Wow. Is that the whispering earring story playing out in real life? I'd cringe if I'd found platitudes like that in my notes from the teenage days. Let alone flaunt it in front of the whole world.
Can't wait to hear about this brand new approach from my managers and VP.
I think if people are always told that they are geniuses, they stop being able to discern good ideas from bad ones. Then they end up writing things like this, thinking they're incredibly gracious for publicly admitting they can be wrong, and missing how the whole message comes across.
So often recent breaches involve Github in one way or another. How is it still considered a sane choice to host anything proprietary there? If your business is built around open source, ok, put a mirror on Github. But CI/CD, gitops, FDEs' stuff have no place on a public cloud. C-level execs may not know bits from bytes, but by now they should've understood that this is akin to storing ammonium nitrate in the open air.
Github personal access tokens are security footguns. This is an apparently old and forgotten image containing a token from 2023 and it the token gets you admin acces to their repos.
That was not an attack on Github itself. GH made enormous impact in the open source movement and is still beneficial for every software engineer by providing a free and very useful service.
Meanwhile, for a software business, Github is a wide and deep attack vector and nobody seems to be concerned about it.
Of course the same can be said about any other public git hosting, especially if it combines CI/CD, artifact distribution, identity and trust management.
