September 2023 Summaries

Game Bytes is a monthly series exploring the realm of game development on GitHub, highlighting updates in game engines, game jams, open-source games, and more. The latest edition features Roboden, a real-time strategy game with asymmetric factions and autonomous drones, and Aaaaxy, a unique 2D puzzle platformer set in a non-Euclidean space. It also revisits classic games like Crazee Rider, developed in 6502 assembly for the Acorn Electron, and showcases updated modes in Beyond All Reason. Tools like LDTK and Tiled receive updates enhancing level editing capabilities, while FamiStudio offers new features for composing NES music. VRF updates improve modding for Valve’s Source 2 engine, and Alien Swarm: Reactive Drop expands on Valve's original game. Upcoming game jams like Ludum Dare and Game Off offer developers opportunities to create games under tight deadlines, while Unreal Engine 5.3 continues to support a wide range of industries. The TIC-80 fantasy console, ideal for retro-style game development, also receives attention for its constrained yet creative environment. The post encourages developers to share their projects with the community, fostering collaboration and innovation in the gaming world.

GitHub has introduced GitHub Learning Pathways, a structured educational initiative designed to enhance users' understanding and skills on its platform through guided tutorials and best practices from industry leaders. The program is divided into three levels—Essentials, Intermediate, and Advanced—to cater to varying expertise levels, focusing on areas such as automation, security, and administration. Participants can learn to build and optimize CI/CD workflows, protect their codebases with GitHub Advanced Security, and configure GitHub Enterprise Cloud for effective team collaboration. This initiative aims to boost developer productivity and happiness by leveraging insights from companies like Amplifon, Telus, and Salesforce.

GitHub Copilot Chat, announced in March, has significantly enhanced developer satisfaction by providing a context-aware conversational assistant within the integrated development environment (IDE). This tool builds upon GitHub Copilot's original capabilities, extending beyond autocompletion to allow developers to ask questions, receive code explanations, and obtain tailored suggestions without leaving their IDE. Particularly beneficial for junior developers and those learning new frameworks, Copilot Chat facilitates rapid prototyping, debugging, and accessibility improvements, as illustrated by its application in a ReactJS photo gallery project. While it offers substantial productivity gains, developers remain responsible for verifying and reviewing AI-generated code to ensure quality and security.

GitHub Universe '23 is a pivotal annual event that brings together developers, enterprise leaders, and security professionals to discuss the latest trends and best practices in software development. Taking place on November 8-9 at the Yerba Buena Center for the Arts in San Francisco and available virtually, the event offers a wide array of sessions, including keynotes from GitHub CEO Thomas Dohmke and discussions on application security, AI operationalization, and innovative uses of GitHub Copilot. Participants can also attend workshops for hands-on learning and earn GitHub certifications in various domains. The conference promises to provide attendees with valuable insights, practical tools, and networking opportunities to enhance their skills and career prospects in the evolving digital landscape.

GitHub's Developer Experience (DX) team has transitioned their continuous integration (CI) system to GitHub Actions, leveraging the newly released larger runners to meet the scaling demands of their engineering team. This shift has improved the developer experience by allowing GitHub engineers to quickly and confidently ship software, using autoscaling capabilities and custom VM images to streamline the CI process. With the ability to run 15,000 CI jobs within an hour across 150,000 cores of compute, larger runners facilitate efficient scaling and management of CI workflows. GitHub Actions' features, such as reusable workflows and workflow outcome reusability, have further optimized the CI processes by reducing redundancy and improving efficiency. The DX team has also developed a remote access solution to securely connect larger runners to GitHub's private services, enhancing both security and accessibility. This comprehensive approach demonstrates GitHub's commitment to refining its CI infrastructure to support rapid development and deployment, ultimately enhancing the overall developer experience.

The post details the exploitation of CVE-2023-3420, a type confusion vulnerability in Chrome's V8 JavaScript engine, disclosed in June 2023. This vulnerability allows remote code execution (RCE) within Chrome's renderer sandbox when a user visits a malicious website. The exploit involves using speculative optimization in the TurboFan JIT compiler, which optimizes JavaScript functions based on input type assumptions. When these assumptions become invalid, it can lead to incorrect memory access and potential security breaches. The exploitation process involves creating a situation where optimized code accesses fields with incorrect offsets, leading to out-of-bounds (OOB) access. The post describes the method for achieving type confusion by manipulating JavaScript objects and outlines steps to gain code execution through JIT spraying techniques, bypassing V8's heap sandbox. The complexity of the JIT engine and speculative optimization has led to numerous security issues, highlighting the challenges in securing such advanced systems against sophisticated attacks.

