From the blog

Introducing the new, Apple silicon powered M1 macOS larger runner for GitHub Actions

Today, GitHub is releasing a public beta for the new, Apple silicon powered M1 macOS larger runner for GitHub Actions. Apple silicon powered M1 macOS larger runners Apple developers require the latest chipset to take advantage of features in the latest versions of iOS and macOS. They also want increased performance by leveraging the on-chip GPU capabilities of the M1 processor. The M1 macOS runner comes with GPU hardware acceleration enabled by default. Workloads are transferred from the CPU to the GPU for improved performance and efficiency. The runner is equipped with a 6-core CPU, 8-core GPU, 14 GB of RAM, and 14 GB of storage. It can reduce build times by up to 80% compared to the existing 3-core Intel standard runner, and up to 43% compared to the existing 12-core Intel runner. How GitHub uses the M1 runner to build GitHub mobile for iOS The GitHub mobile iOS team leverages the new M1 runner for 10k+ minutes to deliver updates of the GitHub iOS app to the Apple App Store every week. The transition from the 12-core Intel runner to the M1 runner resulted in a 44% build time improvement, from 42 minutes to 23 minutes. While the time spent testing the binary remained constant for single target runs, code compilation improved by 51%, along with UI tests improving by 55% across the entire GitHub mobile test suite. The transition to the M1 runner was seamless, with updating the YAML workflow label being the only requirement to access it. However, due to differences in UI rendering between M1 Macs and Intel Macs, the team had to re-record images for snapshot tests, which compare new UI images with recorded reference images on a pixel-by-pixel basis. The M1 runner has proven to be advantageous for iOS teams, as it provides access to the VMs GPU and speeds up the App Store review process. Faster approval and publishing of apps can be achieved, which reduces the time spent on submitting to the Apple app store. How to use the runner To try the new Apple silicon macOS larger runner, update the runs-on: key in your GitHub Actions YAML workflow YAML file to target macos-latest-xlarge or macos-13-xlarge. The 12-core macOS larger runner is moving from xlarge to large, and is still available by updating the runs-on: key to macos-latest-large, macos-12-large, or macos-13-large. There is no sign-up required for the beta and the runner is immediately available to all developers, teams, and enterprises. New macOS runner pricing As part of GitHub’s continued commitment to deliver the best developer experience we are excited to share with you that we will be decreasing the price of our macOS larger runners. We understand the importance of achieving both cost-efficiency and high performance and this price decrease reflects our dedication to supporting your success. With today’s launch, our macOS larger runners will be priced at $0.16/minute for XL and $0.12/minute for large. To learn more about runner per job minute pricing, check out the docs. Additionally, if you’re interested in using larger macOS runners and understanding the difference between them and larger Linux and Windows runners, you can find more details in the “About larger runners” section of our documentation. What’s next? You can track progress towards the general availability of macOS larger runners by following this […]

