In a surprising twist, Microsoft has reportedly turned to its cloud rival, Amazon, for extra computing power after a string of AI-related outages (via Business Insider).

Microsoft acquired GitHub for $7.5 billion in 2018. The company promised to take good care of GitHub, empower developers at every stage of the development cycle, and more. However, recent developments suggest otherwise.

Perhaps more concerningly, GitHub's own blog has detailed how the service has been failing to meet its own service level agreements (SLA). Before he departed from the platform, Ghostty developer Mitchell Hashimoto kept a close eye on every GitHub issue that interfered with his workflow, citing 90.21% uptime, which is way below GitHub's stated SLA of 99.9%.

However, GitHub CCO Kyle Daigle indicated that the company is actively working to address these issues. GitHub used to run on its own data centers, but following Microsoft's acquisition, the company planned to move the service entirely to Azure by 2027.

As AI becomes more prevalent and advanced, more software engineers and programmers are leaning more on the technology to write code faster, which has seemingly contributed to the platform being overwhelmed with new code. Consequently, it has strained the platform's compute resources.

For context, GitHub processed 1 billion commits in 2025. However, COO Kyle Daigle said the platform’s commit records, a proxy for development activity, are on pace to reach 14 billion in 2026, a sharp jump from last year’s total

"To handle this surge in activity, Microsoft is adding extra computing capacity via Amazon Web Services," Business Insider indicated, citing two people familiar with the plans.

Speaking to the outlet, a Microsoft spokesperson confirmed that GitHub is seeking additional compute capacity from third-party cloud providers, but didn't comment about its arrangement with Amazon:

"The incredible spike in agentic development that began late last year has tested our infrastructure's limits. To meet this demand, Microsoft is both accelerating our move to Azure and continuing to explore a multi-cloud strategy to ensure we have the future capacity, compute elasticity, and horizontal scale required to support continued growth."

Amazon declined to comment directly, but noted: "Customers choose AWS for its global infrastructure that delivers reliable, secure, and efficient performance at scale. We remain committed to providing the best results for every workload."

Elsewhere, shareholders have filed a class action lawsuit against Microsoft, alleging the company deliberately overstated Copilot’s success and its partnership with OpenAI. They also contend Microsoft failed to disclose Azure’s revenue slump while pouring billions into expanding AI data center infrastructure.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

Earlier this month, security sleuth and researcher "Chaotic Eclipse" (also known as Nightmare-Eclipse) published a zero-day exploit known as YellowKey, which allowed them to access BitLocker-protected drives on Windows 11 with a simple USB key. "Just can't come up with an explanation besides the fact that this was intentional. Also, for whatever reason, only Windows 11 (+Server 2022/2025) is affected; Windows 10 is not," they explained.

Last week, Microsoft publicly acknowledged awareness of the security feature bypass vulnerability in Windows. It further disclosed that it is tracking the YellowKey zero-day exploit under CVE-2026-45585 and shared mitigation measures to prevent it from gaining unauthorized access to protected drives. "The proof of concept for this vulnerability has been made public, violating coordinated vulnerability best practices," the company added.

After claiming that a backdoor into Windows 11's BitLocker is by design, the security sleuth's GitHub account has since been banned by Microsoft over unspecified reasons, forcing them to transition to GitLab (via Tom's Hardware).

Interestingly, it appears that the company deleted Chaotic Eclipse's Microsoft account, which they had used to report the bugs. Eclipse described Microsoft's actions as "vindictive." In a detailed blog post, they indicated: "So let me get this straight, when I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people."

"You defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot."

"Now you take the courtesy to flag my GitHub account and wipe it out of the public, just like that? You are proving to everyone that you actively escalating this conflict but I'm done begging you."

"I might sound like crazy idiot who is whining around but I have proof for every single word I said, I just can't release it yet. Why? Microsoft still has chains in my hands; it's been like this for years, and I just can't stay silent anymore. I hope I can release the documents soon."

"Mark this date, July 14th, I will make sure your bones are shattered that day. Nothing will be released this June (or maybe I will release smtg, depending on circumstances)."

The bone of contention between the security sleuth and Microsoft seems to stem from unpaid bounties from the MSRC program. Nightmare-Eclipse indicated that Microsoft gave a deaf ear to their communication attempts and that they "got zero pennies from doing so."

Microsoft's MSRC (Microsoft Security Response Center) program pays between $30,000 to $100,000 for per endpoint zero-day, depending on the conditions. The figure could shoot to $250,000 if you can bypass Hyper-V.

Microsoft considers several factors when rewarding security researchers for disclosing critical vulnerabilities, including the severity of the issue, the ease of reproduction and weaponization, and the overall quality of the report — from clear documentation to a working proof-of-concept.

As such, it seems that Eclipse could be implying that Microsoft ignored and refused their zero-day reports. Another scenario would be that the company refused to pay the bounty to the security sleuth, who has already uncovered six zero-day exploits.

When publishing the YellowKey zero-day exploit, Eclipse indicated that they "could have made some insane cash selling this, but no amount of money will stand between me and my determination against Microsoft."

But as it now seems, Eclipse might be planning a more sinister and concerning vendetta against Microsoft on July 14:

"Mark this date July 14th, I will make sure your bones are shattered that day. Nothing will be released this June (or maybe I will release smtg, depending on circumstances)," the researcher added. This seems to be a response in their blog post claiming, "[they were] told personally by [Microsoft] that they will ruin my life and they did", that there's a dead-man switch of some sort, and that they "will make sure [Microsoft's] bones are shattered."

