►
Description
Presented by Lindsey Bieda, GitHub.
In an age where oversharing information is the norm, users need to be increasingly aware of what they make public to an internet that never forgets. In this talk, we'll take a look at identity on the web and what users and sites can do to help protect personal information. We'll do an in-depth look at the safety and privacy tools on GitHub, user consent-driven feature designs, and best practices for keeping your users safe on your site.
About GitHub Universe:
GitHub Universe is a two-day conference dedicated to the creativity and curiosity of the largest software community in the world. Sessions cover topics from team culture to open source software across industries and technologies.
For more information on GitHub Universe, check the website:
https://githubuniverse.com
A
It's
camps
for
short,
which
was
coined
by
Danielle,
who,
you
might
have
heard,
speak
earlier,
and
we
kind
of
build
tools
to
help
communities
grow
and
we
build
tools
to
keep
users
safe.
But
we
also
do
an
important
thing
for
other
features.
Is
we
look
for
abuse
vectors
in
them,
which
is
extremely
important,
so
little
definition,
time,
abuse
vectors
in
tech,
our
path
through
a
given
feature
that
allows
a
user
to
interact
in
a
way
that
is
destructive
or
disruptive?
A
Not
all
users
are
actively
trying
to
be
destructive
when
they
kind
of
find
a
weird
path
through
it.
Maybe
someone's
opening
a
bunch
of
issues
because
they
want
to
get
some
help
with
something,
but
they
don't
understand.
That's
not
exactly
the
right
route
to
go
about
it.
So
that's
like
a
potential
disruptive
user
who
isn't
trying
to
be
destructive,
but
they
kind
of
have
that
same
end
effect
virtual
identity,
so
identity
on
the
web
is
sort
of
like
a
funny
thing.
A
You
build
it
through
information
about
yourself
whether
or
not
you're
using
an
alias
a
handle.
Anything
that's
kind
of
like
obscuring
who
you
are
you're
still
kind
of
putting
yourself
in
that,
and
despite
like
the
fact
that
you're
kind
to
like
keep
identity,
separate,
they're,
still
part
of
the
whole
there's,
always
a
certain
level
of
vulnerability.
A
With
the
information
you
share,
whether
or
not
you
do
that,
underneath
your
real
name
or
a
handle
or
anything
else
like
that,
you
kind
of
create
a
sense
of
authenticity
to
be
like
okay,
I'm,
a
person
here
are
some
facets
about
me
or
the
illusion
there
of
where
you
might
be
pretending
to
me
something
else,
though,
on
the
web
right
now,
what
we
have
is
information
over
sharing,
so
over
sharing
information
has
sort
of
become
the
norm
on
the
web.
Like
Instagram,
it's
like!
Oh
look.
This
is
what
I
ate
for
lunch.
A
This
is
what
I
ate
for
dinner.
This
is
what
I
ate
for
breakfast
and
that's
probably
too
much
information.
You
also
have
a
tendency
to
tag
like
I
was
here
when
I
ate.
This
I
was
at
this
location,
and
if
someone
really
wanted
to
track
you,
that's
all
they
would
need,
but
we
don't
really
know
those
risks
until
we
dive
in
deep
or
until
like
a
situation
occurs
that
affects
you.
So
the
amount
of
information
you
share
is
sort
of
this
balance
with
identity.
You
want
to
be
authentic.
A
You
want
to
show
who
you
are
what
you're
doing,
but
at
the
same
time
you
don't
want
to
expose
yourself
in
your
personal
information
more
than
you
absolutely
have
to
and
more
that
may
be
absolutely
necessary.
Different
people
have
different
amounts
of
information,
they're
willing
to
share
and
feel
comfortable
sharing,
and
so
it's
important
that
we
kind
of
give
everyone
the
tools,
so
they
can
decide
how
much
they
want
to
share
users
and
trust
are
a
funny
thing.
A
I'm
sure
a
number
of
us
have
seen
recently
some
pretty
big
stories
coming
out
about
users.
