December 2022 Summaries

GitHub sponsored the Ekoparty 2022 Capture The Flag (CTF) competition, designing a series of challenges to test participants' problem-solving skills in various cybersecurity scenarios. The first stage, "Classroom," required participants to decode a hex-encoded string to access a course URL. The second stage, "Approval," involved exploiting GitHub Actions and branch protection rules to gain access to protected secrets, focusing on bypassing security settings using pull_request_target. The third stage, "FreeDOM," simulated a vulnerable ticketing system where players had to manipulate DOMPurify's configuration to leak sensitive ticket content, demonstrating a creative use of DOM clobbering for exploitation. The final stage, "Free Ride," focused on reverse engineering and binary exploitation, although no participants completed it during the event. Throughout the competition, GitHub highlighted potential security issues and encouraged innovative problem-solving, while also identifying areas for future improvement in challenge design and security practices.

As 2022 comes to a close, the GitHub Blog reflects on notable contributions from its engineers, product teams, and security researchers, highlighting the top 10 posts of the year. Key developments include the general availability of GitHub Copilot, an AI code-suggesting tool, and the introduction of Mermaid for diagram creation in Markdown files, enhancing visual communication. GitHub also launched new features such as math support in Markdown, the educational platform GitHub Skills, and an Achievements system to recognize developer milestones. Other notable entries include guides on building CI/CD pipelines with GitHub Actions and the security-oriented Git Credential Manager. The blog series exploring Git's database internals provides insights into its data storage techniques, with more entries expected in 2023. Laura Lindeman, the blog's editor and strategist, collaborates with various technical experts to effectively present complex ideas.

Rubber ducks have become a symbol in programming circles, largely due to the concept of "rubber duck debugging," which originated from the 1999 book "The Pragmatic Programmer" by Andrew Hunt. The technique involves explaining code out loud to an inanimate object, like a rubber duck, to help programmers understand and troubleshoot their work. This method has become part of developer culture and was highlighted during the GitHub Universe event, where rubber ducks were used to demonstrate various features of GitHub as a comprehensive platform for developers. The concept encourages developers to verbalize their problems, which can be a useful strategy beyond coding, and emphasizes the importance of communication in problem-solving.

GitHub's Social Impact team orchestrated an inclusive and successful GitHub Gives campaign in October, moving it from its traditional December slot to enhance participation and engagement. This move allowed for four full weeks of programming, avoiding the end-of-year scheduling conflicts when many employees are out of the office. The campaign featured thematic fundraising raffles, participation awards, and activities encouraging employees to engage in community support, which resulted in a 10% increase in participation compared to the previous year. GitHub partnered with nonprofits, including The Seeing Eye and Hack the Hood, to support diverse causes, focusing on educational and employee-related interests. The campaign involved virtual and in-person events, like presentations from nonprofit representatives, which fostered deeper connections between employees and the causes they support. GitHub plans to apply the insights gained from this campaign to their upcoming Volunteer Month in April 2023 to maximize their social impact.

GitHub has significantly enhanced its productivity, collaboration, and security through the advancement of tools like Codespaces and GitHub Copilot, which have streamlined the development process and improved developer satisfaction. With Codespaces, developers can quickly set up a working environment, reducing the time from 45 minutes to less than a minute, while GitHub Copilot has been shown to increase task completion speed by 55% and enhance job satisfaction. Collaboration is facilitated through centralized tools like Issues and projects, which help teams plan, track, and understand their work within the broader company mission. Security measures have been strengthened by integrating practices such as multi-factor authentication and using tools like CodeQL to protect against vulnerabilities, positioning security as an enabler rather than a barrier to efficient software deployment. These efforts reflect GitHub’s commitment to building a platform that is not only more secure and productive but also one that fosters creativity and satisfaction among developers.

