GitHub Security Update: Reused password attack

What happened?

On Tuesday evening PST, we became aware of unauthorized attempts to access a large number of GitHub.com accounts. This appears to be the result of an attacker using lists of email addresses and passwords from other online services that have been compromised in the past, and trying them on GitHub accounts. We immediately began investigating, and found that the attacker had been able to log in to a number of GitHub accounts.

GitHub has not been hacked or compromised.

What information was involved?

For affected accounts, usernames and passwords are involved. Additionally, for some accounts, other personal information including listings of accessible repositories and organizations may have been exposed.

What we are doing:

In order to protect your data we’ve reset passwords on all affected accounts. We are in the process of sending individual notifications to affected users.

What you can do:

If your account was impacted, we are in the process of contacting you directly with information about how to reset your password and restore access to your account.

We encourage all users to practice good password hygiene and enable two-factor authentication to protect your account.

These attacks often evolve, and we’re continuing to investigate and monitor for new attack vectors. Please keep an eye on our blog and on Twitter for pertinent updates, or contact Support if you have any questions.

“Open source everything you can:” Advice from open source experts at CodeConf LA

On June 27-29, join us at the Avalon Theater in Los Angeles for CodeConf 2016, where experts in open source systems will take the stage to share projects, practices, and programs with you.

In anticipation of this year’s event, we’ve asked several of our speakers how and why they contribute to open source, their creative processes, and how to drive change within an organization. Check out their responses below for some inspiration, and make sure to grab a ticket while they last.

Nadia Eghbal
Q: How do you see the open source industry and/or community evolving over the next few years?

“As open source hits the mainstream, we'll see deeper interest in the human side of things, with a focus on collaboration, improving workflows, and diverse skill sets like documentation and design.”

John Feminella
Q: What advice would you give to leaders who have been put in charge of driving open innovation at their companies?

“One of my favorite philosophical thought puzzles is the ship of ‘Theseus’. If you keep replacing different parts of a ship until everything is different than the original, at what point is it a new ship? A related but more relevant question for businesses is: how do you know you're making your ship better?

Innovation needs to be paired with a way of measuring or understanding the improvement that occurred. Otherwise it's probably only going to improve things by serendipity. And it can't be done in isolation: it needs to come from continuous improvement at all levels of the organization: engineering, functional business units, information security, IT operations, project management, testing, and so on.”

Anjuan Simmons
Q: Why do you contribute to free and open source software?

“I contribute to free and open source software because I believe in the principles of the original movement that sought to distribute publicly available source code under a license. Namely, that the most stable, secure, and flexible software can only come from a diverse community of developers and that the best practices of software development can only be distilled and distributed through the open collaboration of this community. Free and open source software is the best way to truly optimize software development.”

Cedric Williams
Q: What advice would you give to leaders who have been put in charge of driving open innovation at their companies?

“Create a pull request culture. Mentorship is driven by empathy, learning, and a need to share knowledge. Foster that in your organization.”

Emily Xie
Q: How does working with open source shape your ideas about what you like to create?

“The transparency of open source is amazing. With access to the underlying code, you are empowered with both the ability to understand how a given piece of open source software operates and to contribute back. Not only that but the learning opportunities are incredible; you can examine how a repository evolves over time in response to user feedback and gain exposure to the various coding techniques and styles of your peers—which of course inspires and informs what you yourself create with code.”

Mike McQuaid
Q: What advice would you give to leaders who have been put in charge of driving open innovation at their company?

“Open source everything you can. Ask what you can’t open source rather than the opposite. Start development in the open rather than open-sourcing large existing projects.”

About CodeConf LA

CodeConf LA is an annual three-day event dedicated to the open source community. This year’s conference is packed with sessions and celebrations focused on systems engineering projects, practices, and programs in the open source community. We'll explore topics ranging from systems programming practices to operating applications at scale across more than 30 sessions, lightning talks, and workshops.

