February 2023 Summaries

HashiCorp Configuration Language (HCL) has been identified as the fastest-growing programming language on GitHub, highlighting the increasing significance of Infrastructure as Code (IaC) in modern DevOps practices. HashiCorp, a leader in IaC automation for cloud computing, uses HCL in tools like Terraform and Vault, making infrastructure management more accessible and efficient across multi-cloud and on-premises environments. The growth of HCL underscores the ongoing challenge of integrating infrastructure, operations, and development teams, a primary goal of DevOps. The text explores how GitHub and HashiCorp can streamline workflows and improve consistency across CI/CD pipelines by introducing practices such as storing infrastructure code in repositories, fostering collaboration through pull requests, and automating quality reviews. The document also discusses the benefits of policy as code for compliance and security, illustrating how these approaches can transform traditional operations into more agile and secure processes. Examples include using GitHub Actions to automate Terraform processes, ensuring changes are reviewed and approved before deployment, and leveraging AI for compliance testing. The text advocates for a more integrated and automated approach to infrastructure management, suggesting significant time and cost savings, ultimately adding business value and enhancing productivity.

GitHub Codespaces is a versatile cloud-based development environment that allows users to code without taxing their local machines, offering a browser-based IDE on a virtual machine. It enables users to perform resource-intensive tasks, such as running machine learning models like Stable Diffusion, by allowing them to set machine types from 2-core to 32-core and request GPU-powered environments if needed. GitHub Codespaces facilitates remote collaboration through features like Live Share for pair programming and provides a consistent development setup that simplifies onboarding and technical interviews by eliminating the need for local environment configurations. It also supports coding in various editors beyond Visual Studio Code, like Jupyter Notebook and IntelliJ IDEA, and offers 60 to 90 hours of free access per month depending on the user's GitHub subscription level, making it an attractive option for developers seeking a reliable and efficient coding platform.

GitHub's secret scanning alerts, now generally available and free for all public repositories, help users manage the risk of leaked secrets by notifying them of exposed credentials across their repositories, including code, issues, descriptions, and comments. This feature, which works with over 100 service providers, offers a full audit log of actions taken on alerts and provides visibility into potential security risks. For example, DevOps Consultant @rajbos discovered over a thousand leaked secrets across 14,000 public repositories, highlighting the ease with which sensitive information can unintentionally be exposed. GitHub encourages repository owners and enterprise administrators to enable these alerts, which can be done through the 'Settings' tab under 'Code security and analysis', to enhance security and allow automatic revocation of compromised secrets in collaboration with GitHub's partner program.

The blog post discusses three practical strategies to enhance compliance in developer workflows without significantly altering company culture, aiming to increase developer productivity and satisfaction. It emphasizes the importance of consistently executing basic compliance measures, such as code reviews and access management, using tools like GitHub to integrate compliance seamlessly into existing workflows. The post highlights the significance of a shared understanding of compliance concepts between developers and auditors, advocating for the use of the three lines of defense model to clarify roles in risk management. Additionally, it explores the potential of AI-powered compliance tools and emphasizes the necessity of streamlined approval processes to optimize agility. The article underscores the importance of balancing business value and security to ensure organizational success, encouraging developers to contribute to their team's defensive efforts without overburdening them.

Policymakers worldwide are crafting policies that influence software development, and GitHub Policy aims to represent developers and foster software innovation by supporting research, such as updating the Center for Strategic and International Studies (CSIS) dataset on government policies affecting open source software. This dataset, which catalogs global open source policies since 1999, has been a vital resource for developers and researchers, illustrating contributions like GitHub's role in startup formation. Governments are increasingly recognizing the benefits of "contributing upstream" for security and influence, with examples like the German Sovereign Tech Fund supporting open source project maintainers. The importance of open source in cybersecurity, innovation, and service delivery necessitates thorough data on government policies, as seen in the EU's Cyber Resilience Act and AI Act. GitHub's Chief Legal Officer, Shelley McKinley, joined a CSIS panel to launch the updated dataset, emphasizing the growing focus on open source in cybersecurity and the need for community contributions to enhance the dataset.

