Hacker News Reader

Comment by searchableguy | Hacker News Reader

> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items.

Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released.

> Microsoft employee Sam Smith replied to Under the Breach's tweet stating that he thought the leak was fake as "Msft has a “rule” that GitHub repos must be public within 30 days."

Curious, what does microsoft use internally? Instance of github enterprise? Azure devops?

View on HN

> Curious, what does microsoft use internally? Instance of github enterprise? Azure devops?

I guess they have internal Git servers, since they develop VFS for Git[1] to handle large amount of files in git, but IIRC github isn't support it yet

[1]https://vfsforgit.org/

Yes. Most teams are using git repos in Azure DevOps. Anything in GitHub is supposed to be made public pretty quickly.

When I was in Azure last year we used an internal Git repo named, I think it was named 'onebranch'. There are only two things we posted to a private github.

First was our description of our JSON apis, which would eventually be sent to a public github.

The second was some internal documentation we had for our internal clients. I don't think there were any 'secrets' in there, but it would be documentation for the internal side for internal clients that no outsider could ever use.

As far as I know, everyone uses azure devops. I don’t know of any teams committing to github, but it would make sense only things that will be open sourced will be placed there.

Yes, basically everything is azure devops internally, spread across numerous tenants for different orgs.

I don't think the potential leak of source code is the worry for Microsoft here, it is the fact that they got access in the first place, as that could have security implications for other projects.

Well if MS can't secure their own code on GitHub, surely anyone with private repos has to be thinking to jump ship (at least until the flaws are identified and fixed)?

When I interned on the Office team in 2014, we used something called Source Depot. I’m assuming it’s changed since then.

Many teams have used the public github.com version. You can see all the .NET platform development happening in the open.

I used Azure DevOps while at NERD in 2019.

Reply on news.ycombinator.com