1
No Cookie for You
The developer community remains the heart of GitHub, and we’re committed to respecting the privacy of developers using our product.
The GitHub Blog
Updates, ideas, and inspiration from GitHub to help developers build and design software.
- Popular posts
- 168
- Total points
- 61,128
- HN comments
- 27,254
- Rank
- #10 company
Visit github.blog → RSS feedOn Hacker News Jan 2019 – Aug 2026
Software Engineering 96Tools & Productivity 41Security & Privacy 37Tech Industry & Business 35Infrastructure & DevOps 22Web & Frontend 21
2
We updated our RSA SSH host key
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.
3
Security issue related to the NPM registry
We're sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
4
We found and fixed a rare race condition in our session handling
On March 8, out of an abundance of caution, we logged all users out of GitHub.com. In this post we share technical details of the vulnerability and steps we're taking to ensure it doesn't happen again.
5
GitHub blocks FLoC across all of GitHub Pages
All GitHub Pages sites served from the github.io domain will now have a Permissions-Policy: interest-cohort=() header set. Pages sites using a custom domain will not be impacted. Learn more about…
6
Git security vulnerability announced
Upgrade your local installation of Git, especially if you are using Git for Windows, or you use Git on a multi-user machine.
7
Git password authentication is shutting down
As previously announced, starting on August 13, 2021, at 09:00 PST, we will no longer accept account passwords when authenticating Git operations on GitHub.com. Instead, token-based authentication (for example, personal…
8
Updates to GitHub Copilot interaction data usage policy
From April 24 onward, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.
9
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows.
10
The Python Package Index is now a GitHub secret scanning integrator
GitHub and the Python Package Index (PyPI) are collaborating to help protect you from leaked PyPI API tokens. From today, GitHub will scan every commit to a public repository for…
11
GitHub’s database of security advisories is now open source
Anyone can now provide additional information and context to further the community’s understanding and awareness of security advisories.
12
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.
13
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
14
Code scanning for security vulnerabilities now available
Now available, code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production.
15
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
16
NPM security update: Attack campaign using stolen OAuth tokens
npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.
17
Fine-grained personal access tokens for GitHub
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.
18
Pwning the all Google phone with a non-Google bug
It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code…
19
Behind GitHub’s new authentication token formats
We’re excited to share a deep dive into how our new authentication token formats are built and how these improvements are keeping your tokens more secure. As we continue to…
20
SSH commit verification now supported
GitHub now supports SSH commit verification, so you can sign commits and tags locally using a self-generated SSH public key, which will give others confidence about the origin of a…
21
GitHub will require 2FA by the end of 2023
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.
22
Security keys are now supported for SSH Git operations
You can now use FIDO2 security keys to authenticate over SSH for remote Git operations, providing a higher level of account security.
23
A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
24
GitHub Supports Web Authentication (WebAuthn) for Security Keys
The WebAuthn standard for security keys is making authentication as easy as possible. Now you can use security keys for second-factor authentication on GitHub with many more browsers and devices.
25
Improving Git protocol security on GitHub
We’re changing which keys are supported in SSH and removing unencrypted Git protocol. If you’re an SSH user, read on for the details and timeline.
26
GitHub: Private Profiles beta
Users now have the ability to turn their GitHub profile “private”, which gives users controls over features that share user data across the GitHub platform. To enable this setting, visit…
27
Secret scanning is now available for free on public repositories
Previously, only organizations with GitHub Advanced Security could enable secret scanning's user experience on their repositories. Now, any admin of a public repository on GitHub.com can detect leaked secrets in…
28
Access Control for GitHub Pages
GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page. With access control, you…
29
Bringing supply chain security features to the Go community
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report & prevent vulnerabilities.
30
GitHub Actions update: Helping maintainers combat bad actors
The trustworthiness of our platform is crucial, and our team is committed to developer productivity and Actions performing the way we intended.