It wasn't the Github that was compromised, it was the access to their private repository that was compromised so somewhere down the line the security best practices are in question for sure. Self hosted repos available on public internet would have met the same fate, may be worse, given github does provides some level of security.
Even regarding the blast radius, I do not really believe any company is honest about it. They do not have tools to verify it, if the user information was accessed with leaked token or real token. The thing that works in their favor is that no one else can verify it either which absolves them from any responsibility. Any platform engineer knows that your CICD system has the keys to the kingdom.
The article you're commenting on says how they were compromised.
> The thing that works in their favor is that no one else can verify it either which absolves them from any responsibility
That's not how this works, at all. You need to have enough evidence that you can confidently demonstrate that there is no sign of a broader breach. If you get sued and can't do that, you're in trouble, because being unable to do that shows that you were acting negligently.
They might need regulations, if they are for-profit companies with a responsibility to shareholders to maximize profit while sacrificing all other values.
> responsibility to shareholders to maximize profit while sacrificing all other values
This is not required to meet fiduciary duty, although it is a common misconception. The company officers and board have pretty broad leeway to run the company as they see fit as long as there is no fraud, illegal activity, or conflict of interests.
They are not. This is why OpenAI and Anthropic are Public Benefit Corporations, which gives them the ability to prioritize the public over profit. The issue is that an agreement between them to mutually slow down is an antitrust concern.
It is telling that most aggressive forms of “capitalism” plead for government involvement to permanently limit new competition. I own something and I don’t want anyone else to have a chance. The marginal cost of bribing a senator is tiny tiny tiny compared to the value.
I used "Override colors" under Settings -> Accessibility to set nice dark colors.
Then I used userChrome.js from https://github.com/AlexVallat/firefox-scripts/ to add a button which toggles the browser preferences "browser.display.use_system_colors" and "browser.display.document_color_use", so I can still access bright mode if needed.
You never used a download manager like DownThemAll or GetBot back in the day?
As far as fragmentation goes, I think both Firefox and Chrome derivatives figure out the final file size in advance, pre-allocate a temporary file that long and put data in it as it arrives. Completing the download is a rename operation or a no-op.
Speed Download on early OS X releases was a lifesaver back when I was still on 56k dialup. Its multiplexing was the only way I could get decent speeds half the time (browsers would often drift down to single digits) and being able to resume when connections were dropped (at least when servers supported it).
If they had self-hosted their own repos, they might have had more luck.
reply