Educators looking to enhance their use of GitHub Classroom can leverage the GitHub CLI to customize features through open-source contributions, specifically by building commands tailored to their unique classroom needs. The process involves setting up a development environment using Go, planning and implementing new features, and navigating the GitHub Classroom API to ensure data accessibility. Contributors are guided through writing and testing their code, registering their new command, and then committing and submitting a pull request for review. Although there's no guarantee of feature approval, successful contributions are integrated into the main branch, allowing educators to update their CLI with the new functionality. This collaborative effort not only enriches the GitHub Classroom tool but also engages educators in the open-source community, fostering a cycle of continuous improvement and personalization.

The GitHub Security Lab has reached a milestone of disclosing over 500 CVEs to open-source projects, highlighting the ongoing need for security research in the open-source community. The Lab, rooted in the acquisition of Semmle by GitHub, uses tools like CodeQL to efficiently identify security vulnerabilities and collaborate with project maintainers to resolve issues, boasting a high fix rate of 96% for its reports. Notable vulnerabilities discovered include those in Apache Struts, Apple's ICMP code, the Corona Warn App Server, and the Log4J library, among others. The Lab emphasizes a maintainers-first approach, providing flexible disclosure timelines and support for issue resolution. As it continues to improve tools and methodologies, the Lab aims to reduce vulnerabilities through education and collaboration, urging the community to adopt security practices like code scanning and private vulnerability reporting to enhance open-source software security.

GitHub has launched the Innovation Graph, an open data and insights platform designed to provide comprehensive metrics on software development and its global and local impact. This platform addresses the gap in reliable data on software innovation trends, offering quarterly data on various metrics like Git pushes, developers, and repositories, dating back to 2020. It is intended to assist researchers, policymakers, and developers by lowering barriers to accessing and utilizing data, which has previously been challenging. The Innovation Graph aims to facilitate research and inform policies that promote digital transformation and job creation, with early findings suggesting that open source contributions correlate with increased innovation and economic growth. The platform is designed for community reuse, encouraging users to explore data trends and create visualizations while contributing to ongoing improvements.

Passkeys have been introduced as a new, phishing-resistant sign-in method on GitHub, aimed at enhancing account protection by reducing reliance on traditional passwords and other easily phishable authentication methods. Since their beta launch, passkeys have been adopted by numerous developers, and are now available to all GitHub users as part of the platform's ongoing commitment to securing all contributors with two-factor authentication (2FA) by the end of 2023. The implementation of passkeys, however, faced challenges due to varying support across different operating systems and browsers, notably impacting Linux and Firefox users. To address this, GitHub enabled cross-device registration, allowing users to register a passkey on a mobile device while using a desktop. Additionally, GitHub has made it easier for users to upgrade compatible security keys to passkeys, despite some technical hurdles involving browser, OS, and hardware key combinations. As the industry adopts broader support for passkeys, with companies like Apple, Google, and Microsoft enhancing their systems to facilitate cross-device and cross-ecosystem usage, GitHub continues to refine its approach by incrementally prompting users to register passkeys and seeking user feedback for ongoing improvements.

GitHub has launched a public beta of GitHub Copilot Chat for individual users of Visual Studio and VS Code, expanding its AI-driven software development tools beyond business users. GitHub Copilot Chat, in conjunction with the GitHub Copilot pair programmer, aims to revolutionize software development by allowing developers to write code using natural language, thereby reducing boilerplate work and enhancing productivity. This tool provides real-time guidance, code analysis, security issue resolution, and troubleshooting, empowering both individual developers and teams to learn new languages, address coding challenges, and improve open-source project security without leaving their IDE. By positioning natural language as a universal programming language, GitHub Copilot Chat seeks to democratize software development, making it accessible to a diverse global audience and thus accelerating innovation and human progress.

GitHub Education has introduced Learning Paths on Global Campus to support student developers by providing structured educational tracks tailored to their experience levels. Aimed at both beginners and those with prior GitHub experience, these Learning Paths offer initial steps to cultivate essential skills for future development work. New users are guided through the "Get Started With GitHub" path, which includes tasks like setting up a GitHub profile, engaging with the community, and learning Markdown basics. Experienced users follow the "GitHub Deep Dive" path, which involves mastering the GitHub Flow and using GitHub Codespaces. These initiatives aim to equip students with the confidence and knowledge to further explore and innovate within the software development field, fostering a supportive environment for global learners.

GitHub Advanced Security (GHAS) is designed to enhance software security by integrating application security testing solutions directly into the developer workflow, thereby minimizing context switching and increasing productivity without compromising security. It features native code scanning that surfaces relevant alerts incrementally in pull requests, achieving higher engagement and fix rates compared to traditional SAST tools. With the general availability of GHAS for Azure DevOps, users can now deploy these security features across their repositories, benefiting from enhanced visibility and integration with Microsoft Defender for Cloud. This allows organizations to manage alerts efficiently from a centralized interface and ensures that both GitHub and Azure DevOps users can leverage the same security advantages.

