April 2023 Summaries

In the latest episode of The ReadME Podcast, physicist J. Luc Peterson from Lawrence Livermore National Laboratory discusses a significant breakthrough in fusion research achieved through open source technology, which played a crucial role in reaching the milestone of "ignition" by utilizing supercomputers and AI. The episode explores how open source is shaping the future of nuclear physics and also provides listeners with career advice from Jerome Hardaway, founder of Vets Who Code, on adapting to job market changes and becoming indispensable in the industry. Additionally, Kedasha Kerr offers insights and tips for newcomers on effectively using GitHub to contribute to open source projects and advance their tech careers. The podcast emphasizes the transformative impact of technological advancements, such as fusion energy and AI, on society and encourages listeners to embrace innovation and continuous learning.

The Command Line Interface (CLI) is an essential tool for developers, offering flexibility and control through specific commands that execute tasks like moving files, running programs, or starting servers. Despite its initial complexity for beginners, mastering CLI techniques, such as using keyboard shortcuts, command history, wildcards, pipes, and command substitution, can enhance productivity and understanding of operating systems. The article provides insights into popular CLI tools, including grep for pattern searching, jq for JSON processing, and ImageMagick for image manipulation. It also highlights the GitHub CLI for managing GitHub projects and workflows efficiently. As developers continue to explore the CLI, they can benefit from resources like tldr, Explainshell, and the repository awesome-cli-apps to discover new tools and tricks. The upcoming GitHub Copilot for CLI aims to further simplify the use of terminal commands by translating natural language prompts.

Maintainer Month is a global event taking place in May that celebrates and supports the vital contributions of open source maintainers. It includes a variety of activities such as workshops, podcasts, and conferences, notably featuring the Open Source Summit North America in Vancouver, where maintainers can share their stories. The event also seeks partners to host events, sponsor projects, and amplify stories about maintainers using the hashtag #MaintainerMonth. Companies and organizations are encouraged to participate by providing support through sponsorships, organizing community events, and possibly launching FOSS Funds. The initiative underscores the importance of recognizing and sustaining the efforts of maintainers in strengthening the open source ecosystem.

Kyle Daigle, the newly appointed Chief Operating Officer of GitHub, reflects on his decade-long journey with the company, highlighting its growth from a small startup to a platform with over 100 million developers and a workforce of more than 3,000 "Hubbers". Daigle emphasizes GitHub's commitment to innovation and its role in transforming software development, especially through AI advancements like GitHub Copilot and Copilot X. As COO, he aims to guide GitHub's strategic direction, focusing on maintaining a strong company culture and business strategy while fostering a remote-first, AI-integrated environment. Daigle's background as a developer and his experience in engineering and product leadership in various industries contribute to his passion for integrating software practices into operations. He remains committed to ensuring GitHub continues to support developers, creators, and innovators worldwide while engaging in personal interests like home automation, nonprofit work, gaming, and family travel.

The Git project has released new updates to address several security vulnerabilities, notably CVE-2023-25652 and CVE-2023-29007, affecting versions 2.40.0 and older, which could lead to arbitrary code execution and controlled content writes. Additionally, Git for Windows has patched vulnerabilities, including CVE-2023-25815, CVE-2023-29011, and CVE-2023-29012, that pose risks to users on shared machines and those using specific features like Git CMD and SOCKS5 proxy. Users are urged to upgrade to Git 2.40.1 or take precautionary measures such as avoiding certain commands and configurations in untrusted environments. GitHub has proactively scheduled updates for its platforms to mitigate these issues, although it is not directly affected due to its operational practices. The vulnerabilities were discovered by various security researchers, and the fixes were developed by a team including Johannes Schindelin and Taylor Blau, among others.

Deployment Protection Rules for GitHub Actions offer enhanced control over CI/CD workflows, enabling teams to ensure high-quality, secure applications by enforcing rigorous testing and quality gates before code reaches production. This feature allows developers to create custom rules that can be integrated into deployment processes, fostering collaboration between development and operations teams and leading to faster, more reliable software releases. The public beta, available to GitHub Enterprise Cloud users, includes partnerships with leading service providers like Datadog, Honeycomb, New Relic, NodeSource, Sentry, and ServiceNow, each offering tailored Deployment Protection Rules to integrate monitoring, security, and performance insights into the deployment pipeline. These integrations aim to streamline the development lifecycle, reduce bugs, and enhance code reliability, while also offering the flexibility for users to create bespoke protection rules.