Enterprise Managed Users (EMUs) are a feature introduced in GitHub Enterprise Cloud (GHEC) to enhance security and management for organizations using GitHub. Originating from the evolving needs of enterprises for identity management and content protection, EMUs allow organizations to provision standardized accounts through their identity providers, ensuring that user information like usernames and email addresses are consistent and managed centrally. This model emphasizes security by preventing EMU users from creating public repositories or collaborating outside of their enterprise's context, thereby providing a clear separation between professional and personal GitHub activities. The EMU model caters to enterprises requiring strict user management and data protection, offering a more controlled and secure environment compared to the traditional "bring your own account" approach. While migrating to the EMU system involves a process, it offers administrators simplified management and increased security, making it an appealing option for organizations seeking comprehensive control over their GitHub user accounts.

GitHub has made significant advancements in productivity, collaboration, and security by leveraging its own tools and technologies, such as Codespaces and GitHub Copilot, to streamline development processes and enhance the developer experience. The adoption of Codespaces has drastically reduced the time required to set up local development environments, while GitHub Copilot has proven to accelerate task completion and increase developer satisfaction. GitHub's commitment to collaboration is evident through the use of tools like Issues and projects, which facilitate centralized planning and tracking. Security remains a priority, with initiatives like enforcing multi-factor authentication and using CodeQL for vulnerability checks, all aimed at integrating security into the development lifecycle. These efforts highlight GitHub's dedication to creating a productive, collaborative, and secure environment for developers, reinforcing its vision to be the home for all developers.

Canadian communications and IT provider TELUS faced challenges with a fragmented tech stack, leading to inefficiencies such as lengthy onboarding and excessive context switching for developers. By adopting GitHub Enterprise as a centralized platform, TELUS significantly improved productivity, with new developers onboarding in minutes and saving two hours per week per developer. A study by Forrester Consulting revealed that organizations using GitHub's platform, including GitHub Enterprise Cloud (GHEC) and GitHub Advanced Security (GHAS), experienced a 433% ROI over three years. The platform facilitated 22% productivity gains, 75% improvement in tool maintenance, and enhanced security by reducing code vulnerabilities. Additionally, it streamlined the onboarding process, reduced operational costs, and improved developer satisfaction, helping businesses recruit and retain talent effectively.

The 2022 Octoverse report highlights a significant year for open source, noting a rise in infrastructure as code and increased participation from big tech companies, such as Google, Microsoft, and Meta, in building major open source communities. GitHub's Martin Woodward presented findings showing 2022 saw more than 20 million new users on the platform, with over 413 million contributions made globally, illustrating a robust and accelerating pace of activity in the developer community. The report emphasizes the growing diversity and global reach of open source contributors, with notable growth in regions like India, Brazil, and Nigeria, as well as the inclusion of emerging programming languages like HCL and Shell. The influence of commercial backing on open source projects is framed as beneficial, fostering new participation and highlighting the establishment of open source programs offices (OSPOs) within 30% of Fortune 100 companies. This shift is seen as a catalyst for cultural change within organizations, promoting collaboration and innovation while reinforcing the strength and importance of open source in advancing technology worldwide.

November's Release Radar highlights significant updates in various open-source projects, showcasing the hard work of the developer community as the year comes to a close. Key releases include CLI for Microsoft 365 6.0, which enhances management and automation of Microsoft 365 and SharePoint Frameworks across multiple platforms, and React95 4.0, a nostalgic Windows 95 UI component library for React, now rewritten in TypeScript. React-PDF 6.0 introduces Vite support and modern JavaScript, while Box CLI Maker 2.0 offers customizable terminal boxes with new color options. Chart.js 4.0 provides flexible charting tools with enhanced configurations, and Nuxt 3.0, a modern rewrite of the Vue framework, incorporates TypeScript support. Stable Diffusion 2.0 advances AI-generated artwork with improved models, and Tesseract.js 4.0 enhances image-to-text processing. Dependabot Changelog Helper 2.0 streamlines changelog updates in GitHub Actions, and Revolt 1.0 aids concurrent PHP applications with an event loop. These developments underscore the community's dedication to innovation and collaboration, as featured on GitHub's Release Radar platform.

