October 2022 Summaries

Cybersecurity's significance has surged due to increasing high-profile breaches and its portrayal in popular media, yet there is a limited understanding of career opportunities in the field beyond technical roles. Many students at a Cornell University lecture recognized cybersecurity's importance for data protection but expressed disinterest or unawareness of potential careers outside of computer science, highlighting a need to showcase diverse roles such as those involving communication and marketing. The global cybersecurity market, valued at $150.37 billion in 2021, is projected to double in six years, with 3.5 million positions currently unfilled due to a skills gap and lack of awareness. Efforts by organizations like Microsoft aim to close this gap by promoting inclusivity and interdisciplinary teams. Highlighting roles such as product marketing, developer advocacy, and product security engineering at GitHub illustrates the varied career paths available, emphasizing the importance of both technical and non-technical skills in creating a robust cybersecurity ecosystem. This broader awareness can attract new talent and support the industry's evolving needs, fostering a more inclusive environment.

Lee Reilly's blog post celebrates Halloween by showcasing a collection of open-source or "source available" games created during game jams like Ludum Dare and JS13K. These games, developed using engines such as Unreal Engine, Unity, Godot, and Phaser, offer unique mechanics and are designed to be entertaining, even if they aren't AAA titles. Reilly reminisces about his childhood experiences with game cheats and invites readers to experiment with modifying game codes to enhance gameplay, such as making characters invulnerable or altering game speed. The post includes specific code snippets for hacking various games like Charon Jr., Nighty Night, Nosferatu, Smack Demon, and others. Reilly, a Senior Program Manager at GitHub, encourages readers to participate in game development and invites them to join the upcoming Game Off game jam.

October has been bustling with open source contributions, particularly during Hacktoberfest, which saw a flurry of community pull requests to various projects. The latest blog post highlights notable projects that shipped major releases, such as Home Assistant OS 9.0, which now features faster boot times and enhanced support for smart home devices, and Appwrite 1.0, a secure backend server for web and mobile developers. Other highlighted projects include Git Story 1.0, which allows users to view the historical state of GitHub repositories, and RxDB 13.0, which focuses on offline-first NoSQL database solutions for JavaScript applications. The post also mentions MONAI 1.0, a deep learning framework for healthcare imaging, and other releases like Chips-n-Salsa 6.0, Lazy Trivy 1.0, Spaceship Prompt 4.0, and Wails 2.0, each offering unique updates and features. The blog encourages continued participation in open source initiatives, underscoring the significance of community contributions and offering resources for those interested in joining the movement.

GitHub, a platform with over 90 million developers, is committed to ensuring the security and trust of the code developed and used daily, which is why they have invested heavily in their Bug Bounty program since its inception in 2014. This program, which involves collaboration with external security researchers, has helped GitHub enhance the security of its products. This year, GitHub hosted a Live Hacking event and engaged with researchers at DEF CON 30 to share insights and gather feedback. In an interview, a researcher known as ahacker1 discussed their experiences and processes in identifying vulnerabilities, particularly focusing on improper access control vulnerabilities, and shared insights on trends and resources for those interested in bug bounty. GitHub continues to embrace collaboration with the security community, encouraging contributions to enhance the security of its products and services, and invites interested individuals to explore opportunities within the company.

Earlier this year, the GitHub Security Lab launched an initiative offering office hours for open-source projects to enhance their security posture and mitigate breach risks, aligning with their mission to secure open-source software. The initiative connected with six projects, yielding significant improvements in their security practices. For instance, the Guzzle team, a PHP HTTP client, saw a dramatic reduction in vulnerability processing time thanks to the lab's guidance. The office hours involved maintainers completing a questionnaire, matching them with GitHub security experts who prepared by familiarizing themselves with the codebase, leading to productive discussions. Key findings included maintainers struggling to define their attack surface, the impact of adopting simple security practices like 2FA and automated code scanning, and an observed imbalance between functionality and security testing. The initiative highlighted the importance of threat modeling exercises and encouraged maintainers to prioritize security through practical, data-driven approaches.