To that end, Microsoft has remained silent on the matter, leaving me to wonder whether Eclipse’s claims hold true or if the researcher simply failed to meet the MSRC program’s exact requirements for receiving a bounty reward on critical vulnerability disclosures. I'll keep a close eye on this situation as it unfolds, update this story, and follow up with any new details to keep you in the loop.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

Microsoft's ability to acquire successful companies and then destroy them needs to be studied. Today, we're talking about GitHub.

Microsoft acquired GitHub in 2018 for a hard $7.5 billion in stock, and it was already met with huge amounts of skepticism from the community.

GitHub remains the largest source code hosting platform in the world. Software companies of all shapes and sizes depend on the platform, from hyperscalers to hobbyists, and it arguably changed the way open source software became distributed online.

GitHub's independent, open-source nature seemed at odds with the cold corporatism of Microsoft, and users were immediately concerned that Microsoft would ruin the platform over time. As we approach the acquisition's 10-year mark, those users are increasingly looking like they might've been on the money.

Github's maddening outages are becoming memeworthy, albeit with real consequences

In recent times, the most noteworthy sign of GitHub's downward trajectory revolves around platform stability.

GitHub's own blog has been detailing how the platform is failing to meet its own service level agreements (SLA), but one of the platform's most legendary contributors has been keeping their own tally. Ghostty developer Mitchell Hashimoto began keeping a journal of everyday GitHub issues that prevented him from working. His tracking showcases a pretty dismal 90.21% uptime, far below GitHub's stated SLA of 99.9%.

There have been other issues and bugs, too, with code commits mysteriously vanishing into the void. GitHub CCO Kyle Daigle addressed angry customers last week to explain the situation, but users aren't convinced.

Ghostty is a very popular terminal emulator, developed via GitHub for almost two decades. The emulator is renowned for its performance-first design and has been a staple of GitHub for many years, until this past week.

In a large post that has now gone somewhat viral, Ghostty developer Mitchell Hashimoto announced he's leaving the platform. It has become something of a visible inflection point for the platform. It prompted a groveling apology from GitHub's CCO in response, who said, "I'm sorry. The team is going to keep working to make GitHub something you can come back to with real proof."

In his blog post, Hashimoto expressed frustration and lamentation for the platform he'd dedicated "half of his life" to.

"Lately, I've been very publicly critical of GitHub. I've been mean about it. I've been angry about it. I've hurt people's feelings. I've been lashing out," Hashimoto explained. "GitHub is failing me, every single day, and it is personal. It is irrationally personal. I love GitHub more than a person should love a thing, and I'm mad at it. I'm sorry about the hurt feelings to the people working on it."

I've felt this way for a long time, but for the past month I've kept a journal where I put an "X" next to every date where a GitHub outage has negatively impacted my ability to work. Almost every day has an X. On the day I am writing this post, I've been unable to do any PR review for ~2 hours because there is a GitHub Actions outage. This is no longer a place for serious work if it just blocks you out for hours per day, every day."

Hashimoto's departure isn't the only major player to exit stage left, either. Upcoming programming language Zig also announced it is migrating to competitor Codeberg last year, calling GitHub's engineering culture "rotted."

"Priorities and the engineering culture have rotted, leaving users inflicted with some kind of bloated, buggy JavaScript framework in the name of progress. Stuff that used to be snappy is now sluggish and often entirely broken."

Github's downward trajectory continues Nadella's streak of screwing up core Microsoft pillars

Why is this happening? Much like with Xbox and Windows, it seems to be related to ... you guessed it! Artificial Intelligence.

Microsoft's investment infrastructure revolves entirely around chasing artificial intelligence of late, with vast internal fears that Microsoft may miss the boat on another major computing paradigm shift — as it did with smartphones in decades past.

Microsoft has been investing mammoth amounts of capital into AI workflows, and has, in fact, been migrating GitHub as an entity more closely to its CoreAI division.

With more and more of Microsoft's attention, infrastructure, and code being written by hallucination-prone artificial intelligence platforms, Microsoft seems to be chasing AI investor hype at the cost of quality and customers.

Indeed, Xbox has recently posted groveling apologies for the state of the platform in recent weeks. Windows 11 has as well, pledging to re-focus on feedback and quality. Hell, even Microsoft-owned World of Warcraft has been laden with bugs and server problems as of late.

This can't all be a coincidence, in my view. If there's one thing that has come to define Satya Nadella's tenure at Microsoft, it's this: degraded quality.

Was there ever a time when Microsoft would reinvest profits back into its business? Perhaps I'm misremembering, but one thing is for sure: sending all of the cash to artificial intelligence platforms seems to be doing a number on Microsoft's core services more than ever. And more than ever, it seems completely unsustainable.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

Microsoft may have committed to reducing microslop in Windows 11, but the tech giant seemingly forgot to CC GitHub about the initiative. A software developer named Zach Manson shared that Copilot injected an ad into a pull request on GitHub.

According to Manson, one of their team members used Copilot to correct a typo in a pull request. Copilot did fix the typo, but it also added an ad for Copilot and Raycast in the pull request description.

"⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast," reads the pull request. Text preceded by an emoji is a common trope that appears within content generated by Copilot.

Manson said of the addition, "This is horrific. I knew this kind of bullshit would happen eventually, but I didn't expect it so soon."

An investigation by Neowin sheds light on what likely caused the text to appear. While the message mentions Raycast by name, it appears Copilot is the tool injecting the text.

Searching for the phrase that appeared in Manson's pull request shows over 11,000 instances of the same text in pull requests on GitHub.

The markdown of pages with that text include the phrase, "START COPILOT CODING AGENT TIPS." It appears Copilot is adding "tips" to pull requests that promote the AI tool.

There is also a chance that Raycast is the culprit here. Raycast has a Copilot extension which could inject text promoting Raycast and Copilot.