Starting February 15, 2024, Atlassian will cease offering support and security updates for its Server products like Bitbucket Server and Bamboo Server, prompting a shift towards alternatives like GitHub Enterprise Cloud and GitHub Actions. GitHub has introduced new migration tools to facilitate this transition, such as the GitHub Enterprise Importer for migrating from Bitbucket Server and Data Center, and GitHub Actions Importer for moving CI/CD pipelines from various Atlassian products. As the DevOps landscape becomes increasingly complex with disparate tools, companies are encouraged to consolidate their operations on a single, integrated platform like GitHub, which offers built-in integrations, scalable CI/CD automation, collaboration tools, and application security testing. GitHub's migration tools are designed to simplify the process, making it swift, cost-effective, and less prone to errors, helping developers focus on building impactful software. The GitHub Actions Importer also uses a phased approach to streamline CI/CD migrations, supporting a wide range of platforms and ensuring a seamless transition to GitHub workflows.

GitHub has introduced a public beta for custom auto-triage rules for Dependabot, allowing developers to create personalized criteria for auto-dismissing or reopening alerts, thus enhancing alert management and reducing false positives. Since the initial release of Dependabot policies, over 250,000 repositories have opted in, resulting in the auto-dismissal of millions of unnecessary alerts. The new feature enables developers to focus on significant alerts by setting rules based on attributes like severity, dependency scope, and package name. This functionality is free for public repositories and part of GitHub Advanced Security for private ones, and it integrates with existing reporting systems to maintain visibility into automated decisions. Upcoming enhancements aim to expand alert metadata and enforcement options, offering more control over security updates.

GitHub's Social Impact program is offering virtual micro-mentoring sessions for students in conjunction with the GitHub Universe 2023 conference, set for November 8-9. These sessions, designed to connect students with industry experts from GitHub, provide personalized feedback on resumes, career path advice, and skill development opportunities during 30-minute one-on-one meetings. Though applications are no longer being accepted, the initiative encourages students to engage with GitHub employees to gain valuable insight into career planning. The program is part of GitHub's ongoing commitment to making a positive global impact through its products and people. Participants had to apply by September 27, 2023, and were required to be at least 18 years old and enrolled in an academic institution. Successful applicants were to be notified by October 13 and needed to confirm their participation by October 20.

In August, GitHub experienced two significant incidents that impacted service performance, starting with a delay in webhook processing on August 15 due to a spike in deliveries, which was mitigated by blocking event sources to clear the backlog. As a result, improvements were implemented to handle higher traffic and manage load sources more effectively. On August 29, a separate incident caused delays in background job processing due to issues with a Kafka consumer group, which was resolved by shifting the load to a standby service and redeploying the primary service. Despite the delays, no data was lost, and GitHub has extended monitoring to prevent future occurrences while encouraging users to check their status page and engineering blog for updates.

Artificial Intelligence (AI) is transforming technology and security, and GitHub is utilizing AI to enhance both software development speed and security. GitHub Copilot includes a security filter to prevent common coding vulnerabilities, while the CodeQL team uses AI to optimize their modeling process for detecting vulnerabilities. By employing Large Language Models (LLMs), they've automated API modeling, significantly reducing false negatives and enhancing CodeQL's detection capabilities. This approach recently led to the discovery of a new CVE in Gradle. GitHub continues to integrate AI into security testing, aiming to improve security offerings and enable scalable variant analysis with tools like Multi-Repository Variant Analysis (MRVA), which allows for extensive code scanning across repositories.

Developing and scaling an application using large language models (LLMs) involves a structured approach that GitHub employed while creating GitHub Copilot, following a three-stage process inspired by the "Nail It, Then Scale It" framework. This process consists of identifying an impactful problem space, delivering a smooth AI product experience, and preparing the application for general availability. The GitHub team focused on enhancing developer efficiency by integrating AI into existing workflows without altering them, initially targeting coding functions in IDEs. Iterative development and user feedback were crucial, with GitHub employing A/B testing and experimenting with features like neighboring tabs. The team also addressed challenges such as optimizing costs and ensuring responsible AI use by incorporating security measures and community feedback. GitHub Copilot's journey from technical preview to general availability illustrated the importance of a focused problem, rapid iteration, and leveraging user insights, leading to significant productivity gains and user satisfaction among developers.

Edge computing, as defined by Microsoft Azure, is a framework allowing devices in remote locations to process data at the network's edge, minimizing latency by transmitting only essential data to central datacenters. Experts such as Jerome Hardaway, Kate Goldenring, and Alex Ellis discuss how this concept differs from traditional cloud applications, emphasizing the need for human-centric definitions and acknowledging the diverse categories like geography-based, resource-based, and connectivity-based aspects of edge computing. They highlight the architectural differences between edge, private, and hybrid cloud computing, noting that edge computing focuses on responsiveness and resource placement. While edge computing's application suitability varies, its development requires consideration of resource constraints and portability issues, often influenced by the extent of platform-specific features used. Skills in Kubernetes, Python, networking technologies, and communication are recommended for developers venturing into edge computing, with learning tools such as Raspberry Pi suggested for hands-on experience.