GitHub has introduced a feature allowing npm projects built on GitHub Actions to publish provenance data using the --provenance flag, enhancing trust in the npm supply chain. This provenance data provides a verifiable link between a package and its source repository, detailing the specific build instructions used. By leveraging the Supply-chain Levels for Software Artifacts (SLSA) specification, the provenance schema captures essential information about the source repository, commit SHA, and buildConfig, ensuring transparency and traceability. To further bolster security, GitHub employs the Sigstore project for cryptographic signing, using a public certificate authority to issue short-lived signing certificates linked to the CI job's identity. This approach aims to prevent malicious code injection by anchoring trust in the source code and build process rather than relying on individual maintainers. The provenance feature is currently supported by GitHub Actions, with plans to expand to other CI/CD platforms, and it integrates with Sigstore's Rekor service for tamper-evident transparency. Additionally, GitHub is working on further improvements, such as adopting version 1.0 of the SLSA specification and collaborating with other cloud CI/CD providers, as part of a broader initiative to secure the open-source software supply chain.

GitHub has announced the general availability of its private vulnerability reporting feature, designed to streamline the process of reporting and fixing vulnerabilities in public repositories by creating a private collaboration channel between researchers and maintainers. Initially introduced in public beta at GitHub Universe 2022, the feature has since been adopted by over 30,000 organizations on more than 180,000 repositories, facilitating over 1,000 submissions from security researchers. This tool allows maintainers like Jordan Tucker of JSON5 to manage vulnerability disclosures more efficiently, avoiding public discussions and cumbersome email threads, and has proven effective in addressing security issues, as demonstrated by the more than 11 million alerts triggered for a JSON5 vulnerability. Security researchers, such as Marco Squarcina, also benefit by being able to submit vulnerabilities directly through GitHub without relying on potentially ignored emails. The feature now includes enhancements like enabling it across all repositories within an organization and integration with third-party systems, alongside GitHub's other security tools, offering it for free on public repositories.

Cyberspace has become a battleground with the rise of cyber mercenaries, private sector actors conducting offensive operations on behalf of governments or private entities, which poses a threat to global security by hoarding and selling exploits and surveillance tools. The technology industry is called to unite against these threats, as emphasized by the White House National Cybersecurity Strategy, which advocates shifting cybersecurity responsibilities from individuals and small entities to more capable organizations. GitHub, alongside 40 other companies, endorses the Cybersecurity Tech Accord principles aimed at limiting such offensive operations by countering cyber mercenaries, investing in cybersecurity awareness, maintaining product integrity, and handling legal requests responsibly. GitHub also actively supports secure software development, funds open source security projects, and partakes in legal actions, like joining an amicus brief in NSO v. WhatsApp, to defend against cyber-surveillance companies acting for foreign governments. The company encourages others to join in this collective effort to enhance security, democracy, and human rights in the digital realm, as articulated by Mike Linksvayer, Head of Developer Policy.

In January, GitHub launched the default setup for code scanning, a feature that simplifies the process of enabling code scanning on repositories without needing a .yaml workflow file. This feature has been well-received, with nearly half of new code scanning implementations adopting it and 96% of users continuing its use. Recent enhancements to the default setup include multi-repository enablement, allowing users to apply security features across selected groups of repositories with ease, and an API for programmatic enablement. The multi-repository enablement provides granular control, enabling users to filter repositories by attributes and exclude specific ones from code scanning. An "Enable all" option is also available for applying code scanning across all eligible repositories, using the latest starter workflow configuration. Improvements at the repository level include extended query suites for broader alert coverage and the ability to use the API for setup customization. Future enhancements will focus on supporting additional languages and customization options, as part of GitHub's commitment to enhancing software security while maintaining a positive developer experience.

Migrating to GitHub can significantly streamline enterprise tech stacks by consolidating source code management, enhancing developer productivity, and fostering a self-service culture among development teams. This transition allows for more efficient DevOps practices, reducing time and costs associated with audits, as highlighted by a Forrester report indicating a 75% improvement in tool management efficiency when using GitHub Enterprise Cloud and GitHub Advanced Security. GitHub's integration of innovative tools like GitHub Copilot and Copilot X further boosts productivity by leveraging AI capabilities, offering features such as chat, voice, and integration with pull requests and documentation. These advancements, coupled with a centralized platform, simplify security and compliance reviews, positioning enterprises to rapidly adopt new innovations. Resources are available to support enterprises through the migration process, ensuring a smooth transition and enabling them to capitalize on the benefits of GitHub's comprehensive suite of tools.

