Comment

Comment on Data from deleted GitHub repos may not really be deleted

Well, sort of. GitHub certainly could refuse to render orphan commits. They pop up a banner saying so but I don’t see why they should show the commit at all. They could still keep the data until it’s garbage collected since a user might re-upload the commit in a new branch.

This seems like a non-issue though since someone who hasn’t already seen the disclosed information would need to somehow determine the hash of the deleted commit.

source

Sort:hotnew top

Morphit@feddit.uk ⁨3⁩ ⁨months⁩ ago
Ah - Actually reading the article reveals why this is actually an issue:

What’s more, Ayrey explained, you don’t even need the full identifying hash to access the commit. “If you know the first four characters of the identifier, GitHub will almost auto-complete the rest of the identifier for you,” he said, noting that with just sixty-five thousand possible combinations for those characters, that’s a small enough number to test all the possibilities.

So enumerating all the orphan commits wouldn’t be that hard.

In any case if a secret has been publicly disclosed, you should always assume it’s still out there. For sure, rotate your keys.

source