Martin Woodward, Vice President of Developer Relations at GitHub explained on X that Copilot was able to add product tips to pull requests on GitHub, but that the behavior has since been disabled following feedback.

GitHub's controversial connection to AI

The Microsoft-owned GitHub is connected to AI in several ways, some of which are genuinely useful. GitHub Copilot can improve productivity, help find bugs, and streamline the development process.

But the tool was trained partly on code hosted in GitHub, which upset some users. Microsoft has updated its GitHub Copilot usage policy to specify that inputs, outputs, code snippets, and associated context in GitHub will be used to train Microsoft's AI models.

That change will affect Copilot Free, Pro, and Pro+ users (business and enterprise users are unaffected).

There is an option to opt out of having GitHub data train Microsoft's models.

Ironically, if Copilot injects ads into pull requests and then GitHub data is used to train Microsoft's AI models, we'll see AI being trained on AI.

That loop can be dangerous. In the early days of Google Bard and Bing Chat, the AI tools made it look like I shared fake news by listing my article as a source, despite the fact my report claimed the exact opposite of what the AI tools claimed.

If AI feeds AI, drift can occur. Without proper grounding, mistakes can perpetuate and shift into further error.

Maybe we'll see a future in which AI promotes ads by accident after it has been trained on code samples that include injected ads.

What's an ad anyway?

Martin Woodward, Vice President of Developer Relations at GitHub, shared a statement with Windows Central regarding the tips added to GitHub pull requests:

"GitHub does not and does not plan to include advertisements in GitHub. We identified a programming logic issue with a GitHub Copilot coding agent tip that surfaced in the wrong context within a pull request comment. We have removed agent tips from pull request comments moving forward."

I believe Microsoft and general users disagree on the definition of an ad. Even when admitting that the tips suggesting Copilot appeared in pull requests, Woodward referred to the text as a "coding agent tip."

As noted above, the phrase, "START COPILOT CODING AGENT TIPS" appears in a search of pull requests 11,000 times. If you define that type of tip as an ad, GitHub already includes thousands of ads.

Even Woodward's statement has a different tone than his X post on the topic. Woodward said "the beaviour became icky" on X and added that they "disabled product tips entirely thanks to the feedback."

The fact that Microsoft could "disable product tips entirely" suggests that the feature was something the GitHub team knew about and could work on, even if the exact way it appeared in pull requests was deemed "icky."

I expected that the definition of an ad would come into play with this story, so I shared a poll about the topic in the original version of this piece. Early voting shows that the vast majority of participants believe the tips are ads, though the poll has a small sample size at the moment.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

GitHub Copilot, however useful it may be, ruffled some feathers when it emerged given that it was trained partly on code hosted on GitHub already.

Fast forward to 2026, and the Microsoft-owned platform is back for another round, though this time it is at least being forthcoming about it.

In an update to the GitHub Copilot usage policy, interactions with the AI tool will be used to train AI models beginning on April 24, 2026. The good news is that you can opt out if you want no part in it.

From the GitHub announcement post:

"From April 24 onward, interaction data—specifically inputs, outputs, code snippets, and associated context—from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out. Copilot Business and Copilot Enterprise users are not affected by this update."

Unsurprisingly, business and enterprise users will not be subject to these changes, only us mere mortals. More specifically, GitHub will be using this data to train AI:

• Outputs accepted or modified by you
• Inputs sent to GitHub Copilot, including code snippets shown to the model
• Code context surrounding your cursor position
• Comments and documentation you write
• File names, repository structure, and navigation patterns
• Interactions with Copilot features (chat, inline suggestions, etc.)
• Your feedback on suggestions (thumbs up/down ratings)

There's the whole spiel about how this aligns with industry standard practice and how real-world data will make the models smarter. But it should also be noted that GitHub may share the collected data with affiliates, including Microsoft.

Should you decide this isn't for you, especially given the open-source nature of a sizeable quantity of GitHub-hosted projects, you will be able to opt out. If you don't use GitHub Copilot at all, then you won't be feeding any further data to the great AI machine in the sky, but you'll still have the same option to say "no thanks."

Head into your GitHub settings and you'll find the option under Privacy. If you've done this previously to opt out of GitHub collecting data, you should already be set, but it's worth checking anyway.

It's another timely reminder also that none of these AI models can exist without us. Without real people producing real material to feed into the engine, they're nothing. Policies like this wouldn't come into play if AI could train itself, would they?

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

I spend a lot of time on GitHub. Not so much making things, because I'm a duffer when it comes to coding. But I love poking around and finding interesting open-source software that those much cleverer than I have made.

I like open-source software so much because it always feels like it was made by people who actually care about what they're making and the people using it. GitHub, of course nowadays owned by Microsoft, is a great place to find it. But it can be a bit overwhelming when there's so much.

I've recently stumbled across an Android and Windows app called GitHub Store which makes discoverability much better. It turns GitHub into a sort of app store on your smartphone, and I can already tell it's going to occupy a lot of my time.

GitHub Store is a simple idea that makes so much sense on mobile

For as much time as I spend on GitHub I rarely use the official mobile app. It's not that it's bad, more that most of what I'm looking at is more relevant to Windows and Linux desktops.

Having found GitHub Store (which, as you'd expect, is available on GitHub) I can already see that I'm going to be finding much more for my Android phone.

It's laid out exactly as you'd expect any app store to be. The front page has tabs for trending projects, hot releases, and most popular to get you started. You don't have to log in with your GitHub account, but you'll be rate limited unless you do.

But for mobile apps made available on GitHub, this app is superb. You can search by platform, so if you're looking for something on Windows, you can still do that, but you can also exclude desktop and just look for mobile-compatible repos.

Otherwise, you can download and install the apps just the same as you would from any other source on Android, with additional options.

