Making a KB article that discusses this space and the relationship between the University spaces and departmental spaces

[dlstrong]

Here's an email exchange that Andy asked to bring here instead.

My first email:
Hi, Git-friends! When working with a cross-campus team the other day and wondering about the interaction of access and permission rules for the campus-wide GitHub organization in relation to the departmental orgs, I did what a lot of folks have been trained to do and searched GitHub on the Knowledge Base.

It turned up one article, and that one article was about the Tech Services-specific GitHub space.

When I’m logged in, I can see an “internal” AITS article about how to add new organizations to the University-wide instance – but that wasn’t the question we had, and it wasn’t visible when I was logged out, meaning that people from departments who don’t use the KB would never find it.

What are the chances of getting a public-facing, overarching GitHub “what’s where” page in the Knowledge Base, so that there’s a public-facing and Google-available page that explains things like:

• GitHub offers many different organizations.
• There’s a University-wide organization and also several departmental organizations.
• If you’re a member of a departmental GitHub organization, you [are / aren’t] automatically a member of the University-wide one.
• If you’re a member of the University-wide organization, you aren’t automatically a member of a separate departmental one unless you’ve also connected the GitHub administrator for that department.
• Here’s a list of the departmental GitHub organizations we know of.

Sound feasible?

---

Andy's reply:
I’d rather keep our university specific orgs and repositories internal to the university for security reasons. Further, GitHub access is only for internal to the university people. What would be the purpose of telling the world what our GitHub organizations are? There are security reasons we wouldn’t want to do that. I see no problem doing this internally though.

There is a community organization, https://uillinois-community.github.io that is used for discussion like this. I’d like to move this discussion there since it’d have more visibility than an email. Thanks.

---

My reply to that:
Keeping our GitHub orgs and repos internal is different than making a KB article about their existence. Yes, this GitHub org is only for people who are internal to the university, and yes, I am totally cool with keeping the org itself that way - but there is a TON that people who are internal to the university don't know about its existence and its usage and the org interrelationships.

And if you put all of the information about that behind a login in a place that half the university doesn't know needs to be logged into and can't log into if they aren't members of a specific KB organization anyway, then there's no way for even University members to find out what they need to know about its existence.

The University is big enough that there needs to be a public-facing and Google-findable entry point, and a whole lot of Help Desk folks are trained to search the KB as their first stop for information about a thing. I'm not sold on the idea that "security by obscurity" is helpful to anyone when the thing being obscured is "documentation about how to understand the relationships between the University GitHub org and other departmental GitHub orgs."

(There's no way I would have found this specific discussion location if Andy hadn't given me a direct link to it, and I already know about the University GitHub organization and am already a member. For people who think that Wade Fagen-Ulmschlager's space is still as close as we get to a University-wide organization, putting all the differing information under lockdown in places that you don't know exist and may not be able to log into isn't going to help with that discovery process.)

What does the rest of the community think about this debate?

[argherna]

Keeping our GitHub orgs and repos internal is different than making a KB article about their existence.

Agreed. But it's outside the scope of any of the existing organizations to document. The Governance committee can take a lead here.

I'm not sold on the idea that "security by obscurity" is helpful to anyone when the thing being obscured is "documentation about how to understand the relationships between the University GitHub org and other departmental GitHub orgs."

Nothing is being obscured. There are security controls in place for each organization that keeps private orgs/repos private. Anyone can visit any org in GitHub and see what is publicly available. The Governance committee can take a lead here to talk about how this documentation ought to be delivered. The KB is a great place for Urbana for sure. UIS & UIC would have to give their feedback on how best to avail their documentation.

Thanks for your feedback.

[jtgorman]

Hi Dena,

I agree with you, more information needs to be publicly accessible in the places people actually look. A public-facing summary of some of the basics, or for starters even just pointing to https://web.uillinois.edu/github , would be helpful. I'm willing to volunteer some of my time at least to help make that happen, although that might not get done quickly ;).

As far as some of the relationships of license, departments, and organizations, below is my current understanding. Which is kind of fuzzy to be honest. I've not been on the committee the whole time....and I'm definitely not one of the experts ;).

There's a University-wide license "institution" or top-level organization. Not sure what the right terminology is for that. This is an umbrella for all of the organizations associated with the University accounts, like this forum, or the UIUCLIbrary one for example. Some of these were existing organizations brought into the license, some were newly created by AITS.

There's still some Github organizations and accounts that are affiliated with the University, but have not yet been brought into the fold, so to speak.

Here's the oddity that I still don't quite have my own head wrapped around. Any university member (github account that can 2FA w/ one of the supported identity providers) can essentially "invite" themselves into any of the organizations that are using the University license if they know the Organization name.

Org owners need to make sure repositories that need to be more tightly controlled have access limited to certain teams or individuals and the repository needs to be "private". There's also a somewhat confusing "Internal" level, which is actually to the wider UofI organization.

There's been talk within the Governance committee on how to start tackling some of this and I'm pretty sure we're up to the challenge, as long as we pace ourselves like a marathon ;).

Jon Gorman
Library IT

[edthedev]

Currently searching 'GitHub' on the University KB finds two articles, both security job aids written by my team:

https://answers.uillinois.edu/illinois/search.php?q=github&cat=0

I love the idea of a new KB article that gives at a few links:

All departments and employees within the U of I System now have access to a shared, enterprise wide, GitHub license. Visit University of Illinois Shared GitHub Service for details, and to get started.
The community of GitHub users at the University maintain the University of Illinois GitHub Portal with helpful resources for campus GitHub users. Please also consider joining the University of Illinois GitHub Community Discussions.

[edthedev]

Update: Here's the new KB article: https://answers.uillinois.edu/illinois/129281

At GitHub Governance group today we discussed and approved adding this stub to the Knowledge Base. I will go ahead and get it added.

[edthedev]

Please feel free to message me via this thread "@edthedev" for any updates to that KB article - or if another member of the GitHub governance group needs to take over maintenance. I doubt that will come up since this should just be a stub pointing to the real resources, but I'm happy to make corrections as needed.