For more information on workshops and for the complete CodeConf LA schedule, check out codeconf.com or stay tuned on Twitter.

Git 2.9 has been released

The open source Git project has just released Git 2.9.0, with a variety of features and bug fixes. Here's our look at some of the most interesting new features:

Faster and more flexible submodules

In the last release, we showed you how to use the --jobs=<N> option to fetch submodules in parallel, which can be a real time saver.

$ git fetch --recurse-submodules --jobs=4

Now you can also use the --jobs option when cloning or updating submodules:

$ git clone --recurse-submodules --jobs=4 ...
$ git submodule update --jobs=4 ...

If you always want submodules to be processed in parallel, you can set the submodule.fetchJobs config option. [source]

There are also some new conveniences for specifying how you want your submodule clones and fetches to behave. Git will now pass command-line configuration options down to submodules commands. So if you need to set a one-off variable for all of your submodule fetches, you can do so with git -c http.proxy=... clone --recursive. In the last release we mentioned how Git LFS can use -c config to speed up the initial checkout. Now it can apply the same trick to cloning submodules. Similarly, you can pass --shallow-submodules to git clone to have it make shallow clones of all of your submodules. [source, source, source]

Beautiful diffs

If you've used Git, you've probably looked at a lot of diffs. Most of the time the diff shows exactly what you did: changed some lines, added some new ones, or took some away. But because Git generates the diff only from seeing the "before" and "after" states of your files, sometimes the way it shows the changes can be pretty confusing. For example, look at this diff that adds a new loop to an existing function:

diff --git a/foo.rb b/foo.rb
index 64bb579..a2b5573 100644
--- a/foo.rb
+++ b/foo.rb
@@ -3,6 +3,10 @@ module Foo
   def finalize(values)

     values.each do |v|
+      v.prepare
+    end
+
+    values.each do |v|
       v.finalize
     end
 end

The author probably didn't write the loop as two out-of-order halves. But because the outer lines of the old and new loops are the same, it's equally valid to attribute the lines either way (it's tempting to say that the problem can be solved by always starting the added lines at the top, but that only fixes this case; you'd have the opposite problem if the new loop were added after the old).

In 2.9, Git's diff engine learned a new heuristic: it tries to keep hunk boundaries at blank lines, shifting the hunk "up" whenever the bottom of the hunk matches the bottom of the preceding context, until we hit a blank line. The result shows what the author actually wrote in this case:

diff --git a/foo.rb b/foo.rb
index 64bb579..a2b5573 100644
--- a/foo.rb
+++ b/foo.rb
@@ -2,6 +2,10 @@ module Foo

   def finalize(values)

+    values.each do |v|
+      v.prepare
+    end
+
     values.each do |v|
       v.finalize
     end

Ah, much better. This new heuristic is still experimental, and may change in the future, or even become the default. For now, you can enable it with the --compaction-heuristic option on the command line, or by setting diff.compactionHeuristic in your git config. [source, source]

But maybe the minutae of diff hunk alignment isn't your thing (it's OK, we all have our niche interests). Let's talk about colors.

You probably already know that Git can colorize its diff output, and you can even customize the colors yourself. But there are also scripts that will filter Git's output and change it even further. For instance, there's a diff-highlight script that will put an extra emphasis on the changed part of a line:

diff --git a/foo.rb b/foo.rb
index bff273..9741ad8 100644
--- a/foo.rb
+++ b/foo.rb
@@ -1,6 +1,6 @@
 module Foo

   def output
-    puts "hello, world!"
+    puts "goodbye, world!"
   end
 end

There are a few ways to make use of this script, but the simplest is to configure Git to filter your diffs whenever it's showing them in a pager:

$ git config pager.log 'diff-highlight | less'
$ git config pager.show 'diff-highlight | less'
$ git config pager.diff 'diff-highlight | less'

That covers almost everything, but there's one spot missing: diffs shown by the interactive patch-staging tool (you are using interactive staging, right?). In Git 2.9, you can now ask it to filter the diffs it shows through any script you like:

$ git config interactive.diffFilter diff-highlight

Phew, with that set you can avoid the horror of ever seeing an unhighlighted diff again. [source]

And if you really want to go nuts, check out the diff-so-fancy project, which plugs in in the same way. These diffs are so fancy, you'll pop your monocle.