Read More

Microsoft kills Python 3.7 ¦ … and VBScript ¦ Exascaling ARM on Jupiter

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters. This week: VS Code drops support for Python 3.7, Windows drops VBScript, and Europe plans the fastest ARM supercomputer. 1. Python Extension for Visual Studio Code Kills 3.7 First up this week: Microsoft deprecates Python 3.7 support in Visual Studio Code’s Python extension. It’ll probably continue to work for a while, though (emphasis on the “probably”). Analysis: Obsolete scripting language is obsolete If you’re still using 3.7, why? It’s time to move on: 3.12 is the new hotness. Even 3.8 is living on borrowed time. Priya Walia: Microsoft Bids Farewell To Python 3.7 “Growing influence of the Python language”Python 3.7, despite reaching its end of life in June, remains a highly popular version among developers. … Microsoft expects the extension to continue functioning unofficially with Python 3.7 for the foreseeable future, but there are no guarantees that everything will work smoothly without the backing of official support.…Microsoft’s recent launch of Python scripting within Excel underscores the growing influence of the Python language across various domains. The move opens up new avenues for Python developers to work with data within the popular spreadsheet software. However, it’s not all smooth sailing, as recent security flaws in certain Python packages have posed challenges. Python? Isn’t that a toy language? This Anonymous Coward says otherwise: Ha, tell that to Instagram, or Spotify, or Nextdoor, or Disqus, or BitBucket, or DropBox, or Pinterest, or YouTube. Or to the data science field, or mathematicians, or the Artificial Intelligence crowd.…Our current production is running 3.10 but we’re looking forward to moving it to Python 3.11 (3.12 being a little too new) because [of] the speed increases of up to 60%. … If you’re still somewhere pre 3.11, try to jump straight to 3.11.6.…The main improvements … are interpreter and compiler improvements to create faster bytecode for execution, sometimes new features to write code more efficiently, and the occasional fix to remove ambiguity. I’ve been running Python in production for four years now migrating from 3.8 -> 3.9 -> 3.10 and soon to 3.11 and so far we have never had to make any changes to our codebase to work with a new update of the language. And sodul says Python’s reputation for breaking backward compatibility is old news: Most … code that was written for Python 3.7 will run just fine in 3.12. … We upgrade once a year and most issues we have are related to third party SDKs that are too opinionated about their own dependencies. We do have breaking changes, but mostly we find pre-existing bugs that get uncovered thanks to better type annotation, which is vital in larger Python projects. 2. Windows Kills VBScript Microsoft is also deprecating VBScript in the Windows client. It’ll probably continue to work for a while as an on-demand feature, though (emphasis on the “probably”). Analysis: Obsolete scripting language is obsolete If you’re still using VBScript, why? It’s time to move on: PowerShell is the new hotness—it’s even cross platform. Sergiu Gatlan: Microsoft to kill off VBScript in Windows “Malware campaigns”VBScript (also known as Visual Basic Script or Microsoft Visual Basic Scripting Edition) is a programming language similar to Visual Basic or Visual Basic for Applications (VBA) and […]

Read More

What Is std::quoted Quoted String In Modern C++?

Sometimes we want to preserve the string format especially when we use string in a string with /”. In C++14 and above, there is a std::quoted template that allows handling strings safely where they may contain spaces and special characters and it keeps their formatting intact. In this post, we explain std::quoted quoted strings in modern C++. What Is Quoted String In Modern C++? The std::quoted template is included in  header, and it is used to handle strings (i.e. “Let’s learn from ”LearnCPlusPlus.org!” “) safely where they may contain spaces and special characters and it keeps their formatting intact.  Here is the syntax,   std::quoted( )   Here are C++14 templates defined in where the string is used as input,   template quoted( const CharT* s, CharT delim = CharT(‘”‘), CharT escape = CharT(‘\’) );   or   template quoted(   const std::basic_string& s,   CharT delim = CharT(‘”‘), CharT escape = CharT(‘\’) );   Here is a C++14 template defined in where the string is used as output,   template quoted( std::basic_string& s, CharT delim=CharT(‘”‘), CharT escape=CharT(‘\’) );   Note that this feature is is using std::basic_string and it improved in C++17 by the  std::basic_string_view support. What Is std::quoted quoted string in modern C++? Here is an example that uses input string and outputs into a stringstream:   const std::string str  = “I say “LearnCPlusPlus!””; std::stringstream sstr; sstr std::quoted(str_out);  // output sstr to str_out   Is there a full example about std::quoted quoted string in modern C++? Here is a full example about std::quoted in modern C++. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31   #include #include #include   int main() { std::stringstream sstr; const std::string str  = “Let’s learn from “LearnCPlusPlus.org!” “; sstr