You
know
gave
companies
information,
trust
of
that
information
to
remain
private,
and
then
it
ended
up
becoming
leaked
or
becoming
visible
by
some
other
means
users,
when
using
your
site
or
using
your
service
when
they
give
you
that
information,
they
don't
anticipate
that
being
used
maliciously
against
them
unless
they've
had
prior
experience
of
that
happening,
which
some
people
have
and
that's
really
unfortunate.
A
But
it's
like
not
really
in
the
floor
of
the
vast
majority
of
people's
minds
and
data
scraping
is
another
kind
of
weird
thing:
that's
always
happening
on
the
web.
There
are
always
BOTS
crawling
the
pulling
down
all
sorts
of
information
they
can
get,
but
it's
something
that
we
tend
to
not
really
think
about.
So
often
it's
like.
A
Oh
that's,
not
happening,
or
you
know
the
idea
that,
like
it's
being
pulled
down
so
often
and
so
much
it's
like,
oh
you
know
they
couldn't
even
use
it
anyway,
but
it's
still
being
used
and
it's
being
fed
into
databases
and
being
shared
with
people
and
other
BOTS.
So
what
can
we
do
and
that's
sort
of
the
question
that
community
and
safety
exists
to
answer?
What
can
we
do
to
make
things
better
for
our
users
and
also
a
little
bit
safer?
A
A
Okay,
emails
in
kid
history
because
that's
part
of
your
identity
right,
so
the
email
is
accessible
to
anyone
who
views
the
get
history.
Anyone
who's
ever
gone
into
a
terminal.
You
type
git
log.
You
can
see.
Okay,
here's
the
commit
message:
here's
who
did
it
and
here's
their
email
that
right
there
is
an
abuse
vector
and
that's
an
abuse
back
there
through
get
in
the
way
that
it
handles
identity.
A
So
get
history
as
an
abuse
vector
you
get
unsolicited
emails,
so
I
don't
know
if
you've
experienced
this
I
definitely
have
where
recruiters
have
gone
through
the
get
history.
In
order
to
email
me
and
say:
hey:
do
you
want
to
work
for
our
company?
First
of
all,
I
don't
share
my
email
publicly.
So
where
did
you
get
it
I
know
exactly
where
you
got
it
might
get
history.
A
Emails
can
be
shared
or
sold
to
third
parties.
Is
it
absolutely
happening?
It's
like
a
huge
fan,
vector
and
I
mean
people
are
making
money
off
of
your
personal
information
that
you're
putting
online
and
using
it
to
sell
you
as
a
product
and
then
there's
dead,
naming
which
to
explain
dead,
naming
it's.
If
you
have
a
name
or
identity,
and
then
you
go
and
change
it,
and
you
no
longer
want
to
use
that
old
name
or
identity,
that's
actually
unsolved
and
get
like
what
you
can
do.
A
Is
you
end
up
rewriting
all
the
history
to
be
like?
This
is
my
new
name.
This
is
my
new
identity,
but
then
you
end
up
kind
of
messing
up
your
entire
get
history.
In
order
to
do
this,
and
that's
just
because
the
way
gets
stores
that
information,
it's
an
unsolved
problem.
I
have
ideas,
but
that's
for
later.
A
So
what
we
really
want
to
do
is
provide
people
the
tools
to
help
users.
You
know
control
what
they're
releasing
to
the
public
control
their
emails.
Saying
like
okay
I
have
my
email
I'm,
tired
of
getting
emails
from
recruiters,
so
you
can
use
stealth
emails
on
github,
which
is
absolutely
great
and
I
haven't
been
using
it.
But
I
really
should
because
I'm
tired
of
getting
emails
from
goober
uber
asking
me
to
join
their
team.
A
No
I
will
never
work
for
you
over
yeah
selfie
wheels
are
great,
there's
actually
some
added
benefits,
but
at
first,
when
you
go
into
your
settings,
you
can
be
like
hey
keep
my
email
address
private
and
it
will
give
you
this
new
email
address.
That's
a
no
reply
at
github
com,
so
people
can
see
that
in
the
gate
history
they
can
email
that,
but
it
won't
go
anywhere.
It's
a
no
reply
goes
dead
null
never
seen
from
again,
but
you
see,
we've
got
two
little
examples
of
this
email.