Testing all the commits with rebase -x

If you're a neat freak when it comes to commit history, you may have used Git's interactive rebase. It's great for fixing commit messages, or squashing, splitting, or reordering commits. But at it's heart, interactive rebase is really just a recipe of instructions to follow: pick this commit, then squash that one, now edit the message on this one, and so on.

What many people don't know is that you can insert any command you like into the instruction sheet, and Git will run it at the appropriate time, stopping the run only if the command fails. This makes it perfect for testing each commit in a series. The rebase stops at the first buggy commit, allowing you to fix it, re-run the tests, and amend the commit before continuing. If your project does commit-by-commit review, polishing your commits like this (rather than lumping on bug fixes at the end) is a great way to be kind to your reviewers. Rather than complain about your bugs in the early commits only to find them fixed later on, they get to see more directly the changes you propose, in a logical flow that builds towards the final goal.

Of course, writing out exec make test for each commit in your instruction sheet gets pretty tedious. That's why git rebase supports a -x option to add it for each commit, and as of this release, -x implies -i. And because rebase already defaults to your @{upstream} tracking branch, testing a full branch is as easy as:

$ git rebase -x 'make test'
Executing: make test
  Result: OK
Executing: make test
  Result: FAIL
make: *** [test] Error 2
Execution failed: make test
You can fix the problem, and then run

        git rebase --continue

Oh no, a bug! We can fix it up and continue on our way:

$ hack hack hack
$ make test
  Result: OK
$ git commit -a --amend
$ git rebase --continue
Executing: make test
  Result: OK
Successfully rebased and updated refs/heads/your-branch.

And now our perfect result is ready to be shared. [source]

Git Tidbits (Gitbits? Tidgits?)

  • The git describe command gives a human-readable (but still uniquely identifiable) name to commits. In its --contains mode, it finds a tag that contains a given commit, which makes the names it generates a good shorthand for "about when did this commit get released?". Older versions of Git looked for the topologically "closest" tag, but this could sometimes produce counter-intuitive results when newer tags had been merged in. Git 2.9 has a new heuristic that is much easier to explain: pick the oldest tag that contains the commit, and describe the path between them in the shortest way possible. [source]

  • If you're a fan of ASCII art (and let's be honest; who isn't?), you'll be pleased to know that git log will now expand tabs in commit messages to account for its 4-space indentation. That turns messy and broken alignment like this:

    $ git log
    commit 8d7fca1d690ff2ffb678dc00fbca1954df5e5b90
    Author: Mu-An Chiou <[email protected]>
    Date:   Mon Sep 23 09:21:03 2013 +0900
    
             _____
             ╲    ╲
             │    │
             │    │                      ___________________________
             └─#──┘    ########           /                           |
               ##     ##~ ~ ~ ##       /                           |
             #####    ##########     <   My circuits are frazzled!  |
             #####    ##########       \                      |
              ###  #######╱╱#######     \___________________________|
               |  / ####╱╱ HUBOT ##\               .
            \/  ##╱╱########### \                   .
                ╱╱############   |                 .
                 #############  ###
                 #############  ####
                    ######      ####
                     ###     XX
                      ##
                      #
    

    into this:

    $ git log
    commit 8d7fca1d690ff2ffb678dc00fbca1954df5e5b90
    Author: Mu-An Chiou <[email protected]>
    Date:   Mon Sep 23 09:21:03 2013 +0900
    
