal host such as Open Collective, NumFOCUS, or the Software Freedom Conservancy. GitHub commits to developing more tools to simplify and enhance funding processes for open-source projects.

GitHub Desktop's 2.5 release introduces the long-awaited feature of Git tags, allowing users to mark specific points in their project's history directly from the application. This enhancement, driven by user feedback, eliminates the need for command-line operations to create tags, thereby streamlining workflows by integrating tagging into the local GitHub Desktop environment. When users push to GitHub.com, any tags created are automatically included, and notifications are provided to ensure that unpushed tags are not overlooked. The update reflects GitHub's ongoing commitment to enhancing user experience by reducing context-switching and supporting a more seamless workflow, as discussed in Neha Batra's session at GitHub Satellite.

The text examines common security vulnerabilities related to integer arithmetic, particularly in memory-unsafe languages like C, using the ntop Deep Packet Inspection toolkit (nDPI) as a case study. It highlights how attacker-controlled input, such as remote integer values, can lead to memory overflows and potential remote code execution (RCE) by manipulating integer arithmetic. The analysis reveals specific vulnerabilities in nDPI's SSH and Postgres protocol dissectors, where integer overflow allows controlled remote heap overflow and out-of-bounds reads, leading to Denial of Service (DoS). These issues were reported and addressed, but further scrutiny revealed additional vulnerabilities due to platform-specific integer handling. The document emphasizes the importance of thorough code audits and the use of tools like CodeQL to identify patterns of vulnerability, advocating for defensive programming practices and careful consideration of integer operations to mitigate such risks.

GitHub's annual conference, Satellite, transitioned to a virtual format due to the COVID-19 pandemic, requiring the team to rapidly adapt their strategies for a successful online event. The shift highlighted the importance of remote collaboration, leveraging GitHub's experience with asynchronous communication and remote-first practices to engage a wider audience. Key challenges included selecting the right digital platform, creating engaging content, and providing interactive experiences, such as virtual "rooms" for attendee interaction. Team members like Sherrine Tan, Brandon Rosage, and Brian DeMott shared insights on maintaining productivity and team cohesion in a remote setting, emphasizing the significance of personal connections, clear communication, and flexibility. They also discussed the emotional impact of remote work during the pandemic, underscoring the need for empathy and open communication. As GitHub's remote-first approach facilitated collaboration across global teams, the company recognized the value of trust and autonomy in remote work while offering advice for those new to this environment, such as maintaining routines and ensuring self-care.

The report analyzes GitHub developer activity during the early stages of the COVID-19 pandemic, focusing on productivity, work cadence, and collaboration. Conducted by GitHub's Data Science Team, the study highlights how the global shift to remote work affected developers' routines and work-life balance. Despite the challenges, developer activity, including pushes and pull requests, largely remained consistent or increased compared to the previous year, indicating resilience in the face of uncertainty. The report also notes changes in work cadence, with longer workdays, particularly on weekends, and emphasizes increased collaboration in open-source projects. Such trends suggest that while remote work has extended work hours, it also fostered greater engagement with open-source communities. The study cautions against potential burnout due to blurred boundaries between work and personal life, urging organizations to adopt flexible work practices to maintain productivity and well-being. The report aims to provide insights for navigating the ongoing changes in work environments and encourages further analysis in future Octoverse reports.

GitHub announced the introduction of code scanning utilizing CodeQL analysis at GitHub Satellite, aimed at enhancing repository security through community-powered queries. To promote learning and skill enhancement in CodeQL, GitHub is hosting a Capture the Flag (CTF) challenge, where participants will identify a security vulnerability in a container management platform that leads to a Remote Code Execution (RCE) vulnerability. This challenge will teach participants how to use CodeQL's taint tracking features to trace data flow paths to vulnerabilities. Additionally, GitHub is offering workshops and resources, such as tutorials and training sessions, to help participants prepare for the challenge and improve their ability to write CodeQL queries. The initiative is spearheaded by the GitHub Security Lab, which aims to inspire and support the community in securing open source software.

GitHub's first virtual conference, Satellite, introduced several new products aimed at enhancing collaboration and security within software communities. The company made GitHub free for teams earlier this year to eliminate cost barriers and expanded GitHub Sponsors to support developers in over 30 countries. New offerings include Codespaces, a cloud-hosted development environment integrated with GitHub, and GitHub Discussions, a platform for community collaboration outside of codebases. Additionally, GitHub announced code scanning and secret scanning to improve code security and introduced GitHub Private Instances for enterprises with stringent compliance needs. These initiatives are part of GitHub's broader effort to support a global developer ecosystem and enhance the way communities collaborate and secure their code.

Amidst the challenges posed by the global pandemic, students worldwide have shown remarkable ingenuity, exemplified by Ben Sassoon, a computer science student who developed an online tool called "How Much Toilet Paper" to address panic buying. Created using resources from the Student Developer Pack, this tool allows users to calculate the duration of their toilet paper supply by entering the number of rolls they have and their usage frequency. Inspired by a joke with his friend Sam Harris, Ben's creation aimed to mitigate panic buying by highlighting that the average user had 500% more toilet paper than necessary. The tool quickly gained massive popularity, reaching over a million users globally within five days and receiving coverage from major media outlets like CNN and The Tonight Show. Ben's experience underscores the potential for students to create impactful solutions using accessible technological tools, encouraging others to pursue their ideas despite potential obstacles.

GitHub Education, in collaboration with Major League Hacking (MLH), has launched the MLH Fellowship, a remote program designed to adapt to the evolving work culture and support the next generation of developers. This 12-week initiative connects small groups of students with open source projects and mentors, offering them a stipend through GitHub Sponsors and engaging them in real-world workflows and collaboration. The program aims to democratize access to internships by accommodating students globally, thus providing an alternative to traditional internships that are often geographically restrictive and highly competitive. With support from partners like Facebook, DEV, and the Royal Bank of Canada, the MLH Fellowship aspires to cultivate a workforce trained in meaningful software development, addressing the increasing demand for skilled graduates and shaping the future of work.

Successfully managing a global team requires exceptional leadership, strong communication skills, cultural awareness, and empathy, as highlighted by GitHub leaders Maneesh Sharma and Bassem Asseh. Both leaders emphasize the importance of seamless experiences for remote employees, akin to those in-office, to foster a robust work culture, while being mindful of the potential loneliness of remote work. Effective collaboration involves including the right individuals early in discussions to prevent productivity loss. The COVID-19 pandemic has accelerated the acceptance of remote work, making video conferencing a norm and reducing the need for extensive travel, which has improved productivity and connectivity with clients and partners. Maneesh and Bassem also stress the importance of respecting time zones and individual preferences in communication to facilitate smooth international collaboration. They value the reduced need for commuting, which enhances efficiency, and advise remote workers to create a clear separation between work and home life, leveraging technology while being mindful of personal interactions during sales processes.