Downloading from GitHub directly means you don't get auto-updates as you would on the Play Store, but you can go from GitHub Store to another app called Obtainium, which will help you get those updates direct from the source.

The only real issue I see right now is Google's impending clampdown on apps being installed on verified Android devices from developers that haven't signed up to its official program. I'm not here to debate that, though for what it's worth, I think it's utterly stupid.

Bonus feature: There's a Windows version, too.

While my own primary enjoyment of GitHub Store so far has been on my phone, there is a version of it for Windows, too.

It's the same exact principle, except by default it'll show you desktop-friendly projects in its category tabs rather than mobile ones.

But the added discoverability you get over the GitHub website, I won't lie, is a big plus. I could see this becoming part of my daily rotation as I poke around looking for the next great piece of software I didn't know I needed.

It's a nice-looking app, too, on both mobile and desktop. I like the default font, but you can make it use your system font if you wish. And there are some basic theming features to make it look a little more how you want it to.

Ultimately, GitHub both is and isn't an app store. It's much more than that, but it's a phenomenal source of software. The thing you didn't know you needed is probably lying among its millions of repos, somewhere.

GitHub Store merely gives the platform a more user-friendly front end when you're not interested in hosting your own projects. And I'm definitely here for it. Grab it for yourself from its GitHub repo now.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

GitHub Copilot recently gained support for OpenAI's latest coding model, GPT-5.4, designed for more complex development tasks, with improvements to reasoning and multi-step problem solving.

Its arrival also comes shortly after its rival Anthropic introduced its latest coding model, Claude Opus 4.6, which launched exactly one month before GPT-5.4. For users, both GPT-5.4 and Claude Opus 4.6 are available to those on Copilot Pro, Pro+, Business, and Enterprise plans.

One notable difference between the two appears to be the context window. GPT-5.4 offers up to a 400k context window, compared to the 192k available with Claude Opus 4.6, potentially making GPT-5.4 better suited to working with larger codebases.

GitHub Copilot with GPT-5.4 is available across a wide range of development environments, including Visual Studio Code, Visual Studio, JetBrains IDEs, Xcode, Eclipse, GitHub.com, GitHub Mobile, and GitHub CLI — I’ll be honest, I only knew a couple of those different coding environments even existed.

OpenAI’s GPT-5.4 rolls out to GitHub Copilot users

If you didn't know, GitHub Copilot is Microsoft’s AI-powered coding assistant. It uses various large language models (LLMs) to help developers complete a range of programming tasks. The tool is built directly into coding environments to suggest code as you type, help explain existing code, and assist with other common development tasks.

To put it simply, GitHub Copilot can act like an autocomplete system for coding. It reads the context of what a developer is writing and suggests the next line of code or even entire functions; however, some users use it to build entire apps without much human input (vibe coding).

🗨️ Would you try GPT 5.4 in GitHub Copilot?

I won’t get into the semantics around whether this is good or not; instead, I’ll just focus on delivering the news here, because AI drama can be quite tiring, regardless of my personal views on the matter.

AI coding tools are evolving fast; whether we like them or not, they are becoming a big part of developer workflows. Some people use them freely, whilst others prefer to do things the traditional way.

Have tools like GitHub Copilot become part of your workflow, or do you still prefer coding without AI assistance?

Let us know in the comments, and help me gauge your interest with a poll.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

In a particularly surprising turn of events, OpenAI is reportedly now developing a coding repository platform to rival the Microsoft-owned GitHub. According to The Information, this decision was prompted by a sudden rise in service disruptions affecting GitHub and its users.

The project still appears to be in its early development phase, so it could be several months before it reaches any kind of broad availability. According to sources with close ties to OpenAI and knowledge of this initiative, the ChatGPT-maker plans to offer the service for purchase to its customer base.

It could represent a broader strategic effort by OpenAI to diversify its portfolio and expand new avenues for revenue generation. Market analysts and experts recently claimed that investor interest in AI in general is waning as top research labs struggle to establish a clear path to profitability.

In January, reports claimed that OpenAI could burn through $14 billion chasing the AI bubble, setting itself up for bankruptcy by mid-next year. Despite the billions the company is pouring into advanced AI development, there are little to no returns to show, with most of the resources spent on infrastructure expansion, model training, research hiring, and general compute costs.

💬 The Microsoft-OpenAI partnership is somehow even more complicated

Last week, OpenAI raised $110 billion from Amazon, NVIDIA, and SoftBank in its latest round of funding, which pushed its market capitalization to $730 billion. While Microsoft didn't participate, it indicated that it had no impact on its partnership and relationship with OpenAI and would continue to collaborate across multiple fronts, including research, engineering, and product development.

This news comes as OpenAI has seemingly become the latest target on social media after it accepted the deal that Anthropic rejected, which gives the U.S. Department of Defense access to its AI models and technology for massive surveillance and autonomous weapons.

That led to a “Cancel ChatGPT” trend going viral, with app uninstalls surging by 295%, while Anthropic’s Claude AI climbs to the top of the U.S. App Store. However, OpenAI CEO Sam Altman indicated that his company is amending the deal with the Pentagon amid backlash and privacy concerns. He admitted the deal was "opportunistic and sloppy."

What do you think about the current state of Microsoft's partnership with OpenAI? Share your thoughts in the comments.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

Microsoft may have just created a new term, though I doubt it would want credit for the feat. The tech giant "morged" a diagram as part of a "careless" and "blatantly amateuristic" attempt to rip off a graphic created over a decade ago.

Vincent Driessen, a software engineer, playfully claimed that Microsoft "morged" his diagram after it was discovered AI was used to poorly plagiarize a graphic.