Douglas Engelbart's visionary demonstration of computers as collaborative tools has parallels to today's emergence of generative AI coding tools, which are transforming software development by enhancing creativity and productivity. These tools, powered by large language models (LLMs) like OpenAI's GPT-3 and GPT-4, enable developers to brainstorm, break down complex tasks, and receive contextual coding suggestions and entire functions in response to natural language prompts. Generative AI distinguishes itself from traditional automation and machine learning by offering developers a more abstract and strategic approach to coding, where they can focus on larger problems and creative solutions. With tools like GitHub Copilot, developers are reportedly coding faster and feeling less frustrated, leveraging these technologies to translate code, enhance test coverage, and explore new problem-solving avenues without leaving their integrated development environments (IDEs). The field is rapidly evolving, with advancements such as multimodal LLMs that process both text and images, paving the way for a new era of AI-powered software development, which holds promise for increased productivity and innovation.

Organizations can maintain compliance with regulatory frameworks such as GLBA, SOX, and HIPAA without disrupting developer workflows by leveraging tools on the GitHub Enterprise platform. Developers are crucial in maintaining a secure software development lifecycle, and GitHub offers resources like code and secret scanning to detect vulnerabilities and prevent the introduction of sensitive data such as PII, PHI, and PCI into codebases. Automated code reviews and push protection features enhance security by enforcing standards and preventing unauthorized data from entering repositories. GitHub Actions and secrets management help ensure compliance and standardization across the software development lifecycle, while logging and monitoring capabilities provide real-time insight into changes and potential security threats. By adopting GitHub's features incrementally, organizations can streamline their development processes, improve security, and adhere to industry standards, all while reducing developer friction and maintaining productivity.

GitHub Accelerator is a 10-week program launched to support open source maintainers by providing an initial sponsorship of $20,000 and guidance from leaders in the field, aiming to help them establish sustainable funding for their projects. The first cohort in 2023 consists of 20 diverse projects with 32 participants from various countries and covers a wide range of industries and software applications. The program seeks to assist maintainers in making open source work a full-time career by testing new funding models and sharing insights with the community. Participants engage in weekly sessions on topics such as licensing, governance, sponsorships, and community management, and at the program's conclusion, GitHub plans to share the outcomes and lessons learned. Additionally, GitHub has introduced features like organization-funded sponsorships and bulk sponsorships to make it easier for companies to support the open source projects they depend on.

GitHub's recent blog post highlights the transformative potential of generative AI in software development, particularly in enhancing compliance and audit processes through automation and optimization. Generative AI can streamline the concept of separation of duties—a longstanding compliance measure—by automating tasks and reducing manual intervention, thereby allowing developers to focus on more value-added activities. The GitHub Next team is developing AI capabilities for code reviews and pull requests, aiming to provide objective insights, automate description creation, and suggest improvements, which could enhance both development and compliance workflows. These advancements promise to keep developers in their creative flow while simultaneously supporting compliance and audit teams in identifying security vulnerabilities more efficiently. As these AI-driven features evolve, they offer a glimpse into a future where manual tasks are minimized, allowing enterprises to leverage human creativity for business success and maintain a robust compliance posture.

GitHub has launched a new collection of merchandise in the GitHub Shop, offering a range of items like apparel, drinkware, and collectibles that aim to foster a sense of community among developers and businesses using the platform. This new collection features comfortable clothing and creative products, such as the Invertocat Joggers and Dog Bowl Bottle, while also retaining classic items like Mona stickers, Octocat mugs, and GitHub hoodies that have been popular for over a decade. Celebrating its 15th anniversary, GitHub highlights its journey and community impact through the "Art of the Octocat" book, which explores the history and development of its iconic mascot, Mona. The GitHub Shop encourages users to feel connected to the broader GitHub community and to harness its collective energy for innovative projects.