Exposed secrets and credentials are a significant cause of data breaches, often going undetected for extended periods, leading to severe consequences. GitHub has partnered with various service providers to address this issue by implementing secret scanning on all public repositories, available for free. This initiative involves scanning repositories for over 200 token formats and notifying partners of potential leaks, with GitHub alerting users directly about leaked secrets in their code. The rollout of secret scanning began in a public beta phase, with plans for full availability by January 2023, allowing users to manage their repository security proactively. Additionally, GitHub encourages service providers to join their secret scanning partner program, aiming to enhance protection for shared users. This initiative not only helps prevent secret exposures but also provides visibility into code issues, as noted by professionals like David Ross, a Staff Security Engineer at Postmates.

GitHub Advanced Security enhances application security by using push protection to prevent secret leaks, which helps developers work more efficiently by addressing vulnerabilities before they occur. Since its release, push protection has prevented over 8,000 secret leaks and now allows organizations to define and enable custom patterns at the repository, organization, and enterprise levels. This feature integrates directly into a developer's workflow, stopping secrets from being pushed into the codebase and saving significant remediation time. Developers can configure push protection for specific patterns, reducing false positives and building trust in security alerts. Secret scanning alerts are available for free in public repositories, with additional features available for private repositories through GitHub Advanced Security. The program supports over 200 patterns and encourages service providers to join the GitHub secret scanning partner program to protect users further.

GitHub is enhancing its security measures by requiring developers to enable two-factor authentication (2FA), particularly targeting maintainers of high-traffic packages and contributors to critical repositories, with a gradual rollout throughout 2023. This initiative aims to mitigate account theft and bolster the security of the software development ecosystem. Starting in March 2023, GitHub will notify users in distinct groups about the requirement to enable 2FA, providing a 45-day notice period before enforcement. Users will receive reminders and have the option to delay enabling 2FA by one week after the deadline, ensuring minimal disruption. GitHub will monitor the rollout's effectiveness by evaluating user success rates, account lockout incidents, and support needs, adjusting the approach as necessary. The company is also working to improve 2FA onboarding, account recovery, and plans to introduce passkey support for stronger authentication.

GitHub has introduced the QueryBuilder component to enhance the accessibility of complex search inputs within its user interface, particularly for GitHub Discussions. This component addresses accessibility challenges by offering features such as styled search inputs, suggestion grouping, and action differentiation within suggestions, using methods like aria-labels and aria-live regions to ensure clarity for screen reader users. Developed in collaboration with GitHub's Primer Team and accessibility experts, QueryBuilder is designed to empower all users, including those with disabilities, by making search experiences more inclusive. The component, which is currently in production and set to be open-sourced, will be integrated into additional parts of GitHub's UI, allowing developers to implement advanced and accessible search functionalities without extensive research. This initiative reflects GitHub's broader commitment to accessibility across its platform, ensuring that all developers can benefit from improved navigation and search capabilities.

Git 2.39 introduces a host of new features and improvements, thanks to contributions from over 86 developers, including 31 newcomers. Among the notable updates, the git shortlog command has been enhanced to offer greater flexibility in aggregating commit data using arbitrary formatting specifiers, allowing users to efficiently summarize commit history. Additionally, Git's garbage collection mechanism has been improved with the introduction of the --expire-to option, enabling the preservation of unreachable objects in external backups. Significant performance enhancements have been achieved in the sparse index compatibility and connectivity check processes, with the latter now focusing on advertised references, reducing computation time dramatically. Security measures have also been strengthened, including a size limit for patches in git apply and the redaction of sensitive information in trace logs. These enhancements aim to improve efficiency, security, and usability for Git users, with further details available in the release notes and Git repository.

The October Release Radar highlights several significant updates and releases in the open-source community, celebrated amidst a busy month filled with events like Hacktoberfest and GitHub Universe. Key releases include Keuss Server Version 2.0, which introduces exchange support for Node.js job queues; SVGO 3.0, enhancing SVG optimization with compatibility for Node.js 14 or higher; and PrestaShop 8.0, marking its first major update since 2016 with enhanced shopping experiences and multilingual support. Mitmproxy 9.0 features new proxy modes and usability improvements, Pure CSS 3.0 emphasizes lightweight responsive design while dropping Internet Explorer support, and InvokeAI 2.0 offers a toolkit for AI-generated images. Additionally, the State of the Octoverse report celebrates a decade of open-source contributions, noting over 413 million contributions in 2022, and invites developers to participate by submitting projects for future Release Radars.