A
We
have
an
ID
plus
your
username
I
know,
users
know
replied
on
github.com
or
we
just
have
the
username.
The
first
one
is
new.
So
if
you
have
the
second
one
without
the
number
on
it
and
you
change
your
username,
you
might
notice
that
the
history
won't
connect
back
to
you
but
say
if
you
use
the
first
one
you
can
now
change
your
username
and
all
that
get
history
still
six
with
your
account
so
kind
of
solving
the
dead
naming
problem,
not
exactly
but
a
little
a
little
bit
of
help
with
that.
A
So
if
you
completely
change
your
identity
on
github,
you
can,
and
if
you're,
using
that
stealthy
email
you'll
be
able
to
keep
all
of
those
commits
your
precious.
You
know,
contribution
graph
will
stay
the
same.
I
know
everyone
loves
the
contribution
graph.
It's
such
a
big
deal
and
anytime
that
changes.
A
Alright.
Another
tool
we
give
to
the
users
is
messaging,
so
informing
the
user.
When
they're
performing
an
action,
they
may
leak
information,
they
want
private.
So
this
was
one
of
my
actually.
This
was
my
first
feature,
I
shipped
when
I
started
working
at
github,
and
this
is
you
can
enable
a
setting.
So
when
you
push
up
information,
they
can
change
your
private
email.
It
rejects
the
push.
It's
like.
Okay,
you're
gonna
be
leaking
this
information.
You
told
me
not
to
let
you
do
that,
I'm,
not
gonna.
Let
you
do
that.
A
You
wanted
to
keep
this
private.
Maybe
you
need
to
go
change
that
commit.
Maybe
you
need
to
take
a
step
back
think
about
if
you
really
want
your
email
address
private
cuz
you're
trying
to
push
this
up.
It's
really
helpful
because,
like
you
know,
when
you're,
just
like
coding
and
typing-
and
you
just
like,
go
and
quickly
do
a
push,
you
might
not
be
thinking
about
your
privacy
at
that
time
and
you
shouldn't
have
to
so.
We
provide
them.
A
Is
that
messaging
and
the
tooling
to
keep
you
a
little
bit
safer,
great,
so
providing
information
to
the
users
for
how
they
can
keep
them?
Themself
safe,
is
extremely
important
and
we
have
like
github
documentation.
Team
is
amazing,
and
so
they
did
a
really
great
job.
Talking
about
your
committee,
email
addresses.
How
do
you
stealthy
emails?
How
to
keep
all
that
private
and
I
would
love
to
see
more
sites
kind
of
show
all
of
their
users?
Okay,
you
can
be
safe.
You
can
keep
your
information
private,
here's
all
the
information
you
need.
A
Privacy
first
is
a
huge
deal,
mini
sites,
kind
of
assume,
openness.
First
right,
it's
like!
Oh,
you
put
all
your
information
here
and
then,
if
you
want
to
be
private,
you
can
be,
but
at
first
it's
all
open
and
we
assume
that
everyone
would
everything
ever
shared.
That's
not
great
because
right
there,
the
moment
a
user
signs
on
to
your
site,
their
informations
out
there,
especially
because
stuff
gets
cached
and
then
those
cache
gets
crawled
and
then
that
crawling
gets
sold
and
then
you
get
more
spam
emails.
A
So
what
we
did
now
is
when
you
sign
up
for
a
github,
your
emails
private,
like
by
default,
not
shared,
you
have
a
stealth
email.
You
can
go
and
use
that
right
away.
Every
commit
you
make
on
the
site
will
be
using
that
stealth
email.
None
of
that
information
is
leaked
right
off
the
bat,
which
is
a
beautiful,
beautiful
thing.
A
Trust
in
the
web
is
an
interesting
thing.
We've
seen
it
time
and
time
again,
trust
being
completely
lost
by
websites
and
services,
because
they're,
like
oh
we're,
playing
hard
and
fast
with
your
data.
We
don't
really
care
that
much,
but
it's
quickly
lost
the
moment
that
leak
comes
out.
You
know
you
go
in
your
website,
was
it
have
I
been
owned,
calm
or
whatever?