GitHub has experienced significant growth and diversification, with over 1,170 new employees joining in the past year, and has focused on becoming more inclusive and reflective of the global developer community it serves. The company launched a Diversity, Inclusion & Belonging strategy centered on four pillars: people, philanthropy, policy, and platform. This strategy has increased racial and ethnic minority representation by 41.4% since 2021, notably among Black and Multiracial employees, though there is still progress to be made in women and minority representation in management roles. GitHub has created employee resource groups to foster a sense of belonging and has partnered with global organizations to enhance representation in tech. Philanthropic efforts, such as GitHub All In, have united industry partners to support historically excluded universities and drive change through skills-based hackathons. In terms of policy, GitHub has advocated for developer access and human rights, joining with other organizations to support LGBTQ+ rights. The platform has been modified to increase accessibility for all developers, including those with disabilities, and recent tools like Copilot aim to remove barriers for new developers. GitHub remains committed to building ecosystems that reflect and support societal diversity, emphasizing that continued collaboration is essential to achieving these goals.

GitHub Universe offers a comprehensive schedule of both in-person and virtual sessions designed to cater to a wide array of interests, including workshops and talks for developers, security professionals, enterprise users, open-source enthusiasts, and students. Attendees can plan their experience using a schedule builder, with sessions available for later on-demand viewing. Highlights include discussions on managing GitHub Actions, leveraging Codespaces for development, and utilizing GitHub Copilot in education and development. Security is a key focus, with sessions addressing software supply chain security and developer-first security practices. Open-source topics explore monetization and career development, while enterprise-focused sessions cover secure development practices and project management with GitHub. The event promises valuable insights from industry leaders and GitHub experts, aiming to enhance skills and knowledge in various domains.

GitHub is implementing ActiveRecord::Encryption in its Ruby on Rails monolith to encrypt sensitive database columns as part of a broader security strategy. Previously, GitHub used an internal library for this purpose, but the transition to ActiveRecord::Encryption aims to simplify encryption processes for developers by adopting more familiar and intuitive patterns. The transition involves customizing existing infrastructure to meet GitHub's scalability and security requirements, such as deriving per-column encryption keys from a primary key using a Key Derivation Function and storing these keys in Hashicorp Vault. This shift also includes making non-compression the default behavior to avoid exposing information about the entropy of encrypted data. The goal is to make encryption seamless and automatic for developers, encouraging better security adoption without requiring them to learn complex or proprietary methods. Future parts of this series will address the challenges of migrating existing columns to the new encryption standard.

Developer productivity is a critical asset for companies and is significantly enhanced when developers can easily access necessary tools and information, as highlighted in GitHub's insights. However, the proliferation of diverse tools can lead to complexity and inefficiencies, such as context switching, which detracts from developers' focus and productivity. GitHub advocates for a streamlined approach by consolidating tools, reducing redundancy, and fostering a centralized platform that enhances collaboration and reduces onboarding time for developers. By utilizing GitHub Enterprise, organizations can simplify their tech stack, minimize context switching, and improve the developer experience, leading to increased productivity and innovation. The platform offers features like Codespaces, GitHub Actions, and GitHub Packages, which facilitate efficient workflows and maintain high-quality software development. This approach not only optimizes the development process but also contributes to cost savings and a more cohesive team environment, ultimately supporting strategic business goals and fostering a culture of innovation.

Sigstore is a newly available technology designed to enhance software supply chain security by providing an innovative approach to signing, verifying, and protecting builds, particularly through integration with platforms like GitHub Actions. By utilizing keyless signing, Sigstore eliminates the need for private key management, streamlining the process and encouraging more frequent signing of builds. This advancement is already being applied to Kubernetes and CPython releases. Additionally, Sigstore aims to improve npm package security by enabling verifiable links between packages, their source code, and build instructions, leveraging information encoded in signing certificates from OIDC tokens. This development is part of a collaborative effort involving multiple organizations, including GitHub, to ensure a more secure ecosystem for npm users. The general availability of Sigstore marks a significant milestone, with ongoing efforts to expand support across various cloud CI/CD providers and enhance npm registry capabilities.