GitHub, in collaboration with Microsoft's Diversity and Inclusion Committee, launched a pilot program called Git Commit Uruguay to introduce over 60 high school students and recent graduates from a low-income neighborhood in Montevideo, Uruguay, to GitHub and open-source software. The program aimed to lower barriers to software development by providing courses taught by Spanish-speaking educators Luis Sanchez and Gustavo Lizarraga, covering topics such as Git commands, repository management, and project structuring. Upon completion, students were equipped with the skills to build their own cloud-based websites and establish GitHub profiles, aiding their pursuit of tech sector jobs. The program concluded with a ceremony featuring a speech by Mario Rodriguez, GitHub's VP of Product, emphasizing courage and perseverance. Future efforts include securing internships at the soon-to-open AI and IoT Insider Lab in Montevideo, marking a continued commitment to creating opportunities for these students.

The text discusses the cost-benefit analysis of investing in more powerful computing resources for development teams, particularly in the context of using GitHub's larger hosted runners. It addresses the common business concern over the expense of hardware, whether physical or cloud-based, and contrasts this with the potential productivity gains for developers. The experiment conducted shows that although more powerful hardware entails higher upfront costs, it significantly reduces build times, allowing developers more time to focus on coding rather than waiting for builds to complete. The analysis reveals that the cost of developer time lost to slow builds or productivity loss from context switching far outweighs the cost of upgrading to more powerful compute resources. For instance, using higher-tier compute options can save a company substantial amounts in developer costs, highlighting the long-term financial and productivity benefits of investing in better hardware. Furthermore, the findings are applicable beyond GitHub's runners, suggesting a general principle that investing in superior CPU power ultimately leads to more efficient and less frustrating work environments for developers.

GitHub's mission to be the "home for all developers" is emphasized by Inbal Shani, the newly appointed Chief Product Officer, who brings extensive experience across various tech domains, including autonomous vehicles, geospatial services, and AI. Shani highlights the transformative potential of AI in software development, with tools like GitHub Copilot and OpenAI Codex already influencing the field. GitHub continues to serve a diverse array of users, from open-source communities to large enterprises, by offering innovative solutions such as GitHub Actions and GitHub Codespaces, while striving to enhance the developer experience through improved efficiency, security, and accessibility. Shani’s background in AWS Elastic Containers and her commitment to empowering developers underscore her enthusiasm for advancing GitHub’s platform amid a rapidly evolving tech landscape.

GitHub Copilot, an AI-powered coding assistant, has significantly enhanced developer productivity by synthesizing up to 40% of code and helping developers code 55% faster. With its recent expansion to organizations, Copilot offers simple and flexible license management, organization-wide policy controls, and robust privacy protections for $19 USD per user per month. GitHub Copilot for Business allows administrators to manage licenses and enforce policy controls, ensuring the safety of code while providing developers with AI assistance to build software more efficiently, focus longer, and explore new problem-solving approaches. The tool has already received positive feedback, with users highlighting its ability to accelerate coding and testing processes, and its potential to transform the developer experience by fostering innovation and maintaining flow states in the software development process.

In November, GitHub experienced two performance incidents impacting various services, including Packages, Pages, and Actions, with an additional incident affecting Codespaces in October. The first November incident on the 25th affected GitHub Packages and Pages, and further details on its causes will be provided in a January report. The October 26 incident was due to an outage in the East US region that impaired Codespaces' functionality, caused by a third-party database outage. GitHub is enhancing its database resilience by implementing regional replication and failover strategies to mitigate future disruptions. On November 3, GitHub Actions experienced delays due to a backup in the webhooks queue caused by an inefficient database query linked to high-volume API calls. GitHub has since optimized the query, reviewed endpoint rate limits, and increased throttling to prevent future issues, alongside conducting training for better incident response. For ongoing updates and insights into their improvements, GitHub encourages users to follow their status page and engineering blog.

npm has introduced two new features to enhance the security of its ecosystem: granular access tokens and the npm code explorer. Granular access tokens allow maintainers and organization owners to create tokens with limited access, reducing the risk of token misuse and enabling better automation of organizational management. These tokens can be restricted to specific packages or scopes and can limit npm API access based on IP ranges, with expiration periods of up to one year. The npm code explorer, previously a paid feature, is now available for free, allowing developers to inspect package contents directly from the npm portal without downloading them, helping to prevent the deployment of potentially harmful code. Additionally, npm has mandated two-factor authentication (2FA) for maintainers of high-impact packages, which significantly contribute to the platform's traffic, to further secure the ecosystem against account hijacking.