And
it's
like?
A
You
can
definitely
see
that
happening
at
a
number
of
sites
right
now
and
services,
the
Equifax
yeah,
but
that's
entirely
preventable
by
being
mindful
of
the
data
and
putting
privacy
first
and
just
being
it's
like
as
gentle
as
you
would,
with
your
own
personal
information
with
someone
else's
like
you,
can
prevent
that
Equifax
could
have
prevented
that
by
not
setting
the
password
to
admin.
But
that's
neither
here
nor
there
service,
like
security
issues,
need
to
be
on
the
forefront,
because
that
affects
everyone,
so
focusing
on
consent.
First
features
is
extremely
important.
A
New
features
should
not
expose
informations
that
the
user
has
previously
opted
to
keep
private
and
users
should
always
have
the
choice.
There
was
a
really
big
issue,
not
to
name
names
arrives
with
ace
book
where
they,
you
know,
outed
someone
without
their
permission,
because
something
that
was
meant
to
be
private
and
was
meant
to
have
privacy
settings
ended
up
being
leaked
when
they
updated.
Some
things
really
go.
This
is
all
open.
A
Everything
is
opened
at
first
and
then
you
can
like
narrow
things
down
to
make
things
more
private,
that's
a
huge
problem
and
it
really
really
exposes
your
users
to
harm
little
shout-out
to
Danielle.
Again
she
has
at
consent
software,
which
is
the
Twitter
account
that
talks
about
consensual
software.
It
was
just
extremely
important,
focusing
on
consent
from
the
users
before
you
do
anything
ask
don't
assume
I
know
like
we've
heard
a
lot
of
like
asks
for
forgiveness,
not
for
permission
like
no.
No,
no,
no
ask
your
users
like
you
want
to
expose
some
data.
A
Ask
them
add
a
little
checkbox.
I
know
you
I
can
be
challenging,
but
if
you
have
you
know,
a
designer
is
talented
as
cat.
It's
not
a
problem,
but
really
ask
your
users
first
protect
the
users,
as
you
would
yourself
and
then
some
and
then
some
because
you
don't
know
what
your
users
are
facing,
what
challenges
they're
dealing
with
they
could
be
dealing
with
stalkers.
They
could
be
dealing
with.
A
You
know
large
scale,
harassment
on
like
the
scale
of
gamergate
or
something
like
that,
but
they
don't
want
any
of
that
personal
information
getting
out
there
and
it's
a
lot
of
states.
Don't
allow
people
to
register,
to
vote
with
the
p
o--
box
and
that's
a
problem,
because
that
means
every
single
person
who
is
like
being
stalked
cannot
actually
register
to
vote
because
you
have
to
express
your
address
and
that
becomes
in
the
public
domain.
And
then
anyone
can
look
up
that
information,
yeah,
really
real
bad
thing.
A
So
you
really
need
to
be
protective
of
that
data
way
more
than
yourself,
because
you
have
no
idea
the
situations
that
your
users
may
be
facing,
inform
users
of
the
risks.
So
if
they
are
performing
an
action-
and
it
may
not
be
clear
that
they're
leaking
particular
source
of
information
such
as
on
github,
it's
like
okay,
you
know,
I
have
a
public
email
address
and
I'm
making
my
first
web
like
edit.
You
know
we
pop-up
books,
it's
like
okay.
You
know
this
is
gonna
leak,
your
email
address,
if
you're,
okay
with
that,
that's
fine.
A
Otherwise,
you
can
go
here
and
change
your
settings,
so
you
have
a
stealth
email
and
that's
really
important
that
the
users
stay
informed
as
to
like
where
their
information
goes.
What
it's
doing,
okay,
I
have
some
reading
wait
hang
on.
They
gave
me
a
laser
yeah
okay,
so
we
have
data
and
Goliath,
which
is
a
really
good
book,
and
it's
about
kind
of
the
data
collection
and
how
to
control
that
dragnet
nation.
It's
about
the
quest
for
privacy
and
a
smart
girls
guide
to
privacy
by
private
blue
is
sort
of
like
more
like
a
workbook.