Game Off, an annual game jam returning for its 10th year on November 1, offers participants a month-long opportunity to create games based on a newly announced theme. Unlike typical game jams that last only a few days, this event encourages developers to experiment with new languages, game engines, or even build their first game. Participants can work individually or in teams, using any programming languages, game engines, libraries, and assets they choose. Past themes have included concepts like "Forking, branching, cloning, pushing, pulling" and "Leaps and bounds," which are open to interpretation. Organized by Lee Reilly, a Senior Program Manager at GitHub, Game Off promotes community engagement through its website, forum, and Discord channel, where participants can connect, ask questions, and find teammates.

Git Merge 2022 recently concluded in Chicago, offering a platform for the Git community to engage in 16 talks, three workshops, and a Git Contributor Summit over two days, with the event raising $10,000 for the Git project at the Software Freedom Conservancy. This annual gathering celebrates the Git project by bringing users and contributors together, featuring diverse sessions on topics such as Git-driven debugging, improvements to git merge, and Git's object storage mechanism. For those who couldn't attend, the session and workshop content is now accessible on YouTube, catering to Git users of all skill levels. The event was supported by GitLab as a sponsor, with Lee Reilly, a Senior Program Manager at GitHub, overseeing the program and community interactions.

GitHub is enhancing the forking experience to address developers' confusion regarding fork functionalities, permissions, and security implications. Recent improvements include the ability to sync outdated fork branches via the web interface or API, set fork permissions using REST or GraphQL APIs, name forks during creation, and fork repositories within the same organization or enterprise with controlled visibility. Additional features allow enterprise owners to restrict where forks can be created, display existing forks in a new dropdown menu, and fork only the default branch to reduce unnecessary data usage. An improved user interface for syncing forks has also been introduced, clarifying options for handling conflicts. These updates are part of GitHub's ongoing efforts to clarify and enhance fork usage, with plans to release updated documentation and encourage community feedback and contributions.

GitHub has introduced a new navigation update for GitHub Actions, aimed at enhancing discoverability, accessibility, and scalability as developers automate their software development workflows. Since its launch in 2018, GitHub Actions has evolved significantly, prompting the need for a refined navigation system that supports the platform’s continued growth and new feature implementation. The sidebar has been renamed to "Actions" to better reflect the comprehensive management capabilities available, and a new navigation design has been integrated using GitHub's Primer design system, ensuring consistency across different viewports and improving accessibility. This update also enhances the hierarchy of reusable workflows, introduces entry points for Usage and Workflow files, and adds local navigation for easier wayfinding during workflow runs. These changes aim to future-proof GitHub Actions, making it a more resilient and user-friendly tool for developers.

GitHub has introduced fine-grained personal access tokens (PATs) to enhance security and control over repository access, addressing the limitations of the traditional, coarser-grained PATs. These new tokens allow developers and organization administrators to specify permissions at a more detailed level, with over 50 granular options for access to GitHub's APIs, and enable targeting to specific repositories or organizations. Unlike the classic PATs, fine-grained tokens are not perpetual and require explicit access grants, offering organization owners the ability to approve and audit token use through new settings. While fine-grained PATs are recommended for most scenarios to minimize security risks, classic PATs are still necessary for certain use cases, such as accessing resources across multiple organizations or using some API endpoints that do not yet support fine-grained permissions. GitHub continues to seek user feedback and plans further enhancements, including expanded API support and features for scaling PAT policies, as part of their ongoing efforts to refine these security offerings.

Git has released new versions to address two security vulnerabilities, CVE-2022-39253 and CVE-2022-39260, affecting versions 2.38 and older. The first vulnerability, CVE-2022-39253, involves Git's --local clone optimization, which could allow symbolic links to be improperly dereferenced, potentially breaching security boundaries. Git has now restricted cloning via this optimization if symbolic links are present and changed the default setting for file protocol safety. The second vulnerability, CVE-2022-39260, is an integer overflow in git shell's interactive mode, which could lead to arbitrary code execution in unsafe configurations. To mitigate these risks, users are advised to upgrade to Git 2.38.1 or follow specific precautionary steps if immediate updates are not possible. GitHub has also taken measures to protect its users, including scheduling updates for GitHub Desktop, Codespaces, and Actions, and ensuring that their repository storage backend and Pages service are not affected by these vulnerabilities.