Developers can significantly impact financial inclusion by leveraging GitHub's tools and services to create solutions that provide access to essential financial products for underserved populations. Financial inclusion, as defined by the World Bank, involves providing affordable financial products like checking accounts and credit cards to over a billion unbanked people worldwide, many of whom are women, impoverished individuals, and those in rural areas. Open Finance, supported by banks such as NAB, uses APIs to securely connect banks, customers, and fintechs, facilitating data exchange and lowering barriers for those with limited access to traditional financial services. GitHub, as a global open-source platform used by 100 million developers, offers an ideal environment for innovation, collaboration, and the dissemination of open-source solutions that drive financial inclusion. By organizing hackathons, improving API documentation, and recognizing developers' contributions, GitHub enhances the developer experience and supports initiatives like the GitHub Sponsors program and GitHub for Startups, fostering a community that can globally address the challenges of financial exclusion.

Game Bytes is a monthly series exploring developments in game development on GitHub, showcasing updates on game engines, open-source games, and game jams. Notable highlights include the release of Godot 4.0, a major update of the open-source game engine with enhanced 3D rendering and expanded platform support, and the Godot GDC 2023 Meetup at GitHub HQ. The series also covers various open-source game projects such as Fly Dangerous, a multiplayer flight simulator, Cataclysm: Dark Days Ahead, a roguelike RPG now on Steam, and OpenRA, a revival of classic real-time strategy games. Additionally, PixiEditor, an open-source pixel art editor, has launched its 1.0 version featuring new tools for creating pixel-perfect art. The series encourages participation in upcoming game jams like Games for Blind Gamers 2 and Ludum Dare #53, offering opportunities to learn and create new games.

Generative AI, encompassing tools like ChatGPT, DALL-E, and GitHub Copilot, represents a transformative category of artificial intelligence that creates new content—such as text, images, and code—by identifying patterns in large datasets using techniques like neural networks and deep learning. This technology is being increasingly adopted across various fields, including content creation, programming, data generation, and language translation, with applications ranging from improving accessibility to enhancing gaming and web design. Generative AI models, such as generative adversarial networks (GANs), transformer-based models, and variational autoencoders (VAEs), employ complex algorithms to produce realistic outputs and are supported by open-source frameworks like PyTorch and TensorFlow. However, the development and implementation of these models face challenges related to the need for substantial computational resources and high-quality data, and while they are not yet flawless, their rapid evolution suggests a promising future for enhancing productivity and creativity in numerous industries.

GitHub's approach to maintaining and upgrading its Ruby on Rails monolith involves a rigorous and automated weekly upgrade process that enhances the platform's resilience and stability. With nearly two million lines of code and over 1,000 engineers collaborating daily, GitHub deploys updates up to 20 times a day and implements a Rails upgrade almost every week. This process begins every Monday with an automated pull request that updates the Rails version, allowing engineers to work on the latest features and improvements. This strategy, which has evolved from months-long migrations to under a week, ensures compatibility with new releases, fosters collaboration with the Rails community, and removes the need for extensive patching. Similarly, GitHub applies a parallel approach to Ruby upgrades, testing new builds alongside production versions to ensure seamless transitions and early identification of potential issues. This continuous upgrade process is supported by a robust test suite and progressive deployment strategies, enabling GitHub to maintain high security and performance standards while contributing valuable feedback to the Ruby core team. The investment in regular upgrades and community collaboration is seen as crucial for sustaining a robust application framework, with GitHub championing the importance of treating these frameworks as integral parts of application development.

In 2023, a critical security vulnerability, GHSL-2023-005, in the Pixel 6's Arm Mali GPU driver allowed for arbitrary kernel code execution and root access from malicious apps, despite being publicly fixed in a prior driver release in 2022. The issue arose due to a patch oversight during backporting, leaving a loophole that could be exploited by manipulating JIT memory regions. This oversight was not originally flagged as a security issue, leading to a delayed patch and leaving users exposed to potential attacks. The vulnerability hinged on the complex handling of JIT memory and GPU address mappings, ultimately allowing for unauthorized access to kernel memory. The exploit involved a race condition during memory allocation processes, which could be leveraged to gain control over system resources. The problem was quietly addressed in a March 2023 update, but the delayed application of the patch highlights the need for more transparent security patching processes to prevent prolonged exposure to such vulnerabilities.

