May 2023 Summaries

The blog post by Man Yue Mo explores the intricacies of a security vulnerability, CVE-2022-46395, in the Arm Mali GPU driver used in Android devices, specifically on a Pixel 6. This vulnerability allows unauthorized access to kernel code execution and root privileges through a race condition in memory management. The issue is a variant of Project Zero's CVE-2022-36449 and involves a tight race window that can be exploited using advanced techniques to manipulate memory pages. The post details how the vulnerability stemmed from improper handling of shared memory regions, specifically KBASE_MEM_TYPE_IMPORTED_USER_BUF, which can lead to a use-after-free condition. The author demonstrates the exploitation of this race condition by widening the race window with strategic interrupt timing, ultimately enabling arbitrary kernel code execution. This case study underscores the importance of thorough root cause analysis in identifying and understanding security vulnerabilities, even those with seemingly limited exploitability.

Open source program offices (OSPOs) have been increasingly established across various sectors, with over 30% of Fortune 100 companies implementing them to enhance their open source activities. These offices aim to be centers of excellence by managing an organization’s open source initiatives, including code release, community participation, and dependency management. GitHub, in collaboration with the TODO Group and Linux Foundation, is conducting research to understand the adoption and impact of OSPOs, supported by a public survey designed to gather insights on issues like openness, control, and community sustainability. Participants of the survey, which is expected to take less than 15 minutes, will receive a 25% discount code for Linux Foundation e-learning courses as a token of appreciation.

In a special episode of The ReadME Podcast dedicated to GitHub’s Maintainer Month, Kelsey Hightower, a prominent figure in the Kubernetes community, discusses the future trajectory of Kubernetes, emphasizing its potential eventual obsolescence due to future innovations. Hightower highlights Kubernetes' robust extension points for security, storage, and integrations, which eliminate the need for forking and facilitate continued development without distractions. The episode explores Kelsey's philosophy on fostering open source communities, the significance of empathy for maintainers, and the profound impact of individuals behind open source projects. Discussions also touch on balancing openness and control in projects, humor's role in community building, the intersection of open source and nuclear fusion research, and technology's role in accessibility. Hightower offers insights into succession planning and identifying future leaders, underscoring the importance of making complex technologies more accessible.

Low-code technology has made it easier for developers and non-developers alike to deploy applications, with Microsoft Power Platform providing a suite of tools for building custom solutions using low-code methods. GitHub, a platform for managing and delivering code, offers GitHub Actions, a powerful automation tool that enhances continuous integration and deployment (CI/CD) by allowing developers to automate tasks like building, testing, and deploying code. GitHub Actions supports both pre-built and custom actions, facilitating workflow creation and making it possible to automate Power Platform deployments efficiently. Automating deployments with GitHub Actions ensures consistency, reduces human error, and boosts productivity by enabling version control, collaboration, and integration with GitHub tools such as GitHub Advanced Security. The blog post by April Yoho, a senior developer advocate and DevOps practice lead at GitHub, emphasizes the benefits of automation in deployment processes and provides resources and tutorials for implementing these practices.

Web applications play a crucial role in modern life, but their widespread use also makes them primary targets for cyberattacks, accounting for over 40% of data breaches. GitHub aims to enhance software innovation by ensuring security through GitHub Advanced Security (GHAS), which offers application security testing tools integrated seamlessly into the developer workflow. These tools, including secret scanning, dependency scanning, and code scanning, enable developers to address security vulnerabilities rapidly, significantly improving fix rates compared to industry norms. In 2022, GHAS helped users identify and fix millions of vulnerable packages and exposed secrets. With the public availability of GHAS on Azure DevOps, developers can access these security features without leaving their familiar environment, facilitating the detection and prevention of vulnerabilities in open-source packages and code across various programming languages.

