October 2023 Summaries

GitHub, committed to providing a safe and inclusive platform for developers, has released its biannual transparency report detailing its approach to content moderation and user information disclosure. As the platform has grown to host over 100 million developers, GitHub has expanded and refined its reporting categories, aligning with the Santa Clara Principles and UN guidelines for transparency. The introduction of the GitHub transparency center marks a significant update, offering an interactive platform where users can explore and download detailed reporting data, enhancing accessibility for researchers, journalists, and developers. This new format aims to streamline the reporting process while maintaining GitHub's dedication to openness and accountability. GitHub also plans to continue using its blog and social media to update and share insights from its data, inviting feedback through its repository.

As Halloween nears, a collection of 13 free-to-play, Halloween-themed games created during game jams like Ludum Dare and Godot Wild Jam offer a mix of creativity and programming diversity, utilizing languages such as JavaScript, Haxe, and TypeScript, and engines like Godot and Unity. These games, including the acclaimed "Ciara and the Witch’s Cauldron" and "Silver Bullet," combine unique narratives and gameplay mechanics, from solving puzzles to reanimating the dead, each with opportunities for players to hack and modify the code for personalized experiences. The games are designed to be browser-friendly and provide engaging entertainment during short breaks, inviting players to embark on eerie adventures with elements of humor and challenge. Whether defending against mischievous ghosts in "Boo Bark" or racing broomsticks in "WitchCup1276," these games cater to a variety of tastes, encouraging players to share their experiences and modifications on social media.

As Hacktoberfest concludes, developers are encouraged to finalize their pull requests by exploring projects featured in the latest Release Radar, which highlights several notable updates from August and September. These include Front Matter 9.0, a CMS now available in multiple languages with enhanced Visual Studio Code support, and Astro 3.0, a web framework known for its lightweight outputs and improved rendering performance. Framework x 4.0 caters to API development, while Drifty 2.0 offers an interactive file downloader with GUI support. The OpenAPI Generator 7.0 introduces several enhancements, including new client generators, and OpenLayers 8.0 simplifies APIs for creating web maps. Additionally, GraphQL API Voyager 2.0 and Livewire 3.0 offer updates for dynamic UI components and GraphQL interactions, respectively, while DiceBear 7.0 introduces new avatar styles. Developers are invited to submit their projects for future editions, celebrating the vibrant contributions of the open-source community.

The blog post discusses the process and architecture involved in building applications using Large Language Models (LLMs), focusing on empowering developers to exploit these models' capabilities. It highlights five essential steps for developing LLM apps, including identifying a focused problem, selecting the right model, customizing the model through techniques like in-context learning and fine-tuning, setting up the app's architecture with tools for user input and prompt optimization, and conducting online evaluations to assess real-time performance. The text also explores the emerging architecture of LLM applications, illustrated through a hypothetical example of a user interacting with an LLM-powered assistant to resolve an internet connectivity issue. Additionally, it emphasizes the importance of efficient and responsible AI tooling, such as caching, content filtering, and telemetry services, and offers insights into real-world applications of LLMs in various fields like climate science, medical guidance, language learning, and ecommerce.

Large language models (LLMs) are transforming software interaction by using deep learning to generate human-like responses, although they can occasionally produce inaccurate or outdated information due to being trained solely to predict the next token in text rather than to reason or understand. LLMs' strengths lie in generalizing and understanding context, enabled by deep neural networks that learn complex patterns from vast amounts of text data, allowing them to generate coherent responses across diverse prompts, though this flexibility can lead to errors and overgeneralization. Their training on massive, sometimes biased datasets can lead to outputs that reflect existing stereotypes or inaccuracies, emphasizing the need for fact-checking and critical thinking. Despite these challenges, LLMs are not inherently deceitful; instead, their occasional inaccuracies stem from attempts to generate relevant text based on learned patterns. Ethical considerations are crucial when using LLMs, and developers, researchers, and users are encouraged to promote transparency, accountability, and active efforts to mitigate biases, ensuring LLMs are used responsibly and beneficially.

Developers are driving the adoption of AI technologies at scale, as evidenced by a GitHub survey revealing that 92% of developers already use AI tools in their work or personal projects. This trend suggests that businesses can enhance productivity and collaboration by understanding and supporting developers' needs, particularly through AI integration. AI tools like GitHub Copilot are shown to improve collaboration, with developers completing tasks faster and focusing more on solution design and innovation. The article emphasizes the importance of agile and collaborative team structures, promoting practices such as innersource to enhance team productivity and the potential of AI to facilitate learning and development. Organizations are encouraged to invest in systems, technology, and culture that boost developer experience (DevEx) to prepare for AI-driven growth and innovation.

