Submitted 4 months ago by 0x815@feddit.org to technology@lemmy.world
https://infosec.exchange/@still/112681853434505681
GitCode, a git-hosting website operated Chongqing Open-Source Co-Creation Technology Co Ltd and with technical support from CSDN and Huawei Cloud.
It is being reported that many users’ repository are being cloned and re-hosted on GitCode without explicit authorization.
There is also a thread on Ycombinator (archived link)
Well now chinese companies that use free softwware don’t have an excuse to share their modifications of their software product.
But at what cost???
Better to analyze for vulnerabilities. Particularly with a number of governments using open source software hosted on github.
that could come in veery handy once microsoft wants to pull some plugs. i guess we can be grateful for the backup that is 1. not 100% in m$ hands any more then and 2nd cannot be as easy destroyed as some backups at archive.org. i actually hoped for someone with enough money to create this type of security after m$ assimilated github and thought like “does nobody see the rising danger there?” but even if china’s great fork might be more reliable than m$ over time, maybe it’s better to have your own backups of all the things you actually may need in future.
btw did microsoft manage to get rid of the hackers that settled into their network for … how long??
i guess they’ll tell
Classic Chinese tech co, if you can’t create something on your own just download the source files and say you made it. The money spends the same after the fact, anyhow.
I hope they copy the web interface too. I stopped using GitHub for my dumb little projects when Microsoft bought them and I can’t be bothered to learn git. I will gladly host my future projects there if it’s good.
I can’t be bothered to learn git.
How to become unemployable as an engineer 101.
I’m not an engineer and I am employed, I do a little scripting for fun. Software developers should learn how to use git but I’m not one :)
What use is Github / a Github clone to you without knowing git?
*self hosts gitlab with docker run
*still doesn’t know git
‘:confused jackie:’
Generally, I tend to think more in the direction of that there is some misunderstanding happening, then people being stupid. Maybe that is just the optimist in me.
What exactly is meant when people say they don’t know git. Do they mean the repository data format? Do they mean the network protocol? Do they mean the command line utility? Or just how to work with git as a developer, which is similar to other vcs?
I think if you use some git gui, you can get very far, without needing to understand “git”, which I would argue most people, that use it daily, don’t, at least not fully.
The web interface is great and easy to use. I liked just dragging and dropping updated files to it, very simple.
%100 me when I first started github: “welp its saying something I dont understand, time to nuke the local copy and restart”
I would argue that this culture would possibly be good to learn from them, first. It didn’t come to existence as some kind of social evolution, but was impressed by power.
Second, at least they are behind Europeans in the culture of genocide.
I hate authoritarian regimes, but why hosting cloned repos is bad?
This is inevitable:
Once the people in China can only see the CCP’s version of everything,
& ALL stuff has been adulterated, either by AI or by some agency-or-other,
THEN dissent should die-down in the Chinese population:
Read Lanier’s “Foreign to Familiar” to understand how Tropical-Culture vs Nordic-Culture shapes people, & how old-cultures vs new-cultures shape people,
then read Hofstede’s “Exploring Culture” to understand the dimensions of culture that his Cultural Dimensions Theory digs into ( power-distance, uncertainty-avoidance, “success”-orientation, & other dimensions )…
& when you understand how we’re kind of “template” people, before being born into culture,
but once born into it, our entire meaning gets framed within whatever culture we were born into…
therefore, the CCP can simply remove most diversity-of-meaning from their completely-possessed-population, through a generation or 2 of that.
Tibetan, Uyghur, Hongkonger, Taiwanese, Indian, South-Korean, Japanese, the intent is consistent: "the destruction of " … others … “is the midwife of Chinese supremacy”.
I expect a similar kind of program to exist in all right-possessed countries, as the right is doing in the US, right now, with burning or banning books, eradicating proper education, suppressing libraries, etc, they’re just doing the same thing as what the CCP’s doing, only less-skillfully, is all.
No real difference in their deeper heart/motivation/intent, though: supremacism, crushing/destroying all “other” kinds.
Russia’s big on it, too, isn’t it?
Islamism…
The “Crusades” were good examples of this kind of idiocy?
The “Inquisition”?
The “Buddhist” genociding of Tamils?
So long as the “home” story is … “coherent”, & “justifies” all, then … kids grow up … believing, right?
There’s a book, & a Big Think yt video, on “Collective Illusions”, which is important!
Please invest in seeing that video, & see how it’s actually a delusion-mechanism in our minds…
…used by political-forces, yes, but they couldn’t use it if it didn’t exist, could they?
_ /\ _
What, even the private gits???
No, they don’t have access to that
That is a good thought.
It is a new “internet” archive without copyright bla bla? ¯\_(ツ)_/¯
Smart.
There is always something you can do about it. Always.
umami_wasbi@lemmy.ml 4 months ago
When they mirror it, does they uses a different username? If so I’m totally fine as that’s just a fork, otherwise it should count as stolen. Not the project but the name and reputation of the owner.
BeigeAgenda@lemmy.ca 4 months ago
They can use the same name but if the owner signs their commits we can at least spot the fake commits.
And even if they clone all repos they don’t clone the build systems, so their builds of apps and windows installers will be signed with different keys.
For people who follow guides to clone something from a repo, compile it and install it, they need to be on their guard if the repo URL is not the official one.
umami_wasbi@lemmy.ml 4 months ago
How many know what even signed commit and build is? For people following a guide they don’t even know what Github is for but a nice place to have free programs.