GitHub Universe, the global developer and customer event, is returning both in-person and online on November 8-9, offering an opportunity for speakers to present on topics like AI, security, and developer experience. The article, written by Rachel Cohen, provides insights and tips for crafting a compelling session proposal, emphasizing the importance of a captivating title, clear key takeaways, and demonstrating the session's unique value and potential for ongoing engagement beyond the event. Prospective speakers are encouraged to ensure their proposals are complete, avoid sales pitches, and convey their passion for the subject matter. In addition, the article outlines the formula for a strong speaker bio and highlights the resources available from the event's content committees to guide submissions. Selected speakers will receive benefits such as a complimentary pass, speaker honorarium, travel expenses, and access to a professional speaker coach. Applications are open until June 7, with the aim of building long-term partnerships and continuing conversations with the global developer community.

GitHub celebrates Global Accessibility Awareness Day by highlighting the achievements of developers with disabilities and detailing recent accessibility improvements within the platform. The article features stories of developers like Paul Chiou, who innovates in accessibility automation, Becky Tyler, who uses eye-tracking for gaming and coding, and Anton Mirhorodchenko, who utilizes AI tools to overcome communication barriers. GitHub has made significant strides in enhancing accessibility, including improvements to navigation, code search, and color contrast, while the npm team addressed accessibility bugs in their package manager. The GitHub Design organization has long prioritized accessibility, integrating it into the development process and introducing features like GitHub Copilot Voice for hands-free coding. Additionally, GitHub fosters a culture of giving back to the accessibility community, and their internal processes reflect a commitment to inclusivity, as demonstrated by improvements in retrospective meetings and social giving events. The company's efforts are driven by a mission to eliminate barriers for developers with disabilities and to celebrate their contributions to the tech community.

GitHub Copilot, a tool for generating code suggestions, emerged from GitHub's collaboration with OpenAI's large language models (LLMs), particularly following the release of GPT-3 in 2020. Initially astonished by the capabilities of these models, GitHub engineers, including researchers like Alireza Goudarzi, explored using LLMs for code generation, which led to the development of Copilot. The journey from theoretical discussions to a practical, interactive tool involved assessing models by solving coding tasks and refining them through techniques like prompt crafting and fine-tuning. As OpenAI released more advanced models, such as the multilingual Codex, GitHub integrated these improvements to enhance Copilot's functionality, allowing it to provide more accurate, context-aware code suggestions. The continuing evolution of GitHub Copilot, marked by features like chat functionality and voice-assisted development, aims to transform the developer experience, culminating in the announcement of GitHub Copilot X, which seeks to extend AI capabilities beyond the IDE to other platform components.

GitHub Copilot, powered by OpenAI's Codex model, has been enhanced by GitHub's machine learning experts to improve its contextual understanding and coding suggestions for developers. Initially launched as a technical preview in 2021 and generally available in 2022, GitHub Copilot leverages prompt engineering to provide contextually relevant responses with low latency. The tool uses transformer large language models (LLMs) to connect input and output text, allowing it to offer more precise suggestions by considering the entire codebase rather than just the active file. Innovations like the Fill-In-the-Middle (FIM) paradigm and techniques such as "neighboring tabs" contribute to improved semantic understanding and coding efficiency. GitHub's ongoing research, including the use of vector databases and embeddings, aims to create a customized coding experience for developers, particularly in private repositories. Studies have shown that developers using GitHub Copilot can code up to 55% faster, enhancing productivity and allowing them to focus on more meaningful work. These enhancements are part of GitHub's collaboration with Microsoft Azure AI-Platform to advance GitHub Copilot's capabilities.

GitHub is actively working to enhance accessibility within its design organization by integrating accessibility earlier in the design process and fostering a culture that supports inclusive design. The organization has made significant strides by employing full-time accessibility specialists, implementing programs like the Accessibility Design Bootcamp and Design Champions, and leveraging its design system, Primer, to address color contrast issues and improve user experience for diverse needs. The organization emphasizes the importance of a cultural shift, supported by leadership, to create an environment that prioritizes accessibility. This includes hosting accessibility workshops, updating communication practices, and fostering an inclusive workplace. GitHub's journey highlights the necessity of progress over perfection and encourages the involvement of all employees in the accessibility effort, aiming to build a diverse team that better represents the users they design for.