CVE-2022-25664 is a vulnerability discovered in the Qualcomm Adreno GPU, which allows information leakage due to inconsistencies between the CPU cache and physical memory. This bug, found accidentally, can be exploited by a malicious Android app to leak large amounts of information from both user space and kernel space without affecting the phone's operational state. The vulnerability arises from cache coherency issues, which cause stale data in physical memory to be accessible even after it has been cleared from the CPU cache. Exploiting this flaw involves manipulating GPU command buffers to view inconsistent data in adjacent memory spaces, allowing for a potential Kernel Address Space Layout Randomization (KASLR) bypass. Although Qualcomm disclosed and patched the issue in October 2022, the bug highlights the challenges in detecting cache-related vulnerabilities, particularly due to the complex and often misunderstood cache-flushing mechanisms in Arm64 architectures.

GitHub Copilot is an AI-driven tool developed by OpenAI that enhances developer productivity by providing real-time code suggestions within a developer's IDE. Trained on extensive public code, Copilot assists in reducing extraneous cognitive load, allowing developers to focus more on solving business problems rather than the intricacies of coding. While it boosts efficiency, completing tasks 55% faster in some cases, it is not a substitute for sound coding practices and DevSecOps processes. Developers should have a basic understanding of the programming language they are using to evaluate Copilot's suggestions, and traditional methods of testing and code review remain essential to ensure code quality and security. As AI tools like Copilot become more prevalent, maintaining robust development practices is crucial for leveraging these technologies effectively.

GitHub Codespaces provides a practical platform for developers at any stage of their career to apply new programming concepts through hands-on experience, utilizing the "see one, do one, teach one" methodology. By signing up for GitHub and accessing Codespaces, users can engage in interactive learning, such as modifying a web application's code and style, with real-time feedback through a live preview. The platform encourages experimentation by allowing users to make changes, publish their projects to a GitHub repository, and share them for collaborative development. Codespaces also offers quickstart templates for popular frameworks, enabling users to explore and enhance pre-existing codebases as a means to understand project structure and inter-file communication. This environment not only facilitates learning new languages and frameworks but also supports advanced exploration with documentation resources and encourages sharing of projects on social media to foster community interaction.

On January 30, 2023, GitHub implemented a change that altered the compression settings for source code downloads, resulting in unexpected consequences for several communities due to changes in the byte layout of archives, affecting checksums and hashes. GitHub promptly reverted the change and acknowledged the need for clearer communication and testing to prevent similar occurrences in the future. Going forward, GitHub committed to maintaining byte-for-byte stability of source downloads for at least one year and promised to give six months' notice before any format changes, barring critical vulnerabilities. They recommend using commit IDs for reproducibility and suggest switching to release assets for security to avoid issues with checksums. The platform also plans to update its documentation to reflect these commitments while engineering workarounds for minor deficiencies in the current system.

GitHub has introduced several enhancements to CodeQL, its semantic analysis engine for code scanning, over the past year, which now includes support for new languages like Ruby and Kotlin, as well as full support for Java 19, Go 1.19, C#11, and Python 3.11. These updates allow for more comprehensive scanning of codebases, detecting vulnerabilities with an increased number of default security queries that cover all OWASP categories and 100% of SANS CWE Top 25. Improvements have also been made to the user experience, such as the ability to customize analysis with query filters and faster analysis speeds. Additionally, CodeQL packs and databases for popular open-source projects are now available, and the GitHub community continues to contribute significantly to the platform's development. CodeQL remains free for open-source repositories, while private repositories can access it through GitHub Advanced Security with a subscription.

GitHub emphasizes its commitment to transparency, privacy, and minimized disruption for developers on its platform by detailing its content moderation policies and legal request handling processes in its transparency reports. These reports, adhering to the Santa Clara Principles and UN guidelines, cover a range of topics including government and DMCA takedown requests, user information disclosure, and measures against abusive content. In 2022, GitHub processed 432 requests to disclose user information, predominantly from law enforcement, and 2,321 valid DMCA takedown notices, reflecting an increase in circumvention-related claims. GitHub also addresses government content removal requests through geoblocking where possible, and it provides developers with legal resources when their projects face legal challenges. The company continues to advocate for greater access to its services in sanctioned regions, offering avenues for users to appeal account restrictions. By providing structured data and maintaining a public repository for takedown requests, GitHub seeks to lead by example in transparency and foster a global discourse on platform governance.