             _____
             ╲    ╲
             │    │
             │    │                      ___________________________
             └─#──┘    ########         /                           |
               ##     ##~ ~ ~ ##       /                            |
             #####    ##########     <   I have expanded your tabs! |
             #####    ##########       \                            |
              ###  #######╱╱#######     \___________________________|
               |  / ####╱╱ HUBOT ##\                .
                \/  ##╱╱########### \               .
                    ╱╱############   |              .
                     #############  ###
                     #############  ####
                        ######      ####
                         ###         XX
                          ##
                          #
    

    Oh, and you can use it for serious things like tables and diagrams, too. [source]

  • Rename detection is now enabled by default for diffs. You may have heard that Git doesn't record renames. It's true! Git infers on the fly when a file has been renamed by looking for similarities between the contents of the old and new files. This feature, which has existed since the early days of Git, is now enabled by default. [source]

  • You can now specify a custom path for hooks. Git calls hook scripts to allow you to implement custom policy or actions when certain events occur. These hook scripts are found inside the .git directory of each repository, making them a pain to manage if you have a standard set of hooks for all of your repositories. Now you can store the hooks in one place and point all of the repositories at them with the new core.hooksPath config. [source]

  • The git-p4 tool can now map p4 users to Git identities, as well as record p4 job information in the commit messages. Thanks to git-p4 and other tools, you don't have to forego the joy of using Git as a client, even if the project you're working on uses Perforce (or SVN, or Hg, or CVS, or...). [source, source]

The rest of the iceberg

That's just a sampling of the changes in Git 2.9. Check out the the full release notes for the complete list.

CodeConf LA: the full lineup of sessions and workshops is now available

CodeConf LA June 27-29

From Rust and Raft to data and design, the full schedule for CodeConf LA is now live on codeconf.com. In addition to the main event, we are hosting hands-on, 90-minute workshops led by experts in InnerSource, Neo4j, and Git. Admission is included in your CodeConf LA pass, but space is limited—RSVP to save yourself a seat. If you don't have a ticket yet, pick one up today, and sign up for the workshop(s) of your choice.

Workshop topics

Transitioning to Innersource
June 27th 10:30-12:00pm, lead by Cedric Williams, PayPal
InnerSource applies the lessons learned from large-scale distributed open source projects to proprietary engineering. Benefits include increased delivery velocity, smoother collaboration, and higher-quality development.

This workshop examines the factors that keep software teams from collaborating effectively, explores the model of development used for Apache Software Foundation projects, and discusses ways to bridge the two approaches. You’ll learn practical guidelines and business justifications for building InnerSource practices in your organization, as well as some antipatterns to watch out for.

Experience with developing software in larger and/or older organizations and is recommended.

Demolitions and Dalí: Web Dev and Data in a Graph Database
June 27th 1:15-2:45pm, lead by Nick Doiron, The Asia Foundation
Neo4j is a NoSQL graph database based on links between records. This workshop uses Python code samples to walk through two real-world examples of linked data, including designing a graph database from scratch, for art and artists at the Museum of Modern Art, and analyzing demolition data by processing road network data from OpenStreetMap.

Dissecting Git’s Guts
June 27th 3:00-4:30pm, lead by Emily Xie, Recurse Center
How does Git work? We’ll use Git’s plumbing commands to dissect the underlying structures that constitute Git and discuss how it is essentially structured as a Merkle DAG.

In doing so, we’ll solidify our conceptual understanding of Git, exploring questions such as: How does Git store our information? What is at the heart of a branch? What is actually happening when you do a Git checkout? Or a reset? Why is data (almost) never lost in Git?

Details

Each workshop is 90-minutes long and will take place on June 27th, the day before CodeConf begins, at the W Hollywood’s rooftop Loft. Your CodeConf LA ticket grants you access to any of these sessions.