Last week, GitHub experienced a series of availability incidents affecting several services, which have since been resolved. These incidents, occurring on May 9, 10, and 11, had various root causes, such as a configuration change that degraded Git databases, inefficiencies in GitHub App authentication token issuance, and a primary database cluster crash that led to a loss of read replicas. Each incident significantly impacted GitHub's core functionalities, causing service degradation and hampering operations like GitHub Actions workflows and pull request updates. GitHub has pledged to investigate these disruptions thoroughly, improve internal processes, enhance observability for high-cost query patterns, and ensure more resilient failover mechanisms. Moving forward, GitHub is committed to transparency and reliability, as communicated by Mike Hanley, GitHub's Chief Security Officer, who emphasized ongoing efforts to bolster site reliability and accountability.

The ReadME Podcast's latest episode explores the complexities of openness in open source software, featuring insights from Scarf founder Avi Press on the necessity for maintainers to understand the usage of their projects while respecting privacy and community autonomy. The discussion includes perspectives from various contributors, such as Ben Johnson's decision to limit contributions to his project, Litestream, while maintaining its open-source status, and Google's Jessica Januik's views on the role of humor in enhancing team dynamics. The episode also covers broader themes like the equilibrium between openness and control, open source's role in advancing nuclear fusion research, and innovative approaches to accessibility, alongside practical advice for career resilience and community building in tech. The podcast invites listeners to engage with these topics and join the upcoming Maintainer Month celebration featuring Kubernetes expert Kelsey Hightower.

A developer advocate at GitHub shares their experience of building a Google Chrome extension to clear browser cache using GitHub Copilot, a generative AI coding tool. While the process was challenging and required learning new skills and seeking help from both AI and human developers on Twitch, the author successfully created the extension by leveraging GitHub Copilot's code suggestions and real-time feedback. The project underscored the benefits of AI in reducing the fear of making mistakes, facilitating learning, and enhancing collaboration, as the author had to clearly communicate their intentions with the AI and livestream audience, resulting in a more transparent workflow. Despite the challenges, the author appreciated the reassurance and confidence gained from using GitHub Copilot, which made the live coding session more productive and less daunting.

GitHub has implemented significant changes to its user interface, focusing on enhancing accessibility, with the aim of being inclusive of developers with disabilities. The new global navigation allows users to navigate using a keyboard, ensuring a clear visual focus indicator, a logical tab order, and an operable interface that adheres to common keyboard interaction standards. Additionally, GitHub has improved the code search experience for screen reader users, emphasizing the importance of the audio experience. The company encourages feedback through its "ship to learn" approach, which values frequent iteration and user engagement to refine these accessibility features further.

GitHub's open-source design system, Primer, plays a crucial role in creating an inclusive and efficient user experience for its global developer community by focusing on an improved color contrast strategy. This initiative is part of GitHub's broader accessibility strategy, wherein the Primer team enhanced color contrast in both light and dark modes, addressing hundreds of color contrast issues across various use cases. By refining Primer Primitives, a functional color system that supports multiple color modes, and leveraging automation scripts to ensure compliance with contrast requirements, the team efficiently scaled accessibility improvements throughout the platform. The process involved a comprehensive audit to identify contrast violations, the application of a blend algorithm to manage opacity challenges, and the use of feature flags to test changes incrementally. These efforts resolved numerous accessibility issues and set a foundation for future updates, reinforcing GitHub's commitment to designing cohesive, inclusive, and efficient experiences.