"Bugfixes from rel, branch may be continvoucly morged back into develop" read the diagram that appeared on the official GitHub page that explains GitHub Flow.

That diagram has since been removed, but you can find it on the Internet Archive.

Driessen, who detailed the saga in a blog post, first shared a diagram about a Git branching model over 15 years ago. He later published the source file, allowing people to expand on the diagram.

The software engineer was happy to have the diagram reused and expanded upon and shared with attribution in blog posts, wikis, YouTube videos, and elsewhere in the name of sharing knowledge. What surprised Driessen was that Microsoft used AI to recreate a worse version of the diagram and shared that graphic without mentioning Driessen at all.

"The AI rip-off was not just ugly. It was careless, blatantly amateuristic, and lacking any ambition, to put it gently. Microsoft unworthy," said Driessen. "The carefully crafted visual language and layout of the original, the branch colors, the lane design, the dot and bubble alignment that made the original so readable—all of it had been muddled into a laughable form. Proper AI slop."

Morged is not the first AI-related slang to be connected to Microsoft. The term "Microslop" trended on social media earlier this year. Perhaps Microsoft should form a partnership with Urban Dictionary to keep track of the slang. Maybe integrate Urban Dictionary with Copilot?

AI tools often struggle with generating text. Even when given explicit instructions to include certain characters, generated text often looks janky. "Typos" are common as well, if that term can be used when typing is not involved.

Oh god yes, Microsoft continvouclymorged my diagram there for sure 😬

— @nvie.com (@nvie.com.bsky.social) 2026-02-19T16:00:24.665Z

The GitHub page's inclusion of the graphic gained traction on social media. Scott Hanselman, Vice President of Developer Community at Microsoft, replied to Driessen on Bluesky.

Hanselman stated that it appears an "overzealous vendor" created the graphic. The VP promised a post-mortem that will try to determine what happened and expressed the need for guidelines and guard rails to be put in place to prevent similar incidents in the future.

Understood. Not trying to sweep under rugs, but I also want to point out that everything is moving very fast right now and there’s 300,000 people that work here, so there’s probably be a bunch of dumb stuff happening. There’s also probably a bunch of dumb stuff happening at other companies

— @scott.hanselman.com (@scott.hanselman.com.bsky.social) 2026-02-19T16:00:24.531Z

Hanselman stuck around in the thread for a while responding to questions and comments about the situation. His last comment on the thread states that "Sometimes it’s a big systemic problem and sometimes it’s just one person who screwed up."

I agree with Driessen's statement that this situation is disappointing. The engineer said,

"I find this whole thing mostly very saddening. Not because some company used my diagram. As I said, it's been everywhere for 15 years and I've always been fine with that. What's dispiriting is the (lack of) process and care: take someone's carefully crafted work, run it through a machine to wash off the fingerprints, and ship it as your own. This isn't a case of being inspired by something and building on it. It's the opposite of that. It's taking something that worked and making it worse. Is there even a goal here beyond "generating content"?"

Driessen also highlighted that his diagram was well-known and that the ripoff was poorly made and clearly generated by AI, so people flagged it. There are many pieces of plagiarized, AI generated content that will go unnoticed.

Share your thoughts on Microsoft's use of AI

Do you view Microsoft's use of AI in this case as plagiarism? Should anything be done to prevent this type of use?

Let me know in the comments section!

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

While I don't have any objections, per se, to Copilot, I do think it's a little overwhelming. It seems to be everywhere, but in so many forms, and it can feel a little invasive.

What I'm more interested in is a system-wide AI tool that's there when I need it, and disappears when I don't, without overloading me with information or taking up all my screen space.

What I want is something along the lines of this third-party tool built by Hayden Barnes, which taps into GitHub Copilot (you will need a subscription) and does so in an effective and elegant way.

It's simply called GitHub Copilot Taskbar GUI, and among its range of features is a native WinUI 3 interface with all the lovely translucency you could shake a stick at. It sits in the system tray when not in use, always there but out of sight when you don't need it.

It also has automatic context detection for open applications and currently visible windows, background services, and active window focus.

Barnes has shown off a range of examples on X of the tool in use, such as knowing about a running Docker instance, interacting with WSL, summarizing text shown in an image file that's open in File Explorer, and even knowing details on who the original PM was for Windows Terminal.

Naturally, this is designed to hook into GitHub Copilot, which has a different purpose than regular Copilot. But it's exactly the type of AI assistant I'd want to use on my Windows 11 PC.

Copilot is getting more useful in recent times, with features like Vision, and as an AI chatbot, it remains a strong performer.

But for me, I've evolved beyond just wanting this type of experience. If I'm using AI, I want to use it across everything on my PC but not take up too much of my focus. The Copilot app can be left open in the corner or system tray with Quick View, but it's still too big and distracting.

That's what I like most about GitHub Copilot Taskbar GUI. You don't need to share your screen — as you do with Copilot Vision — and it looks 100% like it's part of the OS without dominating the desktop or constantly catching my eye. Simplicity, sometimes, is the winner.

Projects like this give me faith that if Microsoft doesn't do it, someone else will. If you want to check out Github Copilot Taskbar GUI for yourself, you can grab it from GitHub right now.

For decades, Notepad has been a staple in the Windows ecosystem. From its origins as a simple text editor, it has lately been picking up a lot of new features, including Copilot integration.

Considering the current climate around Microsoft's forced AI integration into Windows 11, it's understandable that not all of these Notepad features are appreciated by Windows fans.

I'm always on the lookout for alternative apps to try out, and my latest search led me to an open-source and free Legacy Notepad project on GitHub. Created by user ForLoopCodes, it promises a classic Notepad experience that's less demanding than the standard Windows 11 version. The creator says it was made "because Microsoft won't stop adding AI bloatware to notepad.exe."