Read More

Structured Diagnostics in the New Problem Details Window

Structured Diagnostics in the New Problem Details Window Sy Brand October 11th, 20230 2 Massive compiler errors which seem impossible to navigate are the bane of many C++ developers’ lives. It’s up to tools to provide a better experience to help you comprehend diagnostics and understand how to fix the root issue. I wrote Concepts Error Messages for Humans to explore some of the design space and now, due to the hard work of many folks working on Visual Studio, we have a better experience to share with you all. You can read about some of the work which has led up to these changes in Xiang Fan’s blog post on the future of C++ diagnostics in MSVC and Visual Studio. In Visual Studio 2022 version 17.8 Preview 3, if you run a build using MSVC and an MSBuild project, entries in the Error List which have additional information available will show an icon in a new column named Details: If you click this button, a new Problem Details window will open up. By default this will be in the same place as the Error List, but if you move it around, Visual Studio will remember where you put it. This Problem Details window provides you with detailed, structured information about why a given problem occurred. If we look at this information we might think, okay, why could void pet(dog) not be called? If you click the arrow next to it, you can see why: In a similar way we can expand out other arrows to find out more information about our errors. This example is produced from code which uses C++20 Concepts and the Problem Details window gives you a way to understand the structure of Concepts errors. For those who would like to play around with this example, the code required to produce these errors is: struct dog {}; struct cat {}; void pet(dog); void pet(cat); template concept has_member_pet = requires(T t) { t.pet(); }; template concept has_default_pet = T::is_pettable; template concept pettable = has_member_pet or has_default_pet; void pet(pettable auto t); struct lizard {}; int main() { pet(lizard{}); } Make sure you compile with /std:c++20 to enable Concepts support. Output Window As part of this work we have also made the Output Window visualize any hierarchical structure in the output diagnostics. For example, here in an excerpt produced by building the previous example: 1>Source.cpp(18,6): 1>or ‘void pet(_T0)’ 1>Source.cpp(23,5): 1>the associated constraints are not satisfied 1> Source.cpp(18,10): 1> the concept ‘pettable’ evaluated to false 1> Source.cpp(16,20): 1> the concept ‘has_member_pet’ evaluated to false 1> Source.cpp(10,44): 1> ‘pet’: is not a member of ‘lizard’ 1> Source.cpp(20,8): 1> see declaration of ‘lizard’ 1> Source.cpp(16,41): 1> the concept ‘has_default_pet’ evaluated to false 1> Source.cpp(13,30): 1> ‘is_pettable’: is not a member of ‘lizard’ 1> Source.cpp(20,8): 1> see declaration of ‘lizard’ This change makes it much easier to scan large sets of diagnostics without getting lost. Code Analysis The Problem Details window is now also used for code analysis warnings which have associated Key Events. For example, consider this code which could potentially result in a use-after-move: #include void eat_string(std::string&&); void use_string(std::string); void oh_no(bool should_eat, bool should_reset) { std::string my_string{ “meow” }; bool did_reset{ false }; if (should_eat) { eat_string(std::move(my_string)); } if (should_reset) { did_reset = true; my_string = “the string is reset”; } […]

Read More

What Is Decltype (auto) In Modern C++ And How To Use It?

The auto keyword arrives with the new features of the C++11 and the standards above. In C++14, there is a new decltype that is used with auto keyword. In modern C++, the decltype(auto) type-specifier deduces return types while keeping their references and cv-qualifiers, while auto does not. In this post, we explain what decltype (auto) is in modern C++ and how to use it. What is auto in modern C++? The auto keyword is used to define variable types automatically, it is a placeholder type specifier (an auto-typed variable), or it can be used in a function declaration, or a structured binding declaration. If you want to learn more about auto keyword, here it is, What is decltype in modern C++? The decltype keyword and operator represents the type of a given entity or expression. This feature is one of the C++11 features added to compilers (including BCC32 and other CLANG compilers). In a way you are saying “I am declaring this variable to be the same type as this other variable“. Here are more details about how you can use it, How to use decltype (auto) in modern C++? In C++14, there is a new decltype feature that allows you to use with the auto keyword. In C++14 and standards above, the decltype(auto) type-specifier deduces return types while keeping their references and cv-qualifiers, while auto does not. Since C++14, here is the syntax,   type_constraint (optional) decltype ( auto )   In this syntax, the type is decltype(expr) and expr can be an initializer or a return statement. Here is a simple example how we can use it,   decltype(auto) x = i;   Are there some simple examples about decltype (auto) in modern C++? Here are some simple examples that shows difference between auto and decltype(auto), In C++14 and above, we can use decltype(auto) with const int values as below,   const int x = 4096; auto xa = x;    // xa : int decltype(auto) xb = x;  // xb : const int   In C++14 and above, we can use decltype(auto) with int& values as below,   int y = 2048; int& y0 = y;  // y_ : int auto ya = y0;  // yc2 : int decltype(auto) yb = y0;  // yb : int&   In C++14 and above, we can use decltype(auto) with int values as below,   int&& z = 1024; auto zm = std::move(z);   // zm : int decltype(auto) zm2 = std::move(z);  // zm2 : int&&   In C++11 and above, we can use auto for return types,   auto myf(const int& i) { return i; // auto return type : int }   In C++14 and above, we can use decltype(auto) for return types,   decltype(auto) myf2(const int& i) {    return i; // decltype(auto) return type : const int& }   Is there a full example about decltype (auto) in modern C++? Here is a full example that shows how you can use auto and decltype(auto) in different int types. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54   #include   auto myf(const int& i) { return i; // auto […]

