September 2020 Summaries

Earlier this month, the OpenJDK Community successfully migrated to GitHub through Project 'Skara', which involved transitioning JDK 16 main-line development from self-hosted Mercurial servers to Git and GitHub. This significant effort, led by the Java Platform Group at Oracle, required the development of custom CLI tooling, bi-directional bridging with OpenJDK mailing lists, and integration with the OpenJDK bug tracking system. The migration also included adopting GitHub Actions for CI builds and creating integrations with the GitHub API, all of which are now open source. The move allows the OpenJDK projects to utilize GitHub's features for Java developers, such as free code scanning for security vulnerabilities and semantic code navigation. The OpenJDK now joins other popular Java projects on GitHub like Gradle, Maven, and Elasticsearch, marking a new chapter for the Java community on the platform.

GitHub has announced the general availability of its code scanning feature, which is a developer-centric tool designed to identify security vulnerabilities in code before they reach production. This tool is powered by CodeQL, a sophisticated code analysis engine, and is integrated with GitHub Actions to seamlessly automate security within the development workflow. Code scanning focuses on actionable security rules and can run custom or community-contributed CodeQL queries to detect and prevent security issues like remote code execution and SQL injection. Since its beta launch, code scanning has been adopted by the community, scanning over 12,000 repositories and identifying more than 20,000 security issues, with a notable 72% of these being resolved before merging in the last 30 days. The feature supports extensibility through the open SARIF standard, allowing integration with third-party security tools and providing a unified interface for viewing results. Code scanning is free for public repositories and available as part of GitHub Advanced Security for private repositories, with users like Auth0 and McKesson Labs praising its effectiveness in improving security efficiency and confidence.

GitHub Actions offers powerful automation capabilities, enabling developers to streamline workflows by connecting with familiar tools and freeing up time for innovation. A prime example is James Ives' GitHub Pages Deploy Action, which simplifies the deployment process to GitHub Pages, allowing configurations to automate necessary Git commits on new releases or pushes, even from the web interface. This tool emerged from James' necessity to automate tasks and his passion for open source, ultimately leading to a modular, community-appreciated solution available on the GitHub Marketplace. Developers, including James, appreciate GitHub Actions for its ease of use and ability to configure workflows to run on various GitHub events without third-party interventions. James highlights the importance of version tagging for safer updates and encourages others to explore GitHub Actions to enhance their development processes.

Support for the origin-bound draft standard for SMS security codes has been implemented to enhance phishing resistance by associating security codes with the sending site's origin. This standard ensures that autofill features can accurately parse security codes without relying on heuristics, which previously left them vulnerable to phishing attacks. The new format includes a footer in the SMS message that indicates the sender's origin, enabling browsers to autofill security codes only on legitimate sites. Apple's proprietary implementation in iOS 14 and macOS Big Sur supports this standard, with Google proposing the Web OTP API for broader adoption. Despite its vulnerabilities, SMS remains effective against common attacks, balancing security and usability. GitHub supports SMS due to its accessibility and is exploring emerging standards like WebAuthn, which promises improved security and usability. The origin-bound standard represents a simple yet significant step toward enhancing SMS security with minimal investment.

Remote Education delves into the creation and maintenance of online student communities, highlighting the successful example of the Summer of Making program led by teenagers Roshan Palakkal and Sam Poder. This six-week initiative, supported by Hack Club, aimed to engage over 400 students globally in building technical projects through daily challenges and events. Central to its success was Scrapbook, an open-source platform where students shared daily updates, fostering interaction and cultural exchange across 35 time zones. The platform's success, evidenced by over 5,628 unique creations and 7,010 emoji reactions, was attributed to its ability to encourage consistent engagement and a sense of belonging. Students were empowered to take ownership of events, enhancing community participation and support. Additionally, participation streaks, akin to commit graphs or Snapchat streaks, were implemented to motivate and track progress, with the longest streak lasting 91 days. The program's emphasis on shared experiences and empowerment illustrates effective strategies for remote community building.