GitHub Copilot has undergone significant updates to enhance the quality, responsiveness, and security of its code suggestions. The underlying Codex model has been upgraded, leading to a notable increase in the percentage of code generated by Copilot, with Java developers seeing up to 61% of their code being produced by the tool. These improvements include a new Fill-In-the-Middle (FIM) paradigm for better context understanding and a lightweight client-side model that reduces unwanted suggestions. Additionally, an AI-based vulnerability prevention system has been introduced to block insecure coding patterns in real-time, targeting issues like hardcoded credentials and SQL injections. These enhancements aim to help developers code more efficiently and securely, with GitHub Copilot now offering an improved experience for both individuals and businesses.

The Git project has released new versions to address two security vulnerabilities, CVE-2023-22490 and CVE-2023-23946, affecting versions 2.39.1 and older. CVE-2023-22490 involves the local clone optimization in Git, where a specially-crafted repository might allow data exfiltration by tricking Git into using local clone optimization with non-local transport. CVE-2023-23946 relates to the git apply function, where a malicious patch can exploit symbolic links to write arbitrary files outside the working copy. To mitigate these risks, users are advised to upgrade to Git version 2.39.2 and follow best practices, such as avoiding untrusted repositories and inspecting patches. GitHub has implemented several measures to prevent exploitation, including updates to GitHub Desktop, Codespaces, Actions, and Enterprise Server. Contributions to the fixes came from Taylor Blau of GitHub and Patrick Steinhardt of GitLab, with acknowledgment to the discoverers yvvdwf and Joern Schneeweisz.

GitHub Copilot, introduced in 2021 in collaboration with OpenAI, is a pioneering AI-powered developer tool designed to enhance coding efficiency by suggesting code in real-time based on context from a developer's work. Since its launch, it has significantly increased productivity for over a million developers, enabling them to code faster and more effectively, with recent data showing it generates up to 46% of all code for its users. The tool is now being expanded with GitHub Copilot for Business, offering enhanced features such as improved AI models, security vulnerability filtering, and VPN support, making it accessible to organizations of all sizes. Research indicates that developers using Copilot report faster task completion, improved focus, and greater job satisfaction, as it allows them to focus on more meaningful work rather than repetitive coding tasks. The tool's integration into various coding environments, from Visual Studio to JetBrains IDEs, underscores its flexibility, and it represents the beginning of a broader vision to incorporate AI into all facets of the development process, positioning organizations to capitalize on AI's transformative potential in software development.

GitHub has filed an amicus brief in the appeal of Yout LLC v. Recording Industry of America, Inc., challenging a district court's interpretation of Section 1201(a) of the DMCA, which prohibits circumventing technological measures controlling access to copyrighted works. The case involves Yout's use of youtube-dl to facilitate the downloading of YouTube videos, which the court deemed a violation due to the absence of a download button being considered an access control measure. GitHub argues that this interpretation conflates access with use, thereby threatening developer innovation by potentially criminalizing widely used tools like ad blockers and web archivers. GitHub emphasizes that Section 1201(a) should not restrict innovations enhancing content experience, as it could stifle technological progress and curtail developers' ability to experiment and innovate without fear of legal repercussions. The brief further asserts that the court should consider whether such uses fall under copyright's fair use provisions, highlighting the importance of protecting developers' rights to foster creativity and innovation in the digital age.