Read More

Introducing secret scanning validity checks for major cloud services

At GitHub, we launched secret scanning with the mission of eliminating all credential leaks. In support of this mission, this year we’ve made secret scanning and secret scanning push protection free on public repositories to help open source users detect and prevent secret leaks. We also shipped push protection metrics for GitHub Advanced Security customers to better understand trends across their organization. But a good security experience isn’t just about reducing noise and delivering high-confidence alerts–it should make your remediation efforts simpler and faster. A key component of remediation is assessing whether a token is active or not. To that end, we introduced validity checks for GitHub tokens earlier this year, which removes manual effort and friction from the process. You can see a token’s status within the UI, saving you time and allowing you to prioritize remediation efforts more efficiently. This is especially useful when you have to comb through hundreds or even thousands of alerts. Today, we’re excited to announce that we have extended validity checks for select tokens from AWS, Microsoft, Google, and Slack. These account for some of the most common types of secrets detected across repositories on GitHub. This is just the beginning–we’ll continuously expand validation support on more tokens in our secret scanning partner program. You can keep up to date on our progress via our list of supported patterns. How to get started Enterprise or organization owners and repository administrators can activate validity checks by going to “Settings” and “Code security and analysis.” Scroll down to “Secret scanning” and check the box for “Automatically verify if a secret is valid by sending it to the relevant partner” to activate validity checks for non-GitHub tokens. Once the setting is enabled, you can see within alerts whether the token is active or not. We perform checks periodically in the background, but you can also conduct a manual refresh by clicking ‘Verify secret’ in the top right corner. Validity checks are another piece of information at your disposal when investigating a secret scanning alert. We hope this feature will provide greater speed and efficiency in triaging alerts and remediation efforts. If you have feedback to share, please reach out to us in the Code Security community discussion.

Read More

GitHub Copilot Chat beta now available for all individuals

In July, we introduced a public beta of GitHub Copilot Chat, a pivotal component of our vision for the future of AI-powered software development, for all GitHub Copilot for Business users. Today, we’re thrilled to take the next step forward in our GitHub Copilot X journey by releasing a public beta of GitHub Copilot Chat for all GitHub Copilot individual users across Visual Studio and VS Code. Integrated together, GitHub Copilot Chat and the GitHub Copilot pair programmer form a powerful AI-assistant capable of helping every developer build at the speed of their minds in the natural language of their choice. We believe this cohesion will form the new centerpiece of the software development experience, fundamentally reducing boilerplate work and designating natural language as a new universal programming language for every developer on the planet. Let’s jump in and take a deeper look into what this announcement means for individual developers and how you can get started. How developers can access GitHub Copilot Chat beta GitHub Copilot Chat beta has been enabled for all Copilot for Individual users for free. Currently, GitHub Copilot Chat is supported in both Visual Studio and Visual Studio Code editors. GitHub Copilot for Individual users will also receive an email notification to guide them on the next steps. If you’re not already part of our beta program and would like to get started, please refer to our comprehensive getting started guide, which is conveniently linked in your email notification. What GitHub Copilot Chat can do for you Now, anyone signed up for GitHub Copilot for individuals can access the powerful AI assistant that major enterprises are leveraging to turbocharge developer productivity and happiness. Now, teams of developers and individuals alike can use GitHub Copilot Chat to learn new languages or frameworks, troubleshoot bugs, or get answers to coding questions in simple, natural language outputs—all without leaving the IDE. By reducing the need for context switching, it streamlines the development process, which helps developers maintain their focus and momentum. GitHub Copilot Chat also empowers individual contributors to suggest security patches, enhancing the overall security of open-source projects—and we think that’s pretty exciting news for the developer community. Here are some of GitHub Copilot Chat’s other powerful features: Real-time guidance. GitHub Copilot Chat can suggest best practices, tips, and solutions tailored to specific coding challenges—all in real time. Developers can use GitHub Copilot Chat to learn a new language or upskill at speed. Code analysis. With GitHub Copilot Chat, you can break down complex concepts and get explanations of code snippets. Fixing security issues. GitHub Copilot Chat can make suggestions for remediation and help reduce the number of vulnerabilities found during security scans. Simple troubleshooting. Trying to debug code? GitHub Copilot Chat not only identifies issues, but also offers suggestions, explanations, and alternative approaches. Democratizing software development for a new generation Today, developers are no longer just people building software for technology companies. They’re an increasingly diverse and global group of folks across industries, who are tinkering with code, design, and documentation in their free time; contributing to open source projects; conducting scientific research; and more. Whether you are a young developer in Brazil learning how to execute a unit test for the first time or a professor in Germany who needs help documenting data, GitHub Copilot […]