The 77th session of the United Nations General Assembly marked its first in-person gathering since the onset of the COVID-19 pandemic and focused on transformative solutions to global challenges. GitHub, in collaboration with Microsoft, hosted and participated in several side-events highlighting the importance of open-source software and digital transformation within the UN system. One notable event spotlighted the newly launched Open Source Programme Office (OSPO) at the World Health Organization, underscoring its potential to foster equitable technology and create employment opportunities in low- and middle-income countries. Another event introduced the Digital Development Compass, a tool developed by GitHub to support national digital transformation through aggregated public data. Both events attracted significant interest from international audiences, with discussions centered on technology's role in societal growth and the need for inclusive digital development. Additionally, GitHub participated in a high-level event on tech for democracy, emphasizing the importance of secure software and global developer engagement. These events reflect GitHub's commitment to leveraging technology for social good and encouraging collaborative innovation within the UN framework.

Innovation is crucial in addressing global challenges such as climate change, pandemics, and food insecurity, with technology playing a pivotal role in finding solutions. However, the increasing sophistication of cyberattacks poses a significant threat to business innovation by slowing down software development. GitHub offers strategies to enhance security within developers' workflows, helping businesses maintain agility and innovation. By integrating security tools directly into coding environments, adopting proactive security measures, managing signal-to-noise ratios, enabling security feedback during collaboration, and automating security processes, GitHub Advanced Security (GHAS) empowers developers to address vulnerabilities efficiently. These practices aim to make security efforts consistent and allow businesses to innovate swiftly, ultimately enabling them to tackle pressing global issues effectively.

The history and future of artificial intelligence (AI) are deeply intertwined with open source principles, as highlighted by the Open Source Initiative's focus on AI development. Open source frameworks like PyTorch are fundamental to AI systems, providing transparency and fostering collaboration through shared models and licenses. These frameworks facilitate responsible AI development, enabling the creation of an "information commons" through open access and data movements that democratize AI. AI is transforming software development by introducing new tools for code generation, raising questions about software correctness and security. The Open Source Initiative is uniquely positioned to guide discussions on AI's open source status, exploring issues like governance, public policy, and the global impact of AI. As AI continues to shape technology, open source communities are encouraged to tackle these complex questions, promoting collaboration and innovation to address global challenges.

Scalar, a new tool integrated into Git v2.38, is designed to enhance performance features for working with large repositories. It allows users to easily access advanced Git features like partial clone, sparse-checkout, and background maintenance by switching from `git clone` to `scalar clone`. Scalar's development journey began as a prototype derived from the VFS for Git codebase, evolving through principles of rapid prototyping, incremental changes, and extensive testing. Originally created to support cross-platform needs for the Microsoft Office monorepo, Scalar introduced "cone mode" sparse-checkout to improve performance. The tool transitioned from a .NET project to being rewritten in C and ultimately integrated into the core Git project, making it accessible to a broader audience. Scalar aims to configure features for large repositories, filling a niche within Git by providing a streamlined user experience for managing significant performance features. Its integration into Git represents a successful open-source development journey that underscores the importance of adaptability and community collaboration in software engineering.

GitHub Advanced Security (GHAS) has expanded its capabilities by integrating with several Security Information and Event Management (SIEM) providers, including Splunk, Microsoft Sentinel, DataDog, Elastic, Sumo Logic, and Panther, to enhance security visibility and management. These integrations allow GHAS data to be exported to external reporting tools, enabling organizations to combine GitHub security alerts with other data sources, like Configuration Management Databases or user directories, for a comprehensive view of security events within the context of business operations. The partnerships facilitate the creation of customized dashboards, powerful queries, and visualizations, helping security teams to quickly identify, prioritize, and remediate vulnerabilities. Each SIEM provider offers specific features; for example, Splunk provides add-ons for data sources, Microsoft Sentinel offers connectors for audit logs, and Datadog provides out-of-the-box dashboards and alerting capabilities. Additionally, these integrations are open source, allowing for community contributions, and are supported by a detailed integration guide for those interested in implementing or enhancing these solutions further.