About CodeConf LA

CodeConf LA is an annual three-day event dedicated to the open source community. This year’s conference is packed with sessions and celebrations focused on systems engineering projects, practices, and programs in the open source community. We'll explore topics ranging from systems programming practices to operating applications at scale across more than 30 sessions, lightning talks, and workshops.

For more information on workshops and for the complete CodeConf LA schedule, check out codeconf.com or stay tuned on Twitter.

HTTPS for GitHub Pages

Millions of people rely on GitHub Pages to host their websites and millions more visit these websites every day. To better protect traffic to GitHub Pages sites, as well as to encourage the broader adoption of HTTPS across the internet, GitHub Pages now officially1 supports HTTPS for all <username>.github.io sites. HTTPS provides a layer of encryption that prevents others from snooping on or tampering with traffic to your Pages site.

You can now visit *.github.io sites using HTTPS and configure HTTPS enforcement for your site. With HTTPS enforcement enabled, any HTTP requests to your github.io site will be transparently redirected to HTTPS.

GitHub Pages HTTPS

Starting next Wednesday (June 15, 2016, 12pm PDT), HTTPS enforcement will be required for all new GitHub Pages sites. To enable HTTPS enforcement for your existing *.github.io site, visit the settings page for your site's repository. Check out the Pages HTTPS documentation for more information.

1 You have been able to request Pages sites over HTTPS for some time, but we refrained from officially supporting it because the traffic from our CDN to our servers wasn't encrypted until now.

Celebrate Pride with GitHub

Celebrate Pride with GitHub

Pride month is here, and we have a few LGBTQ-focused festivities lined up to celebrate. This year, we're hosting our annual Pride party, releasing brand new Pridetocat t-shirts, and marching in the San Francisco Pride Parade.

T-shirts

This year's special edition Pridetocat and Transtocat shirts will hit the OctoShop on June 20. With 400 sold, last year's tees raised more than $10,000 in proceeds donated to Lesbians Who Tech, Maven, and Trans*H4CK. We hope you'll enjoy the new shirts just as much and help us support grassroots LGBTQ organizations working in the Bay Area.

Party

Date: Monday, June 20
Time: 5:30pm-9:00pm
Location: GitHub HQ

Celebrate Pride with us at GitHub HQ. Meet up with old friends, make new ones, and learn about some of the great things happening in the LGBTQ community at our annual Pride Party. You can swing by to purchase a Pridetocat t-shirt, learn about the ways GitHub is being used to benefit the LGBTQ community, and hear from a few speakers to be announced later this month.

This event is open to all LGBTQ-identified folks and allies. Register to join in.

Patchwork

Date: Wednesday, June 22
Time: 7:00pm-10:00pm
Location: GitHub HQ

Learn Git and GitHub at a special LGBTQ edition of Patchwork. No coding experience is needed to participate in this free, hands-on workshop with support and talks from GitHubbers and special guests from the LGBTQ community. Everyone is welcome to join.

Register now or take a moment to learn more about our Patchwork events.

March

Date: Sunday, June 26
Time: 10:30am-end
Location: Downtown San Francisco

This all culminates in the annual San Francisco Pride Parade on Sunday, June 26. This year, we are so excited to march in the Pride Parade along with our friends at Salesforce to support our LGBTQ Hubbers and to celebrate San Francisco's diverse community. We hope to see you all there!

Improvements to Notification Emails

We've rolled out several changes to our email notifications. Now you have more ways to filter your email notifications and each email will contain more information about why you received it.

Updates to the footer

image 2016-05-26 at 2 15 55 pm

The footer of every email now indicates why you've received a specific correspondence. It contains the same subscription reasons that are available on GitHub.com—for example, whether you or your team were directly mentioned.

If you no longer want to follow a thread, you can mute any new conversations directly from the email. (Note that this will only work for email clients configured to receive HTML emails).

