GitHub The Download, 13 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: The Download: GPT Takes the Bar, Passwordless Cloud Deployments, Dark Sky API alternatives and more

Description

On this security-heavy episode of The Download, Christina is back and in black with the latest developer and open source projects, including:

0:00 Intro
0:56 Passwordless Deployments to the Cloud https://github.blog/2023-01-11-passwordless-deployments-to-the-cloud/
2:16 Default setup: A new way to enable GitHub code scanning https://github.blog/2023-01-09-default-setup-a-new-way-to-enable-github-code-scanning/
3:00 I scanned every package on PyPi and found 57 live AWS keys https://tomforb.es/i-scanned-every-package-on-pypi-and-found-57-live-aws-keys/ and GitHub repo https://github.com/orf/aws-creds-scanner
3:37 Leaked a secret? Check your GitHub alerts…for free https://github.blog/2022-12-15-leaked-a-secret-check-your-github-alerts-for-free/
4:00 GPT Takes the Bar Exam https://github.com/mjbommar/gpt-takes-the-bar-exam
5:16 *Project Spotlight:* Typeshare https://github.com/1Password/typeshare and Typeshare Book https://1password.github.io/typeshare/
6:20 *Christina's Pick of the Week:* Pirate Weather https://pirateweather.net/ and GitHub repo https://github.com/alexander0042/pirate-weather-ha and Alexander's GitHub Sponsors page https://github.com/sponsors/alexander0042
Presented by: @ChristinaWarren

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

A bunch of security tips GPT takes the bar a new tool for synchronizing type definitions and a pick of the week for weather nerds. All that and more on this episode of the download.

A

Welcome back to another episode of the download I'm, your host Christina Warren senior developer Advocate at GitHub, and this is the show where we cover the latest developer news and open source Projects. Please go ahead and like And subscribe, so my shirt this week is not a shirt but a jumpsuit, and that kind of makes me look like an android, robot or so I've been told. I've also been told. It makes me look like a superhero, I love. It look. I like this I haven't worn it in like two years. I wanted to wear it.

A

Give me your suggestions for what shirts you want to see me wear in the comments down below and I may or may not. Take them. We'll see all right. Let's get into the news, so the new year is a great time to reassess your security practices and security hygiene.

A

So I've got a couple of stories that highlight some ways you can protect yourself and your code, so the first one is a fantastic blog post on the GitHub blog from Chris Reddington, and it talks about passwordless deployments to the cloud so having passwords or Secrets exposed in your code is a nightmare for all of us uh in even with with code scanning features, it's just something that isn't good for anyone, because you have to go through a lot of effort to get rid of anything, that's exposed. So what?

A

If you could deploy to your cloud provider without having to bother with passwords at all that'd, be pretty cool right? Well? Well, that's the idea behind Chris's post, which explores in his words, how you can use openid connect to trust your cloud provider which will enable you to deploy easily securely and safely while minimizing the operational overhead associated with secrets. You know like key rotations, so the whole post is worth a read.

A

It opens up some great possibilities for using openid connect and GitHub actions to deploy to your cloud provider without passwords and and as I said like that makes things like secrets and key rotation even easier. I've got a link to the Post in the show notes and the description down below, but I really love. This idea. A great job, Chris and, of course, leaked Secrets or passwords are the only things you need to worry about.

A

Having known vulnerabilities in your code is a problem too, but on that side, GitHub has a brand new setup option for code scanning dubbed default setup, and this is a way for you to automatically enable code scanning on your repository. So right now out of the box, it's going to work with python, JavaScript and Ruby repositories, and it's a way to enable code scanning in just a couple of clicks. So you don't have to bother using a yaml file like you did in the past.

A

The team is working on making this available for all the languages that are supported by the code ql engine and we'll be rolling out support for those languages based on popularity over the next six months or so so. We've got details on how to set this up and more in the show notes in the description down below and speaking of code scans.