The creator shares a screenshot of two Task Manager instances, one with their Legacy Notepad creation running at 2.1MB of memory usage and 0% CPU usage, and the other with Windows 11's Notepad.exe running at 52.3MB of memory usage and 0.5% CPU usage.

Here's a list of the features available in Legacy Notepad, pulled from the project page.

• Multi-encoding text: UTF-8, UTF-8 BOM, UTF-16 LE/BE, ANSI with line-ending selection.
• Rich editing: word wrap toggle, font selection, zoom, time/date stamp, find/replace/goto.
• Backgrounds: optional image with tile/stretch/fit/fill/anchor modes and opacity control. (known issues)
• Printing: print and page setup dialogs.

The creator shared an update on X on January 29, noting that it was their first project to cross 150 stars. At the time of my writing, it has now hit 249 stars on GitHub, signaling that it's definitely gaining some traction among users.

Why is Microsoft's Notepad falling out of favor among Windows users?

In February 2024, Microsoft announced it was integrating Copilot AI with Notepad. Its initial integration was an "Explain with Copilot" tool, but it has picked up additional features over time, including text rewriting and content generation, tables, and Markdown support.

Microsoft wants Notepad to be more user-friendly with these tools, but many users prefer the classic, clean, distraction-free experience. While you can sort of get the classic Notepad experience back by disabling some AI features, it's still not what it used to be.

The backlash from Windows users has been severe enough that Microsoft is reportedly reevaluating its AI push in Windows 11. As our Senior Editor Zac Bowden explains, "sources say sources say Copilot integrations like those found in Notepad and Paint are under review."

I know that a lot of users have made the switch to Notepad++, but it too can be a bit overwhelming if you're just looking for basic text editing tasks. If that's your scenario, Legacy Notepad might be just what you need.

Are you happy with the current state of the Notepad app in Windows 11? Why or why not? Let me know in the comments section!

Microsoft has been an ever present partner in Formula 1 (F1) for quite some time now, but from 2026 the company is switching partners.

Having been initially with Lotus back in 2012, and more recently the latest iteration of that team, Alpine, the 2026 season sees Microsoft beginning a new, multi-year relationship with Mercedes-AMG.

Beyond having the Microsoft logo proudly displayed on this year's car, what else does this partnership actually involve? Shocking precisely nobody, AI (and Azure).

It looks like an extension of tools Mercedes has already been using, and is one of the industries that AI makes a ton of sense. F1 teams have an insane quantity of data to crunch through, and deploying AI to make it easier just sounds like a no-brainer.

Cloud tech through Azure and AI isn't where it ends, though. Mercedes will also be further leveraging Microsoft's GitHub to "modernize and accelerate development workflows."

Microsoft has been getting some flack of late for its obsession with AI, but personally, my own critique has been that there's never much to show why people should care.

Admittedly, none of us will be running out to start an F1 team any time soon, but this is one of those times that AI truly makes a difference. It's capable of crunching far more data, faster, than any human being ever could.

F1 lives and dies by data. Sure, the drivers are the ones piloting the cars, but without the mountains of sensor information crunched in real-time, it's like driving with a parachute pulling them back.

Maybe we'll be seeing the Microsoft logo back on the podium this year. Here's hoping.

There's lots of stream crossing goes on in the world of generative AI, and this latest is a Google model being added to a Microsoft product.

Subscribers to GitHub Copilot premium tiers, including Pro/Pro+, Business, and Enterprise, now have access to Google Gemini 2.5 Pro, the company's best model to date.

"Gemini 2.5 Pro is now generally available to GitHub Copilot customers. The latest Gemini model from Google is their most advanced model for complex tasks. It shows strong reasoning and code capabilities. It also leads on common coding, math, and science benchmarks."

Gemini 2.5 Pro is available now to users of premium accounts in all of the places you can use GitHub Copilot. From VS Code to the mobile app via Xcode, and all stops in between.

But what about those who only use a free account, what can they do? If you're using GitHub Copilot free, there's an argument to be made that you should use something else, anyway. But that's for another time.

There is a way you can use Google Gemini if you wish, including accessing Gemini 2.5 Pro, without having to have a paid account.

Enter Gemini CLI and Gemini Code Assist

Google has its own open-source command line tool, Gemini CLI, built for developers, as well as the Gemini Code Assist extension for VS Code (and others). You can use both for free, logged in with a personal Google account via OAuth, and with extremely generous request limits.

Gemini CLI allows you to choose either Gemini 2.5 Flash or Pro, though does warn that you could be knocked back to Flash if you reach quota limitations. This is no different to using Gemini on the web with a free account. This was from Gemini CLI directly:

"Keep in mind that if you are on the free tier with a personal Google account, the CLI might automatically switch from Pro to Flash due to quota limitations. For more consistent access and higher usage, consider using API keys from Google AI Studio or Vertex AI with usage-base billing."

The Code Assist VS Code extension uses "Gemini 2.5" but there's no specificity beyond that in the documentation. And if you ask it what model it's using, it still seems to think it's using Gemini 1.0!

For local codebase awareness, you get a context window of a whopping 1 million tokens. When using agent mode in Code Assist or Gemini CLI, individuals get a combined quota of 60 requests per minute, and 1,000 requests per day.

With such generous limits for free users versus GitHub Copilot, I'm not sure why you wouldn't give Gemini a shot. Admittedly, I'm very much on beginner level status, but it seems really good to use, too. Copilot Free only allows for 50 chat messages per month, which compared to Google's tool, is outrageous.

Code Assist supports MCP, has the advantage of Google web search functionality and the ability to be aware of multiple files at once. It's not always fast, and Copilot has the advantage of native integration, but for a free tool, it's hard to complain.