Notification reason as the CC email address

image 2016-05-26 at 2 13 45 pm

In addition, the same notification reasons exist as a CC email address. This should help with labelling and filtering emails you receive for services like GMail and iCloud that don't support filtering by our X-GitHub-Reason header.

Our Help documentation provides a full list of the subscription reasons.


We hope these changes enhance your email notification experience!

Let’s talk systems at CodeConf LA: June 27-29, 2016

CodeConf LA is happening next month

We’re welcoming the open source community to Los Angeles for three days of talks, workshops, and festivities. CodeConf LA is approaching fast, so grab your ticket or donate one today.

Theme

This year’s event will focus on systems engineering projects, practices, and programs in the open source community. Together, we’ll delve into the technical components and cultural aspects of systems—from maintaining critical infrastructure projects to teaching the next generation of systems engineers.

Sessions

June 27: A full day of workshops on using Innersource, Git internals, and graph databases
June 28-29: More than 25 featured sessions, lightning talks, and speaker Q&As

Over the course of the conference, there will be back-to-back talks exploring different subjects from contrasting perspectives, followed by a chance to participate in the conversation with other attendees.

Speakers

This year’s event rounds up more than 20 speakers from across the open source community—including developers, designers, and data technicians from Mozilla, the US Department of Commerce, and IBM. We’re also welcoming featured speakers:

  • Michael Bernstein, Vice President of Community at Code Climate
  • Josh Aas, Executive Director at Let’s Encrypt
  • Nadia Eghbal, Founder and Venture Capitalist
  • Kelsey Hightower, Developer at Google
  • Mitchell Hashimoto, Founder and CEO at HashiCorp

Stay tuned for a more detailed speaker schedule, which we'll be rolling out over the next few weeks.

Venues

CodeConf is accessible from both LAX and BUR airports and is just around the corner from the Hollywood/Vine LA Metro stop. Parking is available but limited so we recommend taking a taxi or rideshare to the venue.

Conference Venue: Avalon Hollywood
1735 Vine St, Los Angeles, CA 90028
CodeConf LA will be held at Avalon Hollywood in Los Angeles, one of Hollywood’s most historic landmarks, a five-minute walk from both the Hollywood/Vine Metro Stop and the W Hotel.

Hotel: The W Hollywood
6250 Hollywood Blvd, Hollywood, California, 90028
Just a five-minute walk from the conference venue, the W Hollywood is situated on Hollywood Blvd, under the shadow of the iconic Hollywood sign.

Gatherings

Afterparty: Hyde Sunset Kitchen
8117 Sunset Blvd, Los Angeles, CA 90046
Last year we saw live music at Nashville’s Country Music Hall of Fame. This year we’re playing pub trivia, enjoying delectable dessert bites by Top Chef Chris Crary, and making conversation around the patio firepit.

Tickets

Tickets to CodeConf 2016 are on sale for $399 and include access to all workshops, sessions, and the afterparty. Get your tickets today, or learn more about the event at codeconf.com. See you in LA!

Drag-and-drop tasks in Markdown task lists

You can now move checklist items around just by dragging and dropping them. Reorder items quickly and easily without editing the original comment's Markdown.

re-order

How to re-order task list items

Create a task list item using - [ ] at the start of a new line. When you hover over the left-hand side of an item's checkbox, you'll see the option to drag and drop it into a new location.

Learn more from our our documentation.

Mission Report: GitHub Satellite

satellitepanorama

On May 11 in Amsterdam, over 500 developers converged at GitHub Satellite to share and hear stories about open source, enterprise software, engineering best practices, and more. In case you missed it, here are some highlights and findings:

We kicked off the day with a session by GitHub CEO Chris Wanstrath, who shared a few brand new developments from around the GitHub Universe.

Unlimited Private Repositories

One of the very best things about Git and other distributed version control systems is the ability to create a new repository without asking permission or getting approval. While this has always been true for our public plans, it hasn’t been the case for individuals and teams working together in private. All of that changed with the introduction of unlimited private repositories into all of our paid plans. For detailed information on pricing changes, check out this blog post.