A GitHub profile's README serves as a crucial introduction to one's work and skills, and it's important to ensure its accessibility to all users, including those with disabilities. This guide emphasizes the significance of creating accessible READMEs, which fosters trust, enhances usability, and demonstrates a commitment to inclusivity. Various non-coding strategies are recommended, such as making link text descriptive, using alt text for images, applying proper heading formatting, and employing plain language. The use of emoji should be minimized to prevent distraction. Additionally, the guide suggests utilizing tools and automation like browser extensions and GitHub Actions to identify and rectify accessibility issues in Markdown files. Sharing accessible practices within the GitHub community is encouraged to promote wider adoption of these inclusivity measures.

GitHub's Bug Bounty Program, a key component of its security strategy for nine years, is spotlighted during Cybersecurity Awareness Month, featuring prominent researcher Ammar Askar. Askar, known for uncovering privilege escalation and authentication/access control bugs, shares insights from his journey, which began with modding Minecraft and progressed through playing Capture The Flag (CTF) competitions. The program rewards researchers for identifying vulnerabilities in GitHub's vast ecosystem, having distributed over $3.8 million in rewards since 2016 through HackerOne. Askar emphasizes the importance of understanding complex systems to discover bugs, citing his experience with CVE-2023-23761 as an example. He advocates for practical experimentation and continual learning from available resources like PortSwigger’s WebSecurity Academy. GitHub encourages collaboration with the security community, offering incentives such as a Bug Bounty Merch Shop, and invites interested individuals to explore open roles to further secure its platform and products.

The Contributors GitHub Action is a newly released tool designed to provide insights into contributors' activities within open source projects, helping maintainers recognize efforts, identify potential new maintainers, and foster a more inclusive community. This tool allows users to track metrics such as the total number of contributors, their contributions, and individual activity, all while maintaining privacy by using publicly available data. It is designed to work across entire GitHub organizations or individual repositories, aiding in project health assessment and identifying areas requiring additional support. Users can implement the Action by setting up a repository, selecting a workflow, customizing it, and setting permissions using a GitHub token. The tool aims to support open source maintainers and OSPO managers by enhancing engagement and collaboration within the open source ecosystem.

In the rapidly changing field of software development, ensuring the security of complex applications that utilize diverse libraries, frameworks, and custom code is a significant challenge. The effectiveness of static application security solutions depends on their ability to provide comprehensive vulnerability coverage across various languages and frameworks. Recent advancements in CodeQL have enhanced the detection of vulnerabilities in C++ and Java, including complex memory corruption issues like double-free and use-after-free vulnerabilities, as well as improved support for Project Lombok in Java codebases. These improvements aim to detect more potential security threats while minimizing false positives, thereby optimizing the security posture of organizations. GitHub continues to enhance its security solutions to help developers build safer software without compromising user experience.

GitHub Universe has partnered with product experts and GitHub Stars to create curated agendas for attendees, featuring sessions tailored to various roles, including engineering leaders and security professionals. Ashley Willis, the Senior Director of Developer Advocacy at GitHub, emphasizes fostering collaboration and supporting the developer community, highlighting sessions that explore the integration of AI with human skills in development. Her curated agenda addresses topics such as the ethical use of AI, accessibility, and the evolving role of developers in an AI-driven world, with sessions focused on practical guidance for tools like GitHub Copilot. The event offers both virtual and in-person attendance options, allowing participants to engage with cutting-edge discussions on AI, productivity, and the future of development.

CVE-2023-4069 is a type confusion vulnerability in Chrome's V8 JavaScript engine that allows remote code execution via a single visit to a malicious site. This vulnerability, found in the Maglev compiler, emerges from speculative optimization processes and can be exploited when default constructors in derived classes are omitted, leading to uninitialized objects. Although the Chrome renderer sandbox limits the privilege of code execution, chaining this vulnerability with a sandbox escape could potentially compromise Chrome or the user's device. Despite the complexity of JIT engines historically making them targets for attackers, users can mitigate risks by keeping Chrome up-to-date with automatic updates. In exploiting CVE-2023-4069, the absence of a constructor check in Maglev leads to the creation of uninitialized JavaScript objects, allowing out-of-bounds access. This can be leveraged for arbitrary read and write primitives, enabling attackers to execute code within the V8 heap, although the heap sandboxing in V8 prevents access to arbitrary memory locations. However, attackers can use JIT spraying techniques to bypass this restriction by modifying JIT pointers to execute shell code stored as floating-point numbers.

