Hacker News Reader

Comment by Shrezzing | Hacker News Reader

Everything referenced in this webpage refers only to public data, or private data where a user has enabled the dependency graph

>data from public repositories, and also... data from private repositories when a repository's owner has chosen to share the data with GitHub by enabling the dependency graph

So if you don't enable the Dep Graph feature, your private code is treated according to the standard terms of service.

View on HN

For anyone wondering:

1. Click your avatar

2. Settings

3. Security / Code security and analysis

4. Dependency graph [Disable all]

You're welcome

Is it on by default? Couldn't they just silently re-enable it with an "oops that's how site updates go sometimes!" later?

Its not a checkbox, it’s an action.

…and “automatically disable for all new private repos” is not set unless you explicitly opt in.

Interesting wording. I would call opting in to disabling a feature 'opt out'.

I'm sure github legal prefers your description, though.

Well they could silently do anything. No need to toggle the user-visible checkbox

It's like giving a party some of your possessions to store, and signing a form saying you don't consent to them snooping through them, then worrying "what if they change and forge the contract later?". They wouldn't need to. Either you trust them to keep their word or you don't trust them with your possessions at all

When I click that disable all button there is a modal window with a checkbox that says "Enable by default for new repositories"

I'm assuming I want to definitely not check that if I dont want my code stolen?

But I dunno, they have worded this all so confusingly, this is some dark pattern shit. Do I check the box or not?

I believe you DO NOT check that box in the popup modal window.

So give them an inch (Dep Graph feature) and they'll take a mile (loss of confidentiality); that's not any better...

> So give them an inch

You are not giving them an inch, you are receiving an inch (and a whole lot more). And if you don't want that, you can turn the feature off.

What would you want instead? Them not offering the feature at all?

I'd like them to limit the scope of the data use to dependency graph ONLY and for it to not be stored. I swear this goes without saying.. but these blanket self granted permissions on the part of GitHub are a serious breach of trust. They don't need this to provide the dependency graph service.

My understanding of the way dependabot works is that they read your repository's manifest files to provide alerts about vulnerable dependencies. Then after you patch the repository they re-read it to identify the new package version you've moved to, and if there were any build errors introduced from the update. That info is anonymised & fed into an aggregated dataset, creating suggestions for other users like "95% of repositories impacted by this CVE upgraded from v1.0.4 to 1.0.5". Dependabot doesn't read through your code (unless your code is in `.manifest` or `.package` files).

That might still be too much for you, everyone's line is at a different place. Dependabot works better the more data it has, so personally I'm fine with that level of detail being returned to an aggregated service, for that very specific purpose.

There are other private providers of dependency scanning out there. I'm fairly sure they all work the same way Github does, just with smaller datasets.

I am not disagreeing with you but by your own admission it does not read your code; only the project's manifest. THEN why on Earth do they ask for so much more when all they need to do is bump some dependency version in the manifest.

As for this aggregate stats, why not limit the scope to access to the build status instead? They don't need anything more to provide this service...

I doubt there's any legal way to say "we'll only read your manifests". Programmers may know what that means (and still debate it, honestly), but I'm skeptical the law has the ability to distinguish between the designated utilities of specific files.

As far as I can see from all of their documentation, they exclusively open a predefined list of common manifest files. They explicitly mention that they won't be able to do dependabot analysis if your deps are listed in a `setup.py` file for example. You'd need readonly access to the entire repository to actually find those manifest files though, as most of the time they're not going to be in the top-level directory.

For companies & people not willing or able to surrender that level of access, it's still possible to use the dependabot API, dissociated from any github repository (for example if you have an Atlassian git repository). You just send it a list of dependencies and an enum indicating its current build status, and they'll reply with a list of suggestions.

This is a false dichotomy. They can enable the dependency graph feature without repurposing your data for machine learning.

And they can also repurpose your data for ML, or otherwise illicitly pilfer your data, without you turning a random dependency visualization on. There seems to be an idea here that turning it off will change something, like how there are people adamant that Windows 10 has secret tracking features, yet believe they can defeat them using regedit. I'm afraid this is the technical equivalent of "swiper no swiping!"

And to be clear I'm not saying Github or Windows is doing this, I'm just saying either you trust them to keep their word or you don't

Reply on news.ycombinator.com