GitHub Codespaces is a revolutionary cloud-based development environment designed to streamline workflows, enhance collaboration, and increase security for open-source projects. By offering a pre-configured environment that includes all necessary tools and dependencies, it eliminates the time-consuming setup process typically required for new contributors, thus improving onboarding efficiency. Codespaces allows developers to access a consistent and customizable development environment from any device with an internet connection, reducing compatibility issues and providing a seamless collaborative experience. This flexibility not only enhances productivity but also ensures a secure development setting by isolating individual Codespaces and allowing specific security configurations through devcontainer.json files. With 60 hours of free usage for individual accounts, GitHub Codespaces offers an accessible solution for open-source projects to grow and thrive, fostering a more efficient and dynamic coding environment.

Game Bytes is a monthly series exploring the gamedev world on GitHub, highlighting updates in game engines, open-source games, mods, and more. This edition covers several major releases and updates, including Babylon.js 6.0 with a revamped physics API and improved rendering, Phaser celebrating its 10th anniversary with performance and feature upgrades, and the minimalist Raylib engine gaining popularity. It also discusses Pico3D's impressive use of a microcontroller for open-world gaming, VCMI's progress in recreating Heroes of Might and Magic III, and Open Hexagon's incremental updates. Minetest 5.7.0 introduces enhanced graphics and performance, while Freeciv21 3.0 focuses on competitive multiplayer improvements. OpenRCT2 adds new features to the classic RollerCoaster Tycoon 2, and Bitburner combines programming with gaming. Tools like DFHack for Dwarf Fortress and Proton for running Windows games on Linux are also featured, along with upcoming game jams and the unique Cannon Knight game from Gamedev.js Jam 2023. The series concludes with a spotlight on a Snake game created by GitHub's CEO using GitHub Copilot during a live coding session.

Generative AI is revolutionizing the software development landscape by enhancing productivity and efficiency through automation, task optimization, and improved collaboration. This technology, which creates new content akin to human production by identifying patterns in large datasets, is being rapidly adopted across various industries, including marketing, design, and operations, due to its ability to streamline processes such as software coding, content creation, and language translation. Notably, tools like GitHub Copilot are significantly impacting the developer experience by facilitating faster coding and cleaner outputs, with studies showing that a substantial portion of code is now generated by these tools. As generative AI becomes increasingly embedded in business operations, ethical considerations and responsible use guidelines are emerging, urging transparency and accuracy. Companies like Duolingo have already reported enhanced developer speed and efficiency after integrating generative AI tools into their workflows. As the technology continues to advance, more applications and business models are being explored, promising further integration into the software development lifecycle.

GitHub has introduced push protection as a feature to enhance security by integrating secret scanning directly into developers' workflows, aiming to proactively prevent secret leaks. Since its beta release in April 2022, this feature has helped avert 17,000 potential secret leaks, saving over 95,000 hours in dealing with exposed secrets. Now generally available for private repositories with a GitHub Advanced Security license, push protection is also free for all public repositories, offering a seamless experience by scanning for identifiable secrets before they are pushed. The tool maintains a low false positive rate to ensure trust and alerts developers within their IDE or command line interface with remediation guidance when a secret is detected. Developers can bypass the protection if necessary, with repository administrators being notified of such actions for auditing purposes. This approach, praised by industry professionals like Ger McMahon from Fidelity Investments and Leo Stolyarov from KPMG, enhances security without hindering development speed, ensuring that developers can maintain a high standard of secure and quality code.

ReDoS (Regular Expression Denial of Service) vulnerabilities, although often deemed less severe, pose significant challenges due to their obscure nature and the complexities involved in fixing them. They are typically the result of inefficiencies in regex engines rather than developer errors, leading to exponential runtimes on certain inputs, particularly in languages like Python and JavaScript. CodeQL queries, improved by Erik Kristensen in 2021, have made detecting these vulnerabilities easier, though remediation remains manual and often involves altering minimal characters in the regex. The blog post, authored by Kevin Backhouse from GitHub Security Lab, provides insights into the history and spread of ReDoS vulnerabilities via shared regex patterns, and emphasizes methodology for identifying and fixing such issues, including creating a proof of concept, simplifying problematic regexes, and employing fuzz testing for verification. Backhouse shares his personal experiences in reporting and remediating these vulnerabilities, highlighting successful strategies such as submitting public pull requests when maintainers are unresponsive. Despite the challenges posed by ReDoS, advancements in code scanning and regex engine improvements in certain languages offer hope for reducing their prevalence in the future.