In October 2020, Atlassian announced the end of support for its Bitbucket Server, effective February 15, 2024, leading customers to explore alternative solutions for their source code management. Users of Bitbucket Server face several choices: continue using the service without support and increased security risks, migrate to Bitbucket Data Center with higher costs, switch to Bitbucket Cloud despite feature limitations, or transition to another platform like GitHub. GitHub offers a unified, integrated platform that supports compliance with various international laws, making it a viable option for organizations worldwide. GitHub's tools, such as GitHub Actions and GitHub Enterprise Importer, facilitate the migration of code, collaboration history, and CI/CD workflows. Additionally, GitHub provides solutions for integrating with existing tools or transitioning to its native features, ensuring a streamlined process for organizations seeking an efficient and scalable development environment.

In 2017, Microsoft began migrating its massive codebases for Windows and Office to Git, revealing significant performance challenges due to their size. To address these, Microsoft's Git client team focused on improving Git's scalability, leading to the development of Trace2, a performance logging framework introduced in 2019. Trace2 enables detailed analysis of Git's performance by emitting messages at key points in commands, aiding organizations in understanding and optimizing their Git usage. Recognizing the increasing demand for Git to handle large repositories, an open-source tool was introduced to integrate Trace2 data into the OpenTelemetry ecosystem for enhanced visualization and analysis. This tool allows users to monitor Git's performance, identify inefficiencies, and make informed improvements. The initiative emphasizes democratizing performance analysis, offering tools for both individual statistics and enterprise-level insights. Additionally, partitioning data by criteria such as repository size and configuration can further refine performance understanding, although users are advised to consider legal and ethical implications when collecting data.

js13kGames is an annual online competition that invites developers to create HTML5 games using no more than 13 kilobytes of JavaScript, fostering creativity and optimization under the leadership of founder Andrzej Mazur. Since its inception in 2012, the event has drawn global participation and showcases a variety of innovative games, with this year's theme being the "13th century." The competition highlights include a range of standout entries praised for their approachable gameplay, polished design, and inventive mechanics, such as "Path to Glory" for its engaging music and graphics and "Merlin vs Alfonso" for its intuitive controls and clear goals. The event culminates in recognizing the efforts of participants, judges, sponsors, and organizers, with anticipation building for the upcoming thirteenth edition. Additionally, the announcement encourages participation in the Game Off event, a month-long game jam with no size or language restrictions starting November 1st.

GitHub has set an ambitious goal to skill 5,000 people in open source by 2026, focusing on diversity, equity, and inclusion (DEI) to make open source projects more accessible and welcoming to underrepresented communities. The program, known as "All In for Students," aims to provide students across the U.S. with the necessary resources and skills to contribute to open source development, despite challenges like economic downturns and reduced industry budgets. Students from various institutions, including HBCUs, HSIs, women's colleges, and community colleges, are encouraged to apply, even without prior knowledge or a declared computer science major. The program offers mentoring, networking, technical training, hands-on experience, career development, and more, with the goal of empowering a diverse new generation of developers who can accelerate human progress. As GitHub enters the third year of this initiative, it continues to partner with colleges and universities to foster a vibrant, inclusive open source community.

In September, GitHub experienced two significant incidents impacting service performance. The first incident on September 5 involved a 19-minute outage due to a file system write error in a primary database, which disrupted multiple services, including SAML login and GitHub Actions. The automatic failover failed to detect this partial failure, but manual intervention restored services, leading to improvements in failover detection and automation. The second incident on September 19, lasting 7.5 hours, occurred during a data migration for GitHub Projects, where a misconfigured index constraint rendered project data unavailable for 3.5 hours. This incident also caused limited availability of some Git operations. GitHub has since enhanced validation processes for data migrations and is implementing measures to reduce data restoration times and address replication issues.

GitHub has enhanced its platform to simplify the centralized management of workflows for its users, particularly those using GitHub Enterprise Cloud. By integrating required workflows into GitHub repository rulesets, organizations can enforce that certain workflows run successfully before code can be merged into repositories, thus ensuring adherence to CI/CD best practices. This new feature allows for precise control over which workflows apply, enabling configuration by branch, tag, or specific commit, and offers additional tools like branch targeting, bypass rules, and auditing through Repository Rule Insights. Users can place rules in "Evaluate" mode to test their impact before activation, minimizing disruptions. This advancement aims to streamline the enforcement of code policies across multiple repositories, enhancing the developer experience and building confidence in deployment processes.