The special edition of GitHub's Release Radar celebrates various open source projects that released major updates during December and January, highlighting the vibrant contributions of the developer community. Among the featured projects, GitHub Unwrapped 2022 offers users a personalized video recap of their coding activity over the year, while Vite 4.0 introduces enhancements like new CLI shortcuts and cleaner build logs, reflecting ongoing growth in its ecosystem. SWR 2.0, a React data fetching library by Vercel, showcases improvements in UI capabilities and support for concurrent rendering, and React Virtuoso 4.0 adds flexibility with new generics for large dataset rendering. AMPHP 3.0 marks a significant update for PHP libraries, shifting to the Revolt event loop, and DiceBear 5.0 enhances custom avatar creation with six new styles. Typed RPC 3.0 provides a lightweight TypeScript remote procedure call protocol, and neo.mjs 5.0 streamlines JavaScript framework functionality with runtime class enhancements. Neo4j-Migrations 2.0 updates its database refactoring tools with Java 17 support, and ToolJet 2.0 enhances its low-code platform with a refreshed interface and no-code database features. Blaze 3.0 simplifies peer-to-peer file sharing with a web-based approach, ShareX 15.0 enriches screen recording capabilities, and Roadmap 1.0 offers a new voting application for feature feedback. FullCalendar 6.0 improves stability for web-based scheduling, while Neon Resurgence 1.0 emerges as the winner of the GitHub Game Off competition with its engaging gameplay. The edition concludes by inviting developers to submit their projects for future features.

Security vulnerabilities in software development continue to be a growing concern, despite efforts over the years to secure code. This issue often arises from using security tools and strategies that do not align with optimizing the developer experience, leading to frustration, reduced usability, and a shift in focus away from security towards rapid software delivery. GitHub aims to address these challenges by advocating for embedding security into the developer workflow and leveraging resources like the OWASP Top 10 list, which highlights common vulnerabilities such as cryptographic failures, injection attacks, insecure design, and outdated components. Strategies such as GitHub's Advanced Security features, including secret scanning and Dependabot alerts, are recommended to mitigate these risks while maintaining developer productivity. These approaches focus on integrating security measures within the development process, encouraging collaboration among developers, security professionals, and risk management teams, ultimately fostering a secure and efficient software development environment.

GitHub's new code search engine, Blackbird, was built from scratch using Rust to address the unique challenges of searching vast and constantly changing codebases, which existing solutions could not handle effectively. The decision to create a custom engine was driven by the need for a more efficient user experience, allowing developers to ask questions of the code and receive answers through iterative searching and navigation. Unlike general text search engines, Blackbird supports search requirements specific to code, such as handling punctuation and regular expressions, without stemming or removing stop words. The architecture of Blackbird involves the use of ngram indices, delta encoding, and a sharding strategy to manage and index over 200 million repositories efficiently. The system uses Kafka for asynchronous processing, ensuring query consistency even as code changes, and its optimized indexing allows for faster queries at scale. By reducing the data footprint with techniques like content deduplication and delta indexing, the new system significantly enhances search performance, offering a robust solution for developers navigating GitHub's extensive codebase.

Thomas Dohmke, the CEO of GitHub, delivered a speech in Brussels emphasizing the importance of the AI Act in shaping global AI regulation, underscoring its significance for developers and the open-source community. He highlighted the pivotal role of open source in driving technological innovations, noting its foundational impact on AI development and its alignment with European values of collaboration and diversity. Dohmke argued that open-source developers, often volunteers and without significant resources, should be exempt from the compliance burdens of the AI Act, which should instead focus on entities distributing products. He stressed the economic potential of AI, predicting it will contribute substantially to global and European economies, and advocated for policies that support the growth of open-source AI in Europe, challenging the dominance of the US and China in tech innovation.

Ludum Dare 52, a long-standing weekend game jam, recently concluded with the theme "harvest," resulting in 1,632 game submissions. This online competition challenges participants to create a game from scratch within a short time frame, adhering to a specific theme announced at the beginning. This year's event saw a variety of creative interpretations, including games about farming, space adventures, and horror scenarios involving possessed machinery. Notable entries include "Boba" by @DanielMullinsGames, which won first place with its creative incremental-style gameplay, and other intriguing games like "Ether Warp," "Harvest Season," and "Orchard Alchemy." The competition not only celebrates innovation in game development but also fosters a community where both newcomers and experienced developers can showcase their skills. Ludum Dare 53 is set to begin on April 28, inviting all levels of participants to engage in this creative challenge.