Electron 1.0

Electron 1.0 represents a major milestone in API stability and maturity. This release allows you to build apps that act and feel truly native on Windows, Mac, and Linux. Building Electron apps is easier than ever with new docs, new tools, and a new app to walk you through the Electron APIs. Check out the full write-up of the new release here.

11 05 16 wgf github -6676

All of the talks from the general sessions, as well as the Discover and Develop breakouts will be available to view soon, so keep your eye on Twitter..

GitHub Satellite would not have been possible without the support of our excellent sponsors, who provided delicious food, juice, coffee, and beautiful art installations for our enjoyment. Thanks to IBM, Heroku, Travis-CI, CircleCI, waffle.io, and Apiary.

The GitHub Universe continues to expand—join us on when we return to Pier 70 in San Francisco for the second annual Universe Conference, September 14-15.

Multiple assignees on Issues and Pull requests

Issues and pull requests often need to be assigned to more than one person. Multiple Assignees are now supported, allowing up to 10 people to be added to a given Issue or Pull request.

Using multiple assignees

Assignees can be added and removed on the web UI by clicking on the assignees dropdown in the sidebar and adding multiple users.

multipleassignees

Check out the documentation for more information on this feature.

Diversity and Inclusion at GitHub

At GitHub our goal is to help everyone build better software. To do that, we know we must create a company where anyone, regardless of what they look like or where they come from, can grow and thrive. When we deliberately seek different perspectives, life experiences, and identities, we can build better products for developers all around the world.

Over the past 18 months, diversity and inclusion have become a major focus for us. We’ve learned how diversity of life experiences makes a big difference in how we identify and solve problems, design software, and communicate. Today, we’re releasing our diversity data for the first time to show where we’ve made progress, where we haven’t, and to be transparent about how much further we have to go. We will also provide updates annually and share lessons we learn along the way.

This journey started for us in 2014, after we made some major mistakes and people got hurt. We were forced to re-evaluate our culture and our goals. We had to ask ourselves hard questions about where we fell short.

We started by looking at our own demographics—and they weren’t good. Our diversity was nowhere near industry standard, which is already too low. We also asked what we needed to do to make GitHub a place where everyone can do their best work, then started making changes.

So far, we’re seeing early signs of progress. For example, GitHub has grown from under 1% women of color at the end of 2014 to over 10% today. We’ve increased the number of women in leadership roles to 35% while the number of women overall has grown from 21% in 2014 to 36% today. Of our US employees, 6% are Latino and more than 1% of Hubbers identify as transgender, genderqueer, or nonbinary. We are proud that these are all growing segments of our company.

Still, we are falling short in obvious ways. There are no Black/African-American GitHubbers in management positions, which is unacceptable. Diversity in technical roles lags behind our overall organization. Our gender imbalance remains. And we still have a lot of work to do to ensure we are building an inclusive culture.

Specifically some of the areas we’re focusing on are:

  • Improving our recruitment processes to find candidates from all backgrounds, ensure that they meet a diverse slate of interviewers, and improve our hiring and onboarding practices so they are inclusive.

  • Institutionalizing our long-held belief that formal education is only one of many paths to success at GitHub and in tech overall. We want to hire great people based on their skills, which can be obtained in a multitude of ways.

  • Providing training for all Hubbers on building emotional intelligence, mitigating bias, and interpersonal communication as critical pieces of building inclusive culture.

  • Expanding our benefits to include transgender health care, fertility treatments, and ensuring that our maternity/paternity leave policies exceed the tech industry’s norms.

  • Modifying our San Francisco office to be more accessible. We’ve always intended our headquarters to be welcoming to our community by hosting events and are currently making changes to make it more inclusive. Hopefully we’ll see you here someday in the future.