Automation within the development workflow and DevOps lifecycle is emphasized as a crucial factor for accelerating delivery and maintaining quality, with GitHub Actions providing a platform for implementing continuous integration and continuous delivery (CI/CD) practices. While companies often struggle with disparate tools and inconsistent quality governance across teams, GitHub Actions offers solutions like branch protection rules, reusable workflows, and required workflows to standardize practices and ensure compliance. The introduction of tools like GitHub Actions Importer facilitates the migration from other platforms, enabling organizations to centralize their CI/CD processes and share best practices through reusable workflows. To mitigate risks, GitHub Actions can be configured to manage permissions and secrets securely, and governance policies can be established to control actions and workflows at various organizational levels, ensuring that teams adhere to company-wide standards. This approach not only fosters collaboration and innovation but also reduces operational overhead and enhances the overall software development lifecycle by integrating recommended practices across the organization.

In March, GitHub experienced six incidents causing degraded performance across its services, with a notable incident from February 28 affecting GitHub Codespaces in the East US region due to slow VM allocation from a cloud provider. This incident prompted a redirection of codespace creations and led to architectural changes for quicker failover. On March 1, latency issues in package registries were traced to an unhealthy disk on a VM node, prompting database failover and a shift to a new MySQL infrastructure for improved reliability. March 2 saw GitHub Actions workflow failures due to an SSL certificate issue with a CDN provider, which was resolved by removing the incorrect binding. On March 15, increased latency in package registries resulted from a slow-running query during maintenance, leading to updated safety checks in the maintenance process. Incidents on March 27, 29, and 31 affected pages, codespaces, and Git operations, with investigations still ongoing. GitHub is implementing changes to improve monitoring, failover capabilities, and infrastructure reliability, with updates and ongoing efforts shared on their status page and engineering blog.

GitHub Enterprise is an essential component of the software development lifecycle, offering features that allow administrators and users to collaborate effectively. Announced in December 2022, enterprise accounts are being rolled out to all GitHub Enterprise customers, providing a management layer that combines enterprise-wide innersource experiences with administrative capabilities. These accounts grant access to GitHub Enterprise features such as GitHub Actions, security overview, and audit log streaming, and they also support paid add-ons like GitHub Advanced Security and GitHub Copilot. New customers now have a unified enterprise experience, and existing customers with a single organization will soon receive a free upgrade to establish their entitled enterprise accounts, though this process may take several months. Interested users are encouraged to start a free trial to explore the GitHub Enterprise experience and stay tuned for future updates and blog posts on maximizing the benefits of their enterprise accounts.

GitHub has announced the general availability of organization-funded sponsorships through GitHub Sponsors, aiming to create a more sustainable open-source ecosystem by enabling organizations to support the projects they rely on. Since the program's inception in 2019, over $33 million has been invested in open-source projects globally, with a significant portion coming from organizations. This initiative addresses the funding gap for open-source contributors, especially those from underrepresented groups, and aims to mitigate the personal costs many developers face when working on open source. GitHub has introduced new features such as bulk sponsorships and invoice payments to facilitate easier sponsorship at scale and has begun implementing fees on organization-funded sponsorships to cover processing costs while maintaining fee-free options for individual sponsors. As GitHub continues to refine the program, it remains focused on reducing friction and increasing financial support for open-source developers, emphasizing the importance of direct contributions from organizations to the sustainability of open-source projects.

Millions of people engage with open source software daily, yet the developers behind these projects often lack adequate community support. To address this, GitHub is creating a private Maintainer Community that invites open source maintainers to connect with peers, access new features early, and participate in workshops. This initiative includes events such as the upcoming workshop on April 5, focusing on personal ecology and burnout prevention for maintainers. The community is part of the broader GitHub Community, which serves as a platform for user interaction and feedback. Additionally, GitHub is preparing for Maintainer Month in May to further celebrate and support open source maintainers.

GitHub, a trusted software development platform, has enhanced its security and compliance solutions by introducing advanced features like audit log streaming, which allows enterprises to send near real-time data to chosen storage or SIEM systems. Since its launch, over 800 enterprises have adopted this feature, enabling data exploration, threat detection, compliance monitoring, and operational insights. The platform has also expanded its audit log capabilities to include API requests, helping organizations better understand API usage and detect potential security issues. Additionally, GitHub Enterprise Cloud supports the integration of external identity data via SAML SSO and SCIM, enhancing the correlation between user activity and corporate identity. With integrations into SIEM systems like Splunk and DataDog, GitHub Advanced Security (GHAS) users can gain a comprehensive view of application security events, linking them with other business data to optimize security posture. These developments underscore GitHub's commitment to providing enterprises with tools to maintain security, compliance, and accountability through enriched audit logs and seamless integration with security stacks.