GitHub's branch deploy model offers a streamlined approach for deploying code to production by ensuring that the main branch remains stable and deployable at all times. Unlike the traditional deploy-merge model, where changes are merged into the main branch before deployment, the branch deploy model allows changes to be deployed and validated before merging, reducing risk and facilitating rollbacks. To support this model, GitHub uses a combination of ChatOps and the branch-deploy Action, which is particularly useful when ChatOps integration is unavailable. The branch-deploy Action leverages GitHub Actions to automate deployments through comments on pull requests, known as IssueOps, enhancing flexibility and customization for different deployment targets. This approach is increasingly adopted by various organizations, including npm, and supports Infrastructure as Code (IaC) repositories where tools like Terraform are used. The branch-deploy Action is highly customizable, allowing users to define command syntax, deployment environments, and triggers, while ensuring compatibility with branch protection settings, making it an efficient tool for enhancing DevOps practices.

GitHub Docs serve as essential resources for developers, offering support and guidance to a vast audience of over 100 million users daily. To efficiently manage the complexity of their documentation, which includes 2,396 open-source articles across multiple languages and versions, the GitHub Docs team employs GitHub Projects. This robust project management tool helps the 42-member global team organize their biweekly work cycles, prioritize tasks, and manage releases, while accommodating the diverse nature of their content through custom workflows and labeling systems. GitHub Projects, when paired with GitHub Actions, enhances the team's ability to streamline processes, track issues, and customize workflow views, ultimately allowing team members to focus more on creating valuable content for the developer community. This seamless integration fosters productivity and innovation, enabling the team to efficiently handle the dynamic demands of documentation management.

In January, GitHub experienced two incidents affecting service performance and git users. The first incident occurred on January 30 at 21:48 UTC, lasting 35 minutes, and involved degraded performance for GitHub Packages and Pages due to a backend change, which was mitigated by reverting the change. The second incident on January 30 at 18:35 UTC lasted seven hours and involved an upgrade to the production Git binary, which included an internal gzip implementation that caused checksum mismatches for "Download Source" links, despite no content alteration. This was resolved by reverting the compression change. Both incidents are still under investigation, with more detailed updates promised in the next month's report, and real-time updates available on GitHub's status page.

In 2021, the All In initiative was launched to promote diversity, equity, and inclusion (DEI) within the open-source community, and it has now introduced the All In for Maintainers program along with a DEI Resource Hub. This initiative aims to equip open-source maintainers with the necessary training and support to foster inclusive communities, addressing the challenges they face in advancing DEI. The DEI Resource Hub, created collaboratively with open-source practitioners and DEI experts, serves as a centralized repository offering a range of resources focused on inclusive leadership, accessibility, and addressing burnout among maintainers. By inviting contributions from the community, the initiative seeks to continually update this hub to reflect the evolving needs of open-source communities and ensure widespread access to DEI tools. The launch of the DEI Resource Hub marks a new phase for All In for Maintainers, with ongoing updates and future program announcements anticipated to further support diversity and inclusion efforts in open source.

Open source software forms a crucial foundation for modern technology, fostering a culture of collaboration and participation that extends beyond mere technical contributions. GitHub plays a central role in this ecosystem by serving as a hub where developers can collaborate, grow their projects, and gain recognition. Stories like those of Barbara Forbes with PSSendGrid and Evan You with Vue highlight how personal projects can evolve into vibrant communities. As projects mature, maintainers often create governance structures and mentorship opportunities to sustain collaboration, as seen in the experiences shared by Lorena Mesa and Keeley Hammond. Open source projects also benefit from organizational support, with companies like Meta and Quansight Labs investing in projects like React and NumPy, respectively. Funding mechanisms like GitHub Sponsors enable maintainers like Kovid Goyal of Calibre to work full-time on open source. The open source movement is expected to remain integral to technological advancement, encouraging diverse contributions and ongoing community support.