GitHub enhances developer efficiency and security by integrating code scanning results directly into developers' workflows using the SARIF Viewer Extension for Visual Studio Code and GitHub Codespaces. This integration allows developers to quickly access security alerts and remediation information within their integrated development environment (IDE), fostering a seamless experience. The updated extension enables developers to view and address code scanning findings without leaving their IDE, thanks to the cloud-based deep scanning capabilities, and allows them to push fixes back to GitHub, where code scanning can verify and approve the changes for merging. GitHub Codespaces further streamlines this process by offering fast, cloud-based development environments that can be preconfigured to display code scanning results instantly, eliminating the need for manual extension installations. By focusing on improving the developer experience, GitHub supports over 83 million developers in building secure software through open source collaboration.

GitHub Universe 2022, scheduled for November 9 and 10, offers over 80 sessions across cloud, security, community, and AI tracks, catering to both newcomers and seasoned professionals. Attendees can join in-person or online, with sessions available on-demand post-event. The event features a keynote by GitHub CEO Thomas Dohmke, discussing software development's evolving nature and GitHub's platform capabilities. Highlights include a session on GitHub's internal security practices, insights into the productivity and happiness benefits of GitHub Copilot, and a panel on the value of data in Open Source Program Offices. Other topics cover accelerating coding with Codespaces, uncovering vulnerabilities in Kotlin apps, and how GitHub Enterprise Cloud supports diverse enterprises. Early bird pricing is available until October 15, offering a 20% discount on in-person tickets.

GitHub has launched a public beta for GitHub Projects on GitHub Mobile, allowing users to track issues and manage projects from anywhere using their mobile devices. The app is available on iOS TestFlight and Google Play (Beta), providing features that enable users to access projects through repositories, organizations, or personal profiles, and switch views easily to organize and plan effectively. Users can manage project details with custom fields such as status and priority, and perform quick actions like editing or commenting on issues directly from their mobile devices. GitHub encourages users to provide feedback through various channels to help improve the app.

The eleventh annual js13kGames coding competition, which challenges participants to create games in 13kB or less of JavaScript over a month, concluded with 167 submissions encompassing various genres such as FPSs, platformers, PvP, and puzzle games, all centered around the theme of DEATH. The competition highlighted standout entries like "Dante," praised for its 3D gameplay and fast death/restart flow, and "Dying Dreams," noted for its polished graphics and tricky puzzles. Other notable games include "Norman the Necromancer" with its tactical gameplay and boss battles, and "Infernal Throne," recognized for its smooth animations and challenging puzzles. The event, organized by Lee Reilly and supported by judges and sponsors, encourages sharing favorite games on social media and invites participants to join the upcoming Game Off jam, allowing the use of any language and file size, set to start on November 1.

GitHub plays a significant role in global innovation by enabling developers to contribute to open source infrastructure, build apps, and support scientific research, yet these contributions often go unnoticed by traditional measures like patents and research papers. In an effort to highlight these code-driven contributions, GitHub has collaborated with the World Intellectual Property Organization (WIPO) to include a new indicator in the 2022 Global Innovation Index (GII), which measures developer creative outputs based on GitHub commits. This inclusion aims to provide a more comprehensive understanding of innovation by recognizing economies where code attracts global contributions and allowing for cross-country comparisons by scaling the data by working-age population. The GII, which has been running for 15 years, offers insights into the innovation strengths and weaknesses of economies to guide policymakers and investors. GitHub is committed to furthering the visibility and understanding of developer-driven innovation and seeks ideas and feedback to improve these efforts and expand partnerships.

Applications like Google Ads, eBay Motors, and Alibaba Xianyu, which were developed using the Flutter framework powered by Dart, now benefit from enhanced security measures due to GitHub's integration with the Dart ecosystem. This collaboration, supported by the Dart team at Google, enables developers to better manage and secure software dependencies through GitHub's supply chain security features. Key tools such as the GitHub Advisory Database, Dependency Graph, and Dependabot provide developers with the ability to identify, discuss, and resolve vulnerabilities in Dart applications. These tools offer functionalities like private discussions on vulnerabilities, alerts for known issues, and automatic updates to secure dependencies. This integration aims to prevent vulnerabilities in Dart projects, enhancing the security posture of applications built with this framework.