GitHub Universe 2022, held at the Yerba Buena Center for the Arts in San Francisco, marked the return of in-person gatherings for the developer community after three years, drawing over 1,300 attendees and many more virtually in a hybrid format. The two-day event featured a mix of keynote talks, technical sessions, and workshops, where GitHub unveiled new platform features like free Codespaces hours for individual developers and the upcoming GitHub Copilot for Business. Attendees engaged in interactive demos, discussions, and community-building activities, and could explore new products at the swag shop. The in-person and virtual experiences were designed to foster learning and collaboration, with content available on-demand for those who missed the live sessions. The event emphasized the importance of community, learning, and fun, with activities ranging from AI selfies to motivational messages for aspiring tech students, all culminating in a celebration of the global developer community.

More than one billion people worldwide live with disabilities, and they face numerous barriers in various aspects of life, from transportation to employment. Technology has been identified by the World Bank as a crucial tool for bridging this "Disability Divide," a mission that Ed Summers has pursued for over a decade. With a new role as Head of Accessibility at GitHub, Summers aims to leverage the platform to enhance global accessibility and disability inclusion. GitHub's accessibility program focuses on empowering individuals with disabilities through several key pillars: fostering an inclusive workplace, lowering barriers for developers on GitHub, expanding disability inclusion in the open-source community, and making a transparent commitment to ongoing progress. Summers emphasizes the importance of involving people with disabilities in the development process, advocating for the principle of "nothing about us without us," to ensure technology benefits all of humanity.

GitHub has released two open-source variable fonts, Mona Sans and Hubot Sans, which can be used freely under the Open Font License (OFL). Mona Sans, a versatile typeface inspired by industrial-era grotesques, is designed for primary use across various mediums, while Hubot Sans, a more geometric and technical font, serves as a secondary option for headers and pull quotes. Both fonts feature variable axes of weight, width, and slant, offering thousands of styling combinations and are available in static and variable formats. GitHub recommends using the variable .ttf versions for local use and the woff2 versions for web use, and encourages optimization techniques like preloading, subsetting, and creating custom fallback fonts to enhance performance and reduce layout shifts. Users are invited to contribute to the continued development and improvement of these fonts through GitHub.

GitHub Enterprise is enhancing its platform to unify and improve the experience for enterprise customers by offering enterprise accounts to those who pay via credit card or PayPal, expanding beyond its traditional invoice-based model. This change allows companies, regardless of size, to manage multiple organizations under a single umbrella, facilitating developer flexibility while ensuring governance and auditability through centralized policies like SSO and 2FA. Enterprise accounts, positioned above organizations in the management hierarchy, offer features such as internal repositories for sharing code and audit log streaming to capture important events. By providing these tools, GitHub aims to support businesses in growing quickly and flexibly, while continuing to evolve its platform to meet the diverse needs of its enterprise community.

GitHub is focused on enhancing security resilience by integrating robust security measures into developers' workflows, aiming to make security an intrinsic part of the coding process rather than a separate task. Niroshan Rajadurai, Senior Director of Global GitHub Advanced Security Sales, emphasizes that developers are central to both introducing and fixing vulnerabilities, and therefore, security features should be optimized for their workflow. GitHub Advanced Security (GHAS) offers features like push protection for secret scanning, which prevents credential leaks by rejecting pushes that contain secrets, thereby maintaining the developer's flow. Additionally, security results are centralized in pull requests to streamline the process like any other code review. The platform's community-driven approach enables developers to access the latest security intelligence, helping them update more vulnerable packages and secure millions of projects. GitHub's dedication to developer-friendly security aims to enhance innovation by increasing developer velocity and minimizing disruptions, positioning DevSecOps as the future of application security.