To learn more on Gemini CLI head on over to its GitHub repository. Code Assist is available from the Extensions marketplace on VS Code and other supported platforms.

I have to say, though, I'm a little disappointed with how limited GitHub Copilot seems to be, and not just for free users. I spoke to a subscriber to a paid tier on social media that seems to be more limited, despite paying, than using Gemini's free tools.

I know Microsoft is deploying Copilot everywhere, and definitely wants to make a bundle of cash out of it, but in this arena at least, it looks like there are better value alternatives.

GitHub CEO Thomas Dohmke just shared that he will step down from his role. The popular development platform will have more than a new CEO soon; it will be part of a new organization at Microsoft.

GitHub will now be part of Microsoft's CoreAI team. The resignation of Dohmke marked the end of GitHub operating as a separate company.

The CoreAI division, announced earlier this year, is led by Jay Parikh, former Vice President and Global Head of Engineering at Meta. One of the division’s key focuses will be expanding GitHub Copilot’s capabilities.

Dohmke shared the following on LinkedIn:

"After nearly four years as CEO, I’m leaving GitHub to become a startup founder again.

With more than 1B repos and forks, 150M+ developers, and Copilot continuing to lead the most thriving market in AI with 20M users and counting, GitHub has never been stronger than it is today. ✨

Thank you to Satya Nadella, Julia Liuson, so many countless people, and most importantly, thank you to all Hubbers for the ride of a lifetime. 🎢❤️"

An internal post sent to GitHub employees, lovingly known as "Hubbers," was later shared publicly by Dohmke.

"My startup roots have begun tugging on me and I’ve decided to leave GitHub to become a founder again," said the CEO. "GitHub and its leadership team will continue its mission as part of Microsoft’s CoreAI organization, with more details shared soon."

Microsoft purchased GitHub for $7.5 billion in 2018. The company shared at the time that "GitHub will retain its developer-first ethos and will operate independently to provide an open platform for all developers in all industries."

But plans are always subject to change. GitHub ran independently for almost seven years while owned by Microsoft.

Dohmke will remain at GitHub until the end of 2025 to help with the transition.

AI coding

During his tenure, GitHub grew to have over 1 billion repos and forks. Over 150 million developers now use the platform.

Part of Dohmke's legacy will be GitHub Copilot, which currently has 20 million users. The CEO discussed how GitHub Copilot has evolved "from a simple, but magical autocompletion tool to conversational coding with Copilot Chat & Voice."

GitHub Copilot is an AI coding assistant designed to help developers work faster and more efficiently. The assistant can suggest code, help with pull requests, and review code.

Back in May, Microsoft shared that GitHub Copilot use increased four-fold year-over year.

Microsoft CEO said in April that AI writes "maybe 20%, 30% of the code that is inside of [Microsoft's] repos."

Tech giants, including Microsoft and OpenAI, have focused heavily on improving AI tools for developers. The latest model from OpenAI, GPT-5, is said to be significantly better at coding than its predecessor.

AI coding is a hot topic in the tech industry. Salesforce CEO Marc Benioff said the company is debating hiring software engineers this year due to advancements in AI coding capabilities.

Meta CEO Mark Zuckerberg said that AI may "effectively be a sort of mid-level engineer" that writes code for companies.

Microsoft co-founder Bill Gates said that coders are one of the only professions that are safe from being replaced by AI.

Dohmke was interviewed by The Verge's Alex Heath for Decoder earlier this month. In that episode, Dohmke said AI coding is "here to stay" and discussed competition for AI coding tools.

Dohmke could help create some of GitHub's competition when he founds his next startup, though he has not shared details on future plans at this time. He still has over four months at Microsoft, so it may be a while before we find out about his new startup.

Microsoft CEO Satya Nadella recently shared that as much as 30% of code in Microsoft's repos is probably written by software. And it appears Microsoft developers are far from the only people using AI to code.

According to the most recent Microsoft quarterly report, over 15 million people now use GitHub Copilot. That figure marks a 4x increase year-over-year and indicates a strong interest in using AI to optimize development.

During the Microsoft FY25 Q3 earnings conference call, Nadella touched on the success of GitHub Copilot.

"We are evolving GitHub Copilot from pair to peer programmer. With agent mode in VS Code, Copilot can now iterate on code, recognize errors, and fix them automatically," said Nadella.

"All-up, we now have over 15 million GitHub Copilot users, up over 4X year-over-year," the CEO added.

"And both digital natives like Twilio and enterprises like Cisco, HPE, SkyScanner, and Target, continue to choose GitHub Copilot to equip their developers with AI throughout the entire dev lifecycle."

Those remarks came as part of a call filled with good news for Microsoft investors. The company had yet another record quarter and beat expectations. Revenue was up 13% year-over-year to a total of $70.1 billion in the quarter.

Microsoft also saw a surge in the usage of several services. Intelligent Cloud, which includes Azure, grew 21% year-over-year. Xbox content and services also grew 8%, which was driven in part by PC Game Pass growing 45% year-over-year.

What is GitHub Copilot?

GitHub Copilot is an AI coding assistant designed to help developers. The tool allows people to code faster and with less effort, according to Microsoft. The tech giant states that with GitHub Copilot, developers can focus more on fixing issues and working together.

You can use GitHub Copilot in an Integrated Development Environment (IDE), in GitHub Mobile, and in Windows Terminal Canary. The tool is also available on the command line and on the GitHub website.

GitHub Copilot can make code suggestions, create descriptions of changes within a pull request, and review code. A GitHub doc outlines all the features of the tool.

