Hacker News Reader

Parent Full thread

imdsm

For anyone wondering:

1. Click your avatar

2. Settings

3. Security / Code security and analysis

4. Dependency graph [Disable all]

You're welcome

View on HN

Is it on by default? Couldn't they just silently re-enable it with an "oops that's how site updates go sometimes!" later?

Its not a checkbox, it’s an action.

…and “automatically disable for all new private repos” is not set unless you explicitly opt in.

Interesting wording. I would call opting in to disabling a feature 'opt out'.

I'm sure github legal prefers your description, though.

Well they could silently do anything. No need to toggle the user-visible checkbox

It's like giving a party some of your possessions to store, and signing a form saying you don't consent to them snooping through them, then worrying "what if they change and forge the contract later?". They wouldn't need to. Either you trust them to keep their word or you don't trust them with your possessions at all

When I click that disable all button there is a modal window with a checkbox that says "Enable by default for new repositories"

I'm assuming I want to definitely not check that if I dont want my code stolen?

But I dunno, they have worded this all so confusingly, this is some dark pattern shit. Do I check the box or not?

I believe you DO NOT check that box in the popup modal window.

Reply on news.ycombinator.com