The Indian developer community is experiencing significant growth, with numerous developers, open-source maintainers, and contributors actively participating. GitHub India is capitalizing on this momentum by hosting a Virtual Meetup focused on Open Source and Hacktoberfest on October 6th, from 6:30 PM to 8 PM IST. Hosted by MV Karan, Developer Relations for GitHub India, the event will feature discussions on contributing to open source, enhancing productivity with new GitHub features, and building contributor communities. Notable speakers include Peeyush Gupta from DigitalOcean, Richa Kumar from GitHub, and Umasankar Mukkara from OpenEBS, who will share insights on various aspects of open-source contribution. The meetup will conclude with networking opportunities, allowing attendees to connect with speakers, Hubbers, and fellow members of the Indian developer community. Participants are encouraged to RSVP for updates and further information.

DevSecOps represents a shift in mindset within development teams, integrating security practices throughout the software development lifecycle rather than treating them as a final checkpoint. Unlike traditional security approaches where a specialized team handles application security, DevSecOps distributes responsibility across all members involved in the application lifecycle, encouraging a more proactive stance on security vulnerabilities. This methodology parallels the DevOps movement by emphasizing accountability and collaboration, aiming to reduce security issues as DevOps aims to minimize outages. The concept of "shifting left" plays a crucial role, moving security considerations to earlier stages of the development process to provide developers with timely feedback without disrupting their workflow. This broad distribution of security responsibilities helps address the industry-wide shortage of security professionals and allows for more efficient use of resources, enabling quicker reactions to and prevention of security issues. While there is no one-size-fits-all approach to implementing DevSecOps, consolidating tools and fostering a common pipeline can be initial steps toward better integration of security in development practices.

GitHub's mobile applications have integrated GraphQL to enhance feature development efficiency by reducing engineering efforts and eliminating over-fetching, allowing the team to focus on creating user experiences rather than managing networking and API stability. The adoption of GraphQL, supported by the Apollo framework for iOS and Android, necessitates a shift from the traditional REST mindset to a schema-based approach where queries and mutations replace HTTP methods, allowing clients to specify their data needs without relying on predefined endpoints. This transition is facilitated by code generation, which simplifies the handling of network models and keeps them in sync with backend changes, while fragments ensure API consistency and reduce model redundancy by allowing reusable pieces of code. Although there are platform-specific differences in the Apollo GraphQL library implementations for iOS and Android, these do not significantly impact functionality, and efforts are underway to minimize these differences. Overall, GraphQL and Apollo's tooling contribute to rapid feature development by abstracting away many traditional mobile application concerns, allowing developers to leverage every part of network requests efficiently.

Security vulnerabilities often arise from complex interactions between software components, where assumptions made by one component are broken by another, leading to confusion over who should address the issue. This was exemplified by CVE-2020-15145, a local privilege escalation vulnerability in the Windows version of the Composer installer for PHP, which was caused by insecure directory permissions in the system PATH. Despite the risk of DLL planting and privilege elevation, confusion over responsibility can delay remediation, as seen in this case where both Composer and Windows had roles to play. While Composer's developers ultimately fixed the issue, the incident highlights the need for both application and system-level security measures to ensure that vulnerabilities are addressed promptly and effectively. Security is a shared responsibility, requiring clear understanding and proactive measures to prevent exploitation, as any ambiguity can lead to unintended consequences and insecure behavior.

GitHub has introduced a significant update to its Enterprise Server, incorporating GitHub Actions and Packages for the first time, allowing users to run CI/CD pipelines within their own environments. This release, version 2.22, includes features that enhance scalability for organizations of any size, such as improvements to repository performance, centralized self-hosted runners, and passive replicas for disaster recovery. Additionally, the update offers a refreshed repository homepage layout for better information access and introduces code scanning in beta, integrating security checks into the developer workflow through CodeQL. These advancements aim to streamline workflow automation, improve security, and enhance overall user experience on both desktop and mobile platforms, with a free trial available for those not already using GitHub Enterprise Server.