A

I wanted to give a shout out to Django developer Tom Forbes, who scanned every single package of Pi Pi, the python package manager and he actually found 57 live AWS, Keys yikes, so I've got a link to Tom's blog post in the show notes down below and he actually created a tool in Rust to scan Pi Pi put it on GitHub and it'll periodically run a GitHub action that will scan Pi, Pi, hex pm and ruby gems for AWS keys and then, if it finds one it'll, generate a report and commit it to the repository.

A

It's a really cool proof of concept. But what I really appreciated was Tom's analysis of the types of keys that he found and on a note, I just want to remind everyone that GitHub now allows you to track any leaked secrets in your public repositories for free using secret scanning alerts to track an action on on.

A

You know, leaked Secrets directly within GitHub, so I've got a link to Tom's blog post and his tool in the show notes in the description, as well as a link to the announcement about the free secret scanning feature for all public repositories on GitHub movie.

A

Moving to some AI news, Michael Bommarito and Daniel Martin Katz have pre-published a paper with the audacious, but I will say brilliant title GPT takes the bar exam and they look at how well GPT 3.5 does on the multiple choice, questions for the bar exam and, if you're not familiar in the United States, almost every jurisdiction requires that a lawyer pass a license exam and that's known as the bar, and they need to pass that before they can practice law. Okay. So how did a day I do well.

A

The good news for the lawyers is that AI isn't sentient. Yet, although- and this is what's pretty exciting, it did do better than random selection by a significant margin and it came close to human test takers in a couple of categories.

A

I've got a link to the GitHub repo that has a link to the paper, the Jupiter notebook that has the results, prompt examples and session log and I've got that in the show notes in the description it's worth reading the entire paper, because there are a lot of caveats about how this works, but the results are really exciting.

A

um There's also been a story floating around about a company. That's offering to pay anybody who argues in front of the Supreme Court with their AI lawyer, a million dollars, but honestly, that's a policy stunt and I. Don't really think we should discuss it. I just did okay.

A

Moving on to some cool project, news I want to introduce a new feature: we're calling project Spotlight, where I highlight cool and interesting projects on GitHub and the first one that I want to point out is typeshare, and this is from our friends at one password and like a lot of services. One password has code in a lot of different languages and that can make managing and synchronizing types a hassle, so one password created typeshare and they dubbed this.

A

The ultimate tool for synchronizing your type, definitions between rust and other languages, for seamless, ffi and ffi. If you're not familiar with that term, it means foreign function interface and it's a way that a program written in one program, language can call routines or make use of services written in another. Thank you very much to Wikipedia for that. Succinct definition. Typeshare right now works with kotlin, Swift typescript, and there is experimental support for go.

A

I've got a link in the uh to the project in the show notes in the description as well as a book that one password wrote about it. Basically, the documentation, nation and a post that they wrote in November when they announced the release to the world. This is really really great stuff, and now it's time for my pick of the week, so there used to be a really great website and mobile, app called dark sky that offered really accurate predictions on near time, weather updates.

A

So you could find out with very good accuracy if it would be raining in your area in the next hour or so, and by how much well a few years ago, Apple acquired dark sky and they set the API recently and the sad side effect of the API shutdown was that a lot of projects, especially smaller personal projects, that had relied on dark sky stopped working well. This is where Alexander Ray stepped in, and this is so cool.

A

While he was working on his PhD, he became really familiar with the the NOAA weather data set and he was also relying on Dark Skies API for a project, so he recreated the dark sky API and created something he calls pirate weather and it's a drop in replacement for the dark sky API. So it uses the same public data set that dark sky used, and you can basically just replace the dark sky API call with pirate weather.

A

Now, why is it called pirate weather well Alexander thought that the hrr data set sounded like R in Pirate terms, so that's pretty cute anyway. I've got a link to the pirate weather website. Github repo and Alexander's GitHub sponsors page in the show notes in the description really really great work with this. Well, that's going to do it for me. If um you like, this episode, go ahead and give us a like on YouTube. It helps us out, and let me know in the comments.

A

Any of your thoughts on you know, dark sky or type share, or you know, is, is GPT going to take over the world? Will look with the robot lawyers? Take us all on I'm kind of into it anyway. Let us know that in the comments down below and while you're there go ahead and subscribe to the GitHub YouTube channel for all of your nerd needs, see you next time.

A