Read More

How Event-Driven Architectures Drive Real-Time Operations

People, events, the human brain—in fact, the whole world operate in real-time, but businesses have struggled to keep up. With the help of event-driven architecture (EDA) and the Open API economy, businesses can now do the same. The power of an event-driven world means that, after years of geopolitical events affecting how businesses operate, many businesses are starting to uncover real value by truly being able to operate in real-time. Whether it be retail and manufacturing or energy and resources and financial services, locating and responding to vital issues within a company’s supply chains or product lines in real-time, is key to success. Amazon’s CTO, Dr. Werner Vogels, said that “the world is event driven” in his keynote speech at AWS re:Invent in December 2022. Now, new IDC research unveils that nine out of 10 of the world’s largest companies will deploy real-time intelligence driven by event-streaming technologies by 2025. But What’s the Secret Behind Such Success? A recent IDC Infobrief, sponsored by Solace, surveyed over 300 enterprise IT professionals in North America, Asia and Europe, all of whom work for large companies implementing or considering EDA. The results are quite telling–an overwhelming 93% of respondents at companies that have deployed EDA across multiple use cases said EDA has either met or exceeded their expectations. In addition to technical advantages from EDA, most businesses also see clear business benefits: A full 23% of respondents reported increasing productivity; 22% said better customer acquisition and 18% saw revenues increase as a result of EDA efforts. 1. Get Support From the Top to Ensure Alignment Throughout Expanding the footprint of EDA across the enterprise is a journey, and every journey starts by assembling those that are critical to its overall success. Business sponsorship and engaging key stakeholders is vital, especially in the early days of EDA adoption – 56% of respondents in the early EDA stages cited this as a priority when ROI and business benefits may not be immediately clear. The impact of well-aligned C-suite, operational and technical teams is reflective of business-level digital maturity, too. As 35% of respondents at an advanced stage of EDA rollout felt C-level support was critical, it comes as no surprise that respondents with higher levels of EDA maturity also have higher levels of overall digital maturity, including digital strategy and change management support. 2. Tackle Complexities Head-On With the Backing of IT As EDA becomes more pervasive across an organization, demands on IT become more sophisticated, requiring a deepening of EDA skills in the IT organization, notably with DevOps teams, developers and architects. More than one-third (36.1%) of respondents cited the lack of skills to execute EDA as a hurdle to adoption. Approaches to logging, governance and oversight (30.7%) can also become increasingly challenging and must be thought through carefully. This is where EDA providers themselves need to step up and provide adequate training and a certification path for architects DevOps and developers looking to gain the fundamental knowledge and skills to design and implement event-driven systems. This should include technical details such as understanding various design patterns for EDA, microservices choreography versus orchestration, the saga pattern and RESTful microservices. Education should also clearly define and demonstrate key concepts and tools for EDA success, such as event portal, topic hierarchy best practices and event mesh. […]