GitHub has introduced enhancements to improve the user experience of reviewing logs from GitHub Actions workflow runs, aiming to make the debugging process more efficient and user-friendly. These updates include a simplified layout structure with a virtualized scrolling feature, improved search responsiveness, better color support, and a new full-screen view mode, all designed to enhance performance and readability. The changes focus on making it easier to navigate dense logs, improve the overall interaction design, and provide clearer visual cues through enhanced color usage, accommodating various color formats such as ANSI, 8-bit, and 24-bit colors. These updates are particularly beneficial for users dealing with content-heavy logs, allowing them to quickly identify and address issues, thereby streamlining their workflow. GitHub encourages feedback on these changes through their community forum and social media, highlighting their commitment to continuous improvement and user engagement.

The OctogatosConf is a free, two-day live conference held on September 24-25, 2020, celebrating LatinX heritage month by featuring interactive talks from industry experts in Spanish, Portuguese, and English, with live captioning and translation available. The event, streamed on Twitch, covers topics like software development, security, technical project management, open source, and professional development. Notable speakers include Mica Alaniz, a Senior Software Engineer at the Democratic National Committee, and other influential figures like Julián Duque, Roberta Arcoverde, Felipe de Morais, and Layshi Curbelo. Organized by Octogatos, GitHub's employee resource group for LatinX employees, the conference aims to amplify and empower LatinX voices in technology. Participants are encouraged to register for free and join the event to connect and share knowledge within the community.

GitHub Actions provides a versatile platform for automating workflows and integrating with familiar tools, offering developers the freedom to innovate while managing tasks like cloud deployment and container building. Highlighting the story of Stefan Zweifel, a full-stack developer who created the "git-auto-commit" Action to detect file changes during workflow runs, the text illustrates how this tool automates file changes and commits them back to the GitHub repository. Stefan's motivation stemmed from a personal need for automation, and his Action has since been adopted by many developers for diverse purposes, such as building static sites and updating repositories. Despite initial challenges like authentication issues, improvements such as the "checkout" Action's v2 have resolved many problems. Stefan encourages developers to embrace open-source work by releasing code, learning from the process, and contributing to the community. His story, and GitHub Actions' ease of use, inspire developers to explore and participate in the creation of automated workflows available on the GitHub Marketplace.

GitHub is hosting a virtual event called "GitHub ¡Presente!" on September 22nd at 16:00 UTC-5, aimed at engaging the Latin American community and featuring a lineup of GitHub experts and special guests. The event, led by Alexandra Bourne and Jaime Sanchez, members of the Octogatos Employee Resource Group, will include discussions on various topics such as automating processes with GitHub Actions, enhancing security with CodeQL, developing software using GitHub Codespaces, and addressing societal biases through artificial intelligence. Additionally, Rafael Lagunas Guitrón will explore how software development can address unresolved socio-cultural and economic issues. The event will conclude with networking opportunities for attendees to interact with GitHub employees and like-minded individuals, and there's an invitation for potential future speakers to submit proposals.

GitHub CLI, now officially out of beta and available on Windows, macOS, and Linux, allows users to manage their entire GitHub workflow directly from the terminal, reducing context switching and streamlining processes. Since the beta release, it has facilitated over 250,000 pull requests and 350,000 merges, demonstrating its impact on GitHub operations. Key features include the ability to call the GitHub API, create custom command aliases, and integrate with GitHub Enterprise Server, fulfilling a popular user request. The CLI enables a seamless workflow from issue tracking to release creation, allowing users to script, review, and merge pull requests directly from the terminal. The community has been integral to its development, contributing features such as metadata additions and filtering capabilities, with future updates planned to enhance issue and pull request management further.