Retrospectives are vital for a team's progress but can exclude members with disabilities due to the inaccessibility of common tools. The GitHub Accessibility leadership team, which includes members with disabilities, addresses this by using accessible tools like GitHub Issues and Discussions for retrospectives, enabling all members to engage fully. They conduct remote-first meetings, using formats such as the Starfish retrospective and adhering to Norm Kerth’s "Prime Directive," ensuring discussions are structured and accessible with Markdown formatting. The team prioritizes inclusivity by allowing discussion contributions in advance, using closed captions, and encouraging non-verbal communication options. They also emphasize the importance of clear communication and context setting to ensure everyone can participate meaningfully. The ultimate goal of GitHub's accessibility efforts is to empower developers with disabilities to contribute effectively, starting with their own diverse and adaptive team.

Modern software engineering practices, particularly those embodied by DevOps, emphasize the importance of combining people, processes, and technology to deliver value to users effectively. However, traditional organizational structures, such as siloed teams and centers of excellence, often hinder collaboration and innovation by creating friction and duplication of efforts. The concept of innersource, inspired by open-source communities, encourages internal collaboration by adopting open-source practices within organizations, enabling teams to work asynchronously, openly, and at a global scale. GitHub supports this approach with features like internal repositories, branch protection rules, and CODEOWNERS files, fostering an environment where teams can safely innovate while maintaining governance and compliance. By adopting innersource principles, organizations can break down silos, enhance cross-team collaboration, and ultimately drive a culture of innovation.

GitHub has introduced a newly revamped code search and code view, now available to all users on GitHub.com, aiming to enhance developers' productivity by enabling quick and efficient code navigation and understanding. The update includes a redesigned search interface that offers suggestions and completions, a newly built code search engine that is faster and supports more complex queries, and a completely overhauled code view that integrates search, browsing, and navigation. These features allow developers to swiftly locate critical information, whether investigating errors, managing configurations, or identifying potential vulnerabilities, without the need for extensive manual searching. The new code search functionality not only provides rapid access to relevant code snippets but also helps in contextualizing code usage, thereby streamlining the development process and fostering a more intelligent approach to software development. Feedback from users during the beta phase was instrumental in shaping these improvements, and GitHub encourages continued input to further refine these tools.

GitHub Education is committed to making its Global Campus platform more inclusive by enhancing accessibility in alignment with Web Content Accessibility Guidelines (WCAG). The initiative involved an audit by GitHub's Accessibility team, which includes testers experienced with assistive technologies, to identify and remove barriers for users. Key improvements have been implemented, such as refining HTML structures for better content hierarchy, ensuring correct use of links and buttons, and integrating semantic tags for easier navigation. The platform now incorporates more components from Primer, GitHub's open-source design system, to align with GitHub's overall accessibility standards. These efforts are just the beginning, with future developments including automated accessibility checks and ongoing collaboration with the Accessibility team to further improve the platform. Users are encouraged to provide feedback and can participate in open-source projects to contribute to these accessibility enhancements.

Thomas Dohmke, the CEO of GitHub, delivered an engaging presentation at Web Summit Rio 2023, highlighting the transformative potential of AI in software development through GitHub Copilot and its evolution, Copilot X. He shared personal insights into the daily challenges developers face with repetitive tasks, emphasizing how AI can enhance productivity by eliminating mundane coding tasks and enabling developers to focus on creative problem-solving. Dohmke demonstrated the practical application of Copilot X by building a snake game in just 15 minutes, illustrating how AI can amplify developer capabilities and redefine the concept of a "10x developer." His talk underscored the vision of AI as a tool that not only boosts efficiency but also empowers developers to bring their ideas to life swiftly, fostering a new era of digital creativity and innovation.