GitHub's recent research on Copilot Chat reveals its significant impact on developers' coding efficiency and quality. This AI-driven tool, which integrates seamlessly into IDEs like Visual Studio Code and Visual Studio, offers real-time guidance and solutions tailored to developers' specific challenges, enhancing code readability, reusability, conciseness, maintainability, and resilience. The study found that developers using Copilot Chat completed code reviews 15% faster and felt more confident in their code quality, with 85% of participants reporting improved outcomes. Additionally, 88% of developers maintained a flow state, citing increased focus and reduced frustration. The research underscores that GitHub Copilot Chat not only accelerates coding but also upholds high-quality standards, challenging the traditional trade-off between speed and quality in software development.

All In Africa is an initiative aimed at empowering African developers by providing free open source education, comprehensive training, mentorship, and community engagement opportunities. With Africa poised to become a global tech hub and one of the fastest-growing regions for open source contributions, the program seeks to bridge the diversity gap in technology by equipping Africans with the skills needed to create and contribute to open source projects. The initiative offers structured three-month cohorts twice a year, providing participants with technical training, networking opportunities, and a certificate of completion. Led by Open Source Program Manager Ruth Ikegah, and supported by regional ambassadors across Africa, All In Africa aims to foster innovation and enhance the tech workforce to meet the demands of a rapidly evolving global tech landscape.

A memory corruption vulnerability, CVE-2023-43641, has been identified in libcue, a library used to parse cue sheets, which are metadata formats often associated with the FLAC audio file format. Discovered by the GitHub Security Lab in coordination with Ilya Lipnitskiy, this vulnerability can be exploited particularly when used by tracker-miners, a GNOME application that indexes files in a user's home directory, making them searchable. The vulnerability stems from how libcue handles the INDEX syntax in cue sheets, allowing for an integer overflow that can lead to code execution if a malicious cue sheet is downloaded and automatically scanned. The vulnerability is exacerbated by tracker-miners' automated file scanning process, which can execute the exploit simply by downloading a file into the ~/Downloads directory. Although tracker-miners is not directly vulnerable, its use of libcue increases the impact, particularly for systems running GNOME. The GitHub Security Lab team is withholding the full proof of concept to allow time for users to patch their systems, with a simpler version available that causes a benign crash. This issue highlights the importance of seemingly minor libraries in broader security contexts and the need for timely updates to maintain system security.

Large Language Models (LLMs) like GitHub Copilot can be guided to produce more accurate outputs through prompt engineering, which involves crafting specific prompts to elicit desired responses. GitHub Copilot Chat enhances the code completion capabilities of GitHub Copilot by providing a chat interface that allows developers to interact more directly with the LLM, using contextual information from code and additional prompts to improve results. This blog focuses on using GitHub Copilot Chat to improve accessibility in coding practices, offering foundational prompts and examples to guide developers in writing code that meets WCAG 2.1 accessibility standards. It emphasizes the importance of developers acting as lead developers who verify and refine suggestions made by GitHub Copilot Chat, particularly when it comes to ensuring accessibility and usability in code. While GitHub Copilot Chat is a valuable tool for learning and improving code, it is crucial for developers to work alongside qualified accessibility experts and conduct proper code reviews to ensure that all suggestions meet necessary standards.

The integration of AI with open-source platforms has led to a surge in generative AI projects, with over 8,000 initiatives on GitHub, including commercially backed models like Meta’s LLaMA and various experimental applications. Open-source large language models (LLMs) offer transparency and rapid development due to community contributions, contrasting with closed-source models that are more secure and user-friendly. Fine-tuning open-source LLMs on cloud platforms like AWS or Azure can enhance their performance in specific applications, using techniques like Microsoft's LoRA to improve efficiency and reduce processing time. The open-source LLM landscape includes notable models such as OpenLLaMA, Falcon-Series, MPT-Series, and FastChat-T5, each tailored for distinct tasks and applications. The future of open-source LLMs looks promising, with potential for local deployment and reduced infrastructure needs, although financial support remains a challenge. Despite predictions, the fundamental algorithms of generative AI have remained simple, with scalability being the primary focus. This evolving field holds the potential to significantly transform the developer landscape, with endless possibilities for innovation and application.