Read More

Learn How to Use New And Delete Elisions In C++

The C++14 standard (and later), brings a lot of useful smart pointers and improvements on them. They help us to avoid the mistake of incorrectly freeing the memory addressed by pointers. In modern C++, we have the new and delete operators that are used to allocate and free objects from memory, and in this post, we explain how to use new and delete operators. Can we use new and delete elisions in modern C++ or is it obsolete? Allocating memory and freeing it safely is hard if you are programming a very big application. In Modern C++, there are smart pointers that help avoid the mistake of incorrectly freeing the memory addressed by pointers. Smart pointers make it easy to define pointers, they came with C++11. The most used types of C++ smart pointer are unique_ptr, auto_ptr, shared_ptr, and weak_ptr. Smart pointers are preferable to raw pointers in many different scenarios, but there is still a lot of need to use for the new and delete methods in C++14 and above. When we develop code that requires in-place construction, we need to use new and, possibly, delete operations. They are useful, in a memory pool, as an allocator, as a tagged variant, as a buffer, or as a binary message to a buffer. Sometimes we can use new and delete for some containers if we want to use raw pointers for storage. Modern C++ has a lot of modern choices for faster and safer memory operations. Generally, developers choose to use unique_ptr/make_unique and make_shared rather than raw calls to new and delete. Even though we have a lot of standard smart pointers and abilities, we still need new and/or delete operators. How can we use new and delete elisions in C++? What is the new operator in C++? The new operator in C++, denotes a request for memory allocation on the free memory. If there is sufficient memory, a new operator initializes the memory and returns the address of the newly allocated and initialized memory to the pointer variable.    = new ;   Here, the data_type could be any built-in data type, i.e. basic C / C++ types, array, or any class types i.e. class, structure, union.  Now, let’s see how we can use new operator. We can simply use auto and new to create a new pointer and space for its buffer as below,   auto *ptr = new long int;     or in old style still you can use its type in definition instead of auto as below,   long int *ptr = new long int;     one of the great feature of pointers is we don’t need to allocate them at the beginning, we can set them NULL, and we can allocate them in some steps as below,   long int *ptr = NULL; … ptr = new long int;     What is the delete operator in C++? The delete operator in C++ is used to free the dynamically allocated array pointed by pointer variable. Here is the syntax for the delete operator,   delete ;   we can use delete[] for the pointer_arrays, here is the syntax for them,   delete[] ;   here is how we can use delete to delete a pointer, and this is how we can delete pointer arrays,   int *arr […]

Read More

3 strategies to expand your threat model and secure your supply chain

As GitHub’s Chief Security Officer and SVP of Engineering, one of the most common discussions I have with other engineering and security leaders is the state of supply chain security. We all know it’s been an interesting few years, and supply chain security has rocketed into the mainstream—but where should one start when it comes to securing the supply chain? There are many acronyms and security “solutions” out there. How can teams get the bigger security picture? I recently talked about this problem at the BlackHat CISO Summit and want to share a few prompts you can discuss with your teams and customers to broaden your perspective on supply chain security. These prompts can help open up your aperture for thinking about the breadth and complexity of supply chain security while realizing some quick wins that you can do today—without any extra tooling or purchases. Strategy #1: Understand and account for your build pipelines The SolarWinds incident was a watershed moment that woke the world up to the threat of supply chain attacks. It involved a sophisticated attack on various organizations and government agencies by exploiting vulnerabilities in SolarWinds’ Orion platform, a widely used network management software suite. This incident showed us that the pipelines we use to produce software applications are just as important to secure as the application code itself. Build systems are production systems, period. They are extensions of your production environment and must be protected with the same level of rigor as you protect your most sensitive operations. The problem is that many organizations don’t know the sprawl of their build systems and don’t treat the ones they know about as production systems. Ask yourself: what controls do you have in place for all your code and artifact systems? How many build systems do you have? How many tech stacks do you use? As we saw with SolarWinds, we need to understand exactly what inputs are coming into the software artifacts we’re producing and account for them in the build process. Strategy #2: Require users to use 2FA As an industry, we still need help with basic security hygiene and controls, like adopting 2FA. At GitHub, security starts with the developer, and as such, we now require 2FA for all code contributors on GitHub.com. Empowering developers to prevent open source ecosystem attacks by better securing their accounts from theft or takeover is one of the most critical steps we can take to secure the supply chain. We made this decision after rolling out the npm registry for high-impact package maintainers. By requiring 2FA on the accounts of code contributors, maintainers, and publishers, we’re working to address one of the top, long-standing security threats: phishing. While parts of the security industry love to focus on more exotic threats and more complex capabilities, the reality is we need to start with the basics. With 2FA, GitHub dramatically reduces the likelihood of account takeover of popular package maintainers on npm and GitHub.com contributors—and by extension, mitigates the risk to other developers who depend on that code. You should be using 2FA everywhere you can. We have resources that can help you easily set up 2FA for your account or require 2FA for your organization. This simple step will go a long way in preventing your accounts from being compromised […]

Read More