GitHub's "All In for Students" initiative aims to provide open source training, internships, and job opportunities, particularly for individuals from underserved communities, and has seen significant growth since its 2021 pilot. Originally designed to be an intimate and hands-on program, it successfully scaled from 30 students in its pilot year to 405 students from 112 U.S. universities, including significant representation from Historically Black Colleges and Universities, Hispanic Serving Institutions, and community colleges. Despite challenges such as economic downturns affecting corporate partnerships, the program celebrated 55 graduates in 2023, marking a 130% increase from the previous year. GitHub plans to further expand the program both domestically and internationally, with a goal to skill 5,000 individuals over the next three years, while maintaining a focus on impactful student outcomes, including building portfolios for tech roles and leveraging artificial intelligence. The program highlights the importance of collaboration with university staff and corporate partners to ensure its success and sustainability.

GitHub has introduced a tool status page for its code scanning feature, aimed at simplifying the management of application security tools within the GitHub workflow. This feature provides developers with detailed information about the security tools, such as the native CodeQL engine and other integrated code analysis tools, by indicating their status as either working, needing attention, or not working. Accessible via a "tool status" button on the code scanning page, the tool status page helps developers quickly identify and troubleshoot issues with their code analysis configurations, enhancing the efficiency of maintaining application security. The new tool status feature is part of GitHub's ongoing commitment to improving software security without compromising the developer experience, and further information on application security orchestration can be found in a related blog post.

Creating and maintaining open-source projects can be likened to hosting an unpredictable party, where the initial excitement can quickly turn into challenges of managing contributions and maintaining project integrity. Experienced maintainers like Mike Bayer of SQLAlchemy, Thea Flowers from Winterbloom, and Jordan Harband, a TC39 delegate, share insights on evolving from eager acceptance of contributions to a more discerning approach that emphasizes communication, understanding project vision, and ensuring quality through tests and documentation. They highlight the importance of community engagement, setting clear guidelines, and leveraging platforms like Discord to foster diverse contributions beyond code, such as documentation and project management. The maintainers also discuss strategies to attract and retain contributors, emphasizing the need for automation, clear expectations, and patience while navigating the complexities of open-source collaboration. Ultimately, they advocate for a balanced approach to contributions, recognizing the responsibility maintainers have in guiding and sustaining their projects, while also acknowledging the challenges of integrating external input into a cohesive and sustainable product.

In April, GitHub encountered several service disruptions, including incidents affecting GitHub Copilot, Packages, and Codespaces, with investigations into their causes still ongoing. A notable event on March 27 involved a change in a frequently-used database query that led to lock contention and resource exhaustion, requiring manual intervention to recover services. On March 29, a degraded database cluster impacted GitHub Actions, attributed to a new load source and underprovisioning of proxy instances, which was mitigated by throttling job processing and adding capacity. Another incident on March 31 resulted from a misconfigured notification expiration date, causing 500 errors for some users, which was resolved by deploying fixes and auditing notification configurations. An outage on April 18 was linked to a planned database infrastructure change, which briefly disrupted access to issues and pull requests but self-healed after 11 minutes. GitHub has taken steps to enhance monitoring, alerting, and change management processes to prevent future occurrences.

GitHub has introduced new improvements to Dependabot, aimed at reducing alert fatigue by incorporating an allow auto-dismissal function that targets false positive alerts, particularly those associated with npm devDependencies. This function relies on a sophisticated alert rules engine that assesses alerts based on complex contextual metadata rather than a single criterion, with the goal of identifying and auto-dismissing alerts that are unlikely to pose a threat. The recent public beta release is expected to reduce npm-related alert noise by approximately 15%, addressing a significant challenge in managing dependencies, and is the first step in a series of planned updates to enhance alert relevance. Enabled by default for public repositories, this feature can be activated by administrators of private repositories, and it communicates auto-dismissed alerts through various GitHub tools. GitHub encourages the community to provide feedback to further refine Dependabot’s functionality and extend its support to other ecosystems.