GitHub Engineering, a remote-first company since its inception, has developed communication guidelines called "How we communicate" to effectively manage internal communications across its global teams. These guidelines, inspired by open source community practices, emphasize asynchronous communication, transparency, and collaboration, using GitHub's own tools to manage work and discussions. The guidelines were crafted with input from over 100 employees to foster consistency while allowing team autonomy. To address notification overload, GitHub created a system allowing engineers to opt into relevant updates, using magic labels and GitHub Actions to streamline information flow. Additionally, they leverage AI to enhance post summaries, ensuring important information is accessible without overwhelming staff. The guidance is publicly shared under a CC-BY-4.0 license to assist other organizations in developing their remote communication practices, and GitHub welcomes feedback and contributions to improve these practices further.

GitHub has enhanced its secret scanning capabilities by making secret scanning and push protection free for public repositories, aiming to prevent credential leaks in open-source projects. This initiative includes the introduction of validity checks for GitHub tokens, which streamline the remediation process by allowing users to quickly determine if a token is active via the user interface, thus prioritizing remediation efforts more efficiently. The validity checks have now been extended to include tokens from AWS, Microsoft, Google, and Slack, addressing some of the most common secrets detected across GitHub repositories. This feature is part of a broader effort to expand token validation support through GitHub's secret scanning partner program, with periodic and manual verification options available to enterprise or organization owners and repository administrators. The enhancements aim to provide faster and more efficient triaging of alerts, with ongoing updates and community feedback encouraged through GitHub's Code Security community discussion and documentation resources.

GitHub's Chief Security Officer, Mike Hanley, emphasizes the importance of supply chain security, which has gained significant attention due to incidents like the SolarWinds attack. Hanley suggests three key strategies to enhance security: understanding and securing build pipelines, implementing two-factor authentication (2FA) for all code contributors, and ensuring artifact provenance through tools like Sigstore. These measures aim to protect software applications and open-source ecosystems from vulnerabilities and attacks. Hanley points out that despite the focus on advanced threats, fundamental practices like 2FA can significantly reduce risks such as phishing. He advocates for a collective effort to maintain the integrity of open-source code and dependencies, urging organizations to assess their security controls, verify third-party dependencies, and review integrations to meet security standards.

GitHub is enhancing its GitHub Sponsors program to create a sustainable future for the open-source ecosystem by expanding funding opportunities and regions, as well as partnering with Patreon to offer new benefits. Since the launch of organization-funded sponsorships in April 2023, participation has grown by 20%, with 4,200 organizations now involved. The partnership with Patreon aims to provide open-source developers with more funding avenues and community-building tools, allowing sponsors to link their GitHub and Patreon accounts for streamlined sponsorship processing and recognition. Additionally, GitHub Sponsors has expanded support to 35 new regions, now covering 103 regions worldwide, and has introduced features to simplify invoicing and sponsorship creation for enterprise customers. This expansion is part of GitHub's commitment to supporting the open-source community and facilitating easier access to sponsorships for developers globally.

GitHub has launched a public beta for its Apple silicon-powered M1 macOS larger runner for GitHub Actions, aimed at enhancing performance for developers by utilizing the M1 processor's on-chip GPU capabilities. This runner, equipped with a 6-core CPU, 8-core GPU, 14 GB of RAM, and 14 GB of storage, offers significant build time reductions—up to 80% compared to existing Intel runners. The GitHub mobile iOS team has already experienced a 44% improvement in build times, with UI tests and code compilation seeing enhancements of 55% and 51%, respectively. Transitioning to the M1 runner requires minor workflow updates, but snapshot tests necessitate re-recording due to differences in UI rendering between M1 and Intel Macs. The runner facilitates faster App Store reviews and is available to all developers without prior sign-up, with new pricing set at $0.16/minute for XL and $0.12/minute for large. Future progress can be tracked via GitHub's roadmap, with macOS 14 anticipated later this year.

In celebration of Cybersecurity Awareness Month, GitHub highlights the contributions of a top security researcher, @inspector-ambitious, in its Bug Bounty Program, which plays a crucial role in enhancing the security of the platform's extensive codebase. Since its inception nine years ago, the program has been integral to GitHub's security strategy, offering over $3.8 million in rewards through HackerOne and incorporating live hacking events, a revamped VIP bounty program, and new bounty targets. @inspector-ambitious, who specializes in application-level bugs, shares insights into their bug bounty journey, emphasizing manual testing, application-level logic errors, and a commitment to continuous learning through resources like podcasts and social media. They stress the importance of not being intimidated by the ubiquity of vulnerabilities, as nothing is entirely secure. GitHub remains committed to collaborating with security researchers, inviting them to report findings through HackerOne and explore open roles to help secure its products and services.