Civic engagement plays a crucial role in driving change, both in the software industry and society, as exemplified by Kyle Daigle's volunteering experiences. Daigle, a Software Engineer and GitHub's Senior Director of Strategic Programs, began his journey into software and election support at age 13 by helping his local election office with technical tasks, which fostered his passion for election rights and accessibility. His continued volunteering emphasizes the need for more poll workers, especially amid the COVID-19 pandemic's impact on older volunteers, with the upcoming U.S. election requiring additional support to ensure secure and fair voting processes. Daigle encourages others, particularly those with technical skills, to participate as poll workers to maintain effective election systems and urges citizens to register to vote. As part of GitHub, Daigle is committed to integrating software practices into company operations and promoting AI adoption, while also supporting technology accessibility through nonprofit work.

Developers can now benefit from a new GitHub integration with Microsoft Teams, aimed at enhancing collaboration by allowing them to manage GitHub issues and pull requests directly within the Teams environment. Building on the existing GitHub and Slack integration, this new feature, available in public beta, enables users to close, reopen, and comment on issues and pull requests, as well as receive customized notifications about specific repositories and organizations. The integration allows for seamless communication by turning conversations into actions, such as opening new issues and merging pull requests, while also providing detailed previews of GitHub activities through shared links. To get started, users need to authenticate their GitHub accounts within Teams, and feedback on the integration is encouraged to further refine its capabilities.

Remote Education delves into the complexities of organizing student communities and events in a virtual setting, providing insights from industry and academic leaders to assist in transitioning activities online during the school year. Key strategies include establishing a clear purpose for events, creating engaging and interactive formats to capture attention amid numerous distractions, and ensuring accessibility through features like live-captioning and moderation. The shift to online events requires careful planning and a skilled team adept at handling streaming and audio demands, potentially involving multi-language content moderation. Success metrics are more accessible to gather, with platforms offering tools to track attendance, engagement, and feedback. The article draws from experiences like GitHub Graduation and HackCon VIII to share effective practices and encourages exploring resources such as panel recordings for further guidance.

September 2020's Release Radar highlights an array of exciting new software releases from the open-source community, showcasing innovations ranging from rich text formatting in terminals to interactive process viewers. Notable releases include Rich 5.0, a Python library that enhances terminal text display, and htop 3.0, which adds new features like pressure stall information for Linux. Gitleaks 6.0 improves security by detecting hardcoded secrets in Git repositories, while Aerial 2.0 updates its Mac screensaver with new aerial videos. TypeScript 4.0 introduces numerous features and performance improvements, OctoPrint 1.4.2 offers stable remote control for 3D printers, and Autocannon 6.0 enhances HTTP benchmarking capabilities. Kontra.js 7.0, a compact JavaScript game engine, and Umbra 1.0, a lightweight HTML5 framework, support game development for the JS13K competition. Additionally, a unique project demonstrates a controller for the Chrome Dino game using eye blinks, showcasing creativity and the fun side of coding.

GitHub is hosting its first Virtual Meetup for African developers on September 15th, featuring key speakers such as Omoju Miller, Xavier René-Corail, Prosper Otemuyiwa, Samson Goddy, Cobus Bernard, and Lawrence Muthoga. The event aims to provide insights into the latest GitHub workflows, features, and open-source contributions, along with discussions on community-driven security, quick releases with GitHub Packages, and remote development strategies with VS Code. The meetup, which runs from 3pm to 5pm WAT, will also include time for discussions and networking, offering an opportunity to connect with other developers and open-source community members across Africa. This all-virtual event promises to be informative and engaging, encouraging participation from those interested in advancing their skills and knowledge within the developer community.