In September, GitHub experienced a significant incident affecting multiple services, particularly impacting Enterprise Managed Users due to a data transition error that removed necessary data for pull request merges, which was resolved by restoring data from a backup. Additionally, a Codespaces incident occurred on September 28, but the investigation is ongoing, with a detailed report expected in October. A previous Codespaces issue from August 29 was traced to an Ubuntu security patch affecting DNS resolution, which was mitigated by disabling systemd's DNS resolver. An August 18 incident involved a spike in traffic to GitHub Actions, overloading a token database, which was resolved by scaling up the database and adjusting concurrent connections. GitHub is making procedural improvements to enhance the reliability of its services, including data transition processes, DNS configurations, and monitoring and alerting systems.

GitHub Advanced Security's secret scanning feature is designed to prevent credential leaks by detecting over 180 types of secrets and allowing organizations to define custom patterns for unique secret types. Since June 2021, support for custom patterns has been enhanced to include dry runs, enabling users to experiment with pattern filtering and iteratively improve detection accuracy without committing changes. The feature supports up to 500 custom patterns per organization and 100 per repository, and it includes the ability to edit existing patterns and track updates in audit logs. Custom patterns have become increasingly popular, with a nearly 50% increase in usage since the introduction of dry runs in public preview. Once satisfied with a custom pattern, users can publish it to generate official alerts, while GitHub Advanced Security continues to offer capabilities like code scanning, supply chain security, and Dependabot alerts to secure organizations globally.

Aspiring Creatives, a new feature of the GitHub Global Campus and the Student Developer Pack, is designed to enhance students' design and collaboration skills by providing access to various creative tools and resources. Verified student GitHub users can redeem this experience through their accounts to access design tools like Iconscout, Icons8, Octicons, and Figma, facilitating project brainstorming, organization, and showcasing. A recent collaboration featured on CampusTV involved Figma Education's Lauren McCann, who discussed new GitHub Education-designed hackathon templates aimed at helping students with project design, workflow, and development efficiency. These templates are particularly useful for storyboarding, prototyping, and designer-developer handoffs, thus offering students a practical advantage in their creative and technical endeavors. The Aspiring Creatives Experience is available to all verified students globally, providing them with the opportunity to utilize real-world development tools and join a community of student developers.

GitHub Universe 2023, held on November 9-10, offers both an in-person event at San Francisco's Yerba Buena Center for the Arts and a dynamic virtual experience, providing diverse content across four tracks: Cloud, Security, AI, and Community. The event aims to engage the global GitHub community, including developers, open source contributors, enterprise decision makers, and more, through over 80 sessions and 120+ speakers. Attendees can expect whimsical and diverse presentations, such as a CEO making a sandwich during a talk, highlighting the conference's unique approach to combining learning and entertainment. The in-person experience allows participants to network, attend live sessions, and explore product demos, while the virtual format provides free access to on-demand content and live discussions. GitHub Universe emphasizes collaboration, innovation, and the impact of using GitHub's platform to advance individual projects and careers.

Hacktoberfest, hosted annually by DigitalOcean, is celebrating its ninth year, encouraging open source contributions throughout October. With over 2.6 billion contributions on GitHub in the past year, the event invites participants to contribute not just code but also non-code efforts like documentation, design, and advocacy to support open source projects. GitHub is actively participating by offering opportunities to contribute to its documentation and working with DigitalOcean to promote volunteer opportunities for digital public goods aimed at fostering a more equitable world. With over 90,000 projects participating this year, Hacktoberfest includes events like the Global Kick-Off on October 4 and the Hack Party Asia Pacific Edition on October 12. Abigail Cabunoc Mayes from GitHub emphasizes the importance of contributions to the open source community, highlighting their significant impact on digital ecosystems.

Git 2.38 introduces several significant updates, including the integration of the Scalar repository management tool, which enhances performance in large repositories by configuring impactful features. This release also adds the --update-refs option for git rebase, allowing for seamless history rewrites across dependent branches without manual adjustments. Contributions from Google Summer of Code students have improved features like the sparse index and reachability bitmaps, enhancing both performance and compatibility. New security configurations, such as safe.bareRepository, aim to mitigate risks associated with malicious repositories. Additional enhancements include the introduction of the -m option in git grep for limiting matches per file, the customizable --format option in ls-files, and mailmap support in git cat-file for identity mapping. The release also emphasizes developer engagement, updating documentation to include guidelines for contributing to the Git project.