  • Building partnerships with organizations that are successfully removing barriers to entry in tech like EveryoneOn, CODE2040, and Maven. This is a deliberate investment in the future workforce of our industry and in those who will increasingly use GitHub to build amazing things.

In looking at our data and the areas we're focusing on, there's a lot to be hopeful about—but we still have so much further to go. We are just at the beginning of making substantial changes and seeing their results.

I’ve personally learned a great deal over the past few years. One huge lesson for me has been learning that everyone has the potential to be a great developer, but not everyone has the opportunity. That's something we want to fix in our company and our community, and I invite you to join us in doing so.

I’ve also learned that increasing diversity isn’t a short term project but a lifelong journey. We want our company to reflect our world and I look forward to sharing updates on our progress with you in the future.

View the report

Repository invitations

Beginning today, repository admins must invite you to their repository and you must accept the invitation before you can start collaborating. Repository invitations let you decide whether or not you want to join as a contributor.

Collaborating with other developers is one of the best parts of open source on GitHub, but getting there hasn't always been a happy journey. Previously, anyone could automatically add other developers to their repositories without explicit permission. This model openly provided some users with opportunities to harass members of our community by inviting them to offensive or attention-seeking repositories.

New invitation acceptance page

With repository invitations, every GitHub user can accept or decline requests to collaborate on someone else's repository. Should those invites go too far—due to spam or malicious content—you have the option to block the user sending them. Blocked users cannot invite you, fork your repositories, or comment on your activity.

Repository invitations are a big step forward in providing you with more control of your experiences on GitHub. We're excited to encourage more positive and respectful interactions between our users and look forward to future opportunities to further improve our community.

Learn more about repository invitations and contact support with any questions or feedback.

GitHub Pages now runs Jekyll 3.1

As promised, GitHub Pages has moved to the Jekyll 3.1 branch with an upgrade to Jekyll 3.1.6. Jekyll 3.1 brings significant performance improvements to GitHub Pages. By using Liquid::Drops, rather than Ruby Hashes, Jekyll now calculates document and site metadata on demand, rather than calculating every possible value at build time.

While this should be a seamless transition for most GitHub Pages users, we recommend that all users test locally using the GitHub Pages Gem before pushing. This ensures that your site will continue to build as expected. Three things to note as you upgrade:

  1. All front matter defined in layouts are now accessible only via {{ layout }}. In you define a variable width: full in your layout's YAML front matter, access it with layout.width.

  2. The inheritance of front matter values properly merges a child layout's front matter over its parent's front matter. If you define a variable color: purple in a layout called post which has a parent layout of default, and you define color: blue in the default layout, then {{ layout.color }} will be purple. For more on this, read the pull request that made the change.

  3. If you are using the Jekyll Bootstrap theme, you must update the contents of _includes/JB/setup to use {{ layout.theme.name }} instead of {{ page.theme.name }}.

Beyond the performance improvements, Jekyll 3.1.6 includes over 100 changes, including many bug fixes, both to the rendering process and to the experience of previewing Jekyll locally.

For a full list of changes, see the Jekyll changelog and of course, if you have any questions, please get in touch with us.

More contributions on your profile

Earning green squares on your contribution graph means celebrating the work you do in open source and public projects. Starting today, you can also celebrate the work you do in private by sharing anonymized contributions from private repositories.

GitHub contribution graph settings

We think including your work in private repositories is a more accurate representation of your contributions, but your privacy is important too. Private contributions are not shown by default and, when enabled, are completely anonymized to the general public. You can opt into sharing your private contributions in your profile settings. Details of the issues, pull requests, and commits you have made on private repositories are only visible to your fellow repository collaborators.

As part of this update, code streaks are no longer featured on your contribution graph. The simplified interface focuses on the work you're doing rather than the duration of your activity.

Now that every paid plan includes unlimited private repositories, you can experiment all you want in private and still add to your contribution graph. For more information, read our help guide for toggling private contributions on your profile.