GitHub has established the GitHub Stars program to recognize and support developers who significantly contribute to the community by educating, inspiring, and influencing others through sharing knowledge and fostering inclusive environments. These individuals, such as Monica Powell and Eddie Jaoude, are celebrated for their efforts to make open-source contributions more accessible and for engaging in activities like creating educational content, organizing community events, and advocating for open-source development. The program offers Stars exclusive rewards, such as early feature access and speaking invitations, to enhance their influence and continue their impactful work. GitHub encourages the nomination of community leaders for this program to further amplify their positive contributions.

At GitHub, threat modeling is a critical process that fosters collaboration between security and engineering teams to enhance system security. This practice involves structured discussions to identify potential vulnerabilities and devise mitigation strategies, which are prioritized due to resource constraints. Regular threat modeling sessions are integrated into the development lifecycle, often using tools like Microsoft's Threat Modeling Tool or OWASP's Threat Dragon, and follow a framework such as Microsoft's STRIDE model to address various vulnerability classes. As threat modeling has matured at GitHub, it has led to system-wide security improvements, proactive design guidance, and enhanced communication between teams, ultimately promoting a security-minded culture. This approach encourages early engagement with security teams, allowing for better anticipation of potential issues and fostering secure design principles before product deployment.

In the context of software development, the concept of a software supply chain encompasses everything that contributes to and affects code, including dependencies, development processes, and infrastructure components. The prevalence of open-source code in today's software environments introduces significant security risks, as vulnerabilities in third-party dependencies can expose applications to compromises. While direct supply chain attacks are rare, the main challenge lies in managing and patching unpatched software to mitigate risks. GitHub offers tools such as Dependency Graph and Dependabot to help developers manage and secure their dependencies by identifying vulnerabilities and automating updates. The article highlights the importance of understanding and monitoring the software supply chain to enhance security and encourages developers to participate in a webcast exploring these issues further.

In August, GitHub reported no incidents that led to service downtime and introduced updates to their Status Page to enhance transparency and real-time communication about service availability. The new page focuses on current availability and service degradation, while the 90-day history remains accessible under “incident history.” Users can subscribe for notifications on any status changes. Following a July incident, GitHub improved deployment tooling and Kubernetes configurations to bolster system reliability by removing the ImagePullPolicy of Always and implementing a mechanism akin to Kubernetes mutating admission controllers for sidecar container updates. These changes decouple Kubernetes Pods from Docker registry availability during container restarts, with further enhancements planned to increase Kubernetes deployment resilience.

GitHub has introduced the GitHub Container Registry as a public beta to enhance the management of containers within GitHub Packages, which has already seen significant usage with Docker being a popular ecosystem. This new registry aims to improve developer experience by offering features such as better access policy enforcement, the promotion of standard base image usage, and easier innersourcing for organizational sharing. It allows anonymous access to public container images, similar to public repositories, and is currently free for both public and private images during the beta phase. The initiative also introduces data sharing and fine-grained permissions to facilitate secure collaboration across teams while enabling best practices in software releases. GitHub Actions simplifies publishing to the Container Registry, and guidance is provided for migrating images from the current Docker service. Future updates will include support for open standards like Helm 3 charts for Kubernetes and using Container Registry for universal storage, with ongoing feedback welcomed through community forums and direct communication with product teams.

On September 22, 2020, National Voter Registration Day, GitHub emphasized the importance of civic engagement for the software development community, highlighting how government policies influence the tech industry and encouraging developers to participate in the democratic process. The organization urged U.S. developers and employees to register, vote, and engage in activities supporting voting rights, election security, and combating disinformation. With COVID-19 impacting voting procedures, GitHub encouraged planning ahead and offered resources for registration and voting logistics. It also promoted volunteering as poll workers, recognizing the increased need for tech-savvy individuals to ensure smooth election operations. GitHub supported employee civic participation by offering paid time off for voting and volunteering, joining initiatives like the Time to Vote and Civic Alliance Election Day of Service. These efforts aimed to contribute to a safe and secure election while reinforcing the role of civic engagement in driving change.