AI coding

As AI grows in popularity and usage, many debate its effectiveness and whether automation will replace jobs. Salesforce CEO Marc Benioff shared that the company is debating hiring software engineers in 2025 because of the advancements of AI. Meta CEO Mark Zuckerberg has previously discussed the potential for mid-level AI engineers to claim coding jobs.

Microsoft co-founder Bill Gates has said that AI will replace humans for most things, though he specifically said coders, energy specialists, and biologists will be safe from being replaced by AI.

OpenAI CEO Sam Altman is interested in having AI make coders 10 times more efficient.

Microsoft's 2024 Work Trend Index report suggested that many executives would not hire someone without AI aptitude.

As we wait to see to what extent AI will replace human jobs, it's clear that AI tools are being used by developers. At least 15 million of those developers are doing so through GitHub Copilot.

GitHub is arguably the largest platform for programmers to sync, share, and collaborate on code. Microsoft acquired the web-based platform in 2018 and has revolutionized it with nifty features designed to enhance its functionality, including the integration of Copilot.

GitHub Copilot has gained popularity among developers due to its unique user experience, which includes code suggestions, support for programming languages such as JavaScript, Python, and TypeScript, and autocompleting code. To that end, GitHub Copilot was previously limited to paid users, which can cost up to $39/month.

Microsoft recently introduced a new free tier for the service dubbed GitHub Copilot Free. The free plan offers more functionality to occasional users who might not need to leverage the service's capabilities regularly.

It's worth noting that the service's capabilities are fairly limited. For instance, the free plan (integrated into VS Code) allows access to 2,000 completions/month, 50 messages/month, Copilot Chat in GitHub, and Block suggestions matching public code. However, you need a GitHub account to access the free plan.

The free tier ships with access to Anthropic’s Claude 3.5 Sonnet or OpenAI’s GPT-4o model, which can explain code or identify bugs. According to Microsoft:

"You can execute edits across multiple files. And you can access Copilot’s third-party agents or build your own extension."

Following the launch of the new free plan, Microsoft has indicated that the free access to unlimited Copilot Pro accounts for students, educators, and open-source maintainers will continue running as usual and will remain unaffected. Elsewhere, Microsoft announced that GitHub recently hit over 150 million developers.

What you need to know

• Apiiro, a cybersecurity firm, reported that GitHub has suffered a massive attack that could impact thousands of people. 
• This attack involves cloning safe and clean repositories, adding malicious, obfuscated code, and reuploading them. 
• GitHub is trying to delete the malicious repositories but can't seem to track them all. 

In a recent report by Apiiror, security research and data science teams discovered a very large attack. Apiiro is calling it a malicious repository confusion campaign. The Apiiro teams estimate that over 100,000 GitHub repositories are affected, possibly even millions. Unfortunately, this isn't the first time we have had to report on GitHub being used by malicious actors. A few months ago, we discussed how GitHub is being used to facilitate ransomware and even create command and control channels for ransomware attacks. 

These attacks are not overly complicated nor are they hard to stop, the issue is that the attacks are happening at such an alarming pace GitHub seems to be having trouble keeping up.  

What are repository confusion attacks? 

A GitHub repository is a place where a GitHub user can upload their code so it can be shared with the rest of the world. There are very popular repositories that are often searched for and downloaded by many people. In a watering hole attack, attackers download popular good repositories, add malicious code, "7 layer" "eep" ac"ord"ng" to Api"ro, and reupload them to GitHub with the same name. They then spread the fake version of the repository through social media, Discord, and other means to a targeted audience. These features indicate a watering hole attack that is very common in CyberSecurity. 

A watering hole attack involves cyber attackers targeting groups of users by infecting websites they frequently visit. The attackers patiently wait for users to navigate to these compromised websites and then redirect them to a malicious site to infect their computers, granting access to the organization's network.

Once these attackers reupload their malicious repositories, they use automation to fork them thousands of times. This tactic is pretty commonly used. A few years ago, I recalled a trendy music album by a renowned artist, and many people tried to download the album via Torrent. The file being circulated was malicious, though, and caused a lot of people to lose their data.

How do the GitHub malicious repositories infect your PC?

Apiiro and other cybersecurity firms are calling this a supply chain attack, and while that could technically be true, I think GitHub barely qualifies as a supply chain.  

A supply chain attack is a cyberattack targeting a trusted third-party vendor or supplier. "It involves injecting malicious code into software or compromising hardware components to gain unauthorized access to a company's network or data," per Crowdstrike. 

Usually, a supply chain would need to come from a third-party vendor or supplier with access to your infrastructure and not a website that hosts code that might be used in a company's environment. 

 These attacks obfuscate the code, and Python is mainly used to carry out the attacks. Once delivery of the payload has occurred and the vulnerability has been exploited, the code uses BlackCap Grabber to perform actions on target and send the stolen information to a command and control server. If you download a malicious GitHub repository, these things could be stolen or done on your PC. 

• Browser passwords, cookies, and browsing history
• System information
• Login credentials from apps and tools such as Steam, MetaMask, and Exodus
• It will also attempt to bypass TokenProtector
• Hijacking the Windows clipboard to alter cryptocurrency addresses, replacing its content with the attacker's wallet address (among other functionalities)

What can Microsoft do to make GitHub safe?

According to the report, "GitHub was notified, and most of the malicious repos were deleted, but the campaign continues, and attacks that attempt to inject malicious code into the supply chain are becoming increasingly prevalent."

This attack started in May of 2023 but has grown exponentially. This attack seems to be a whack-a-mole situation where GitHub will have to try to detect this code after it is uploaded and possibly once it's too late. As these attacks continue, more and more users could be infected. 

You probably can't rely on Microsoft and GitHub to keep you safe if you are a heavy GitHub user. Suppose you want to check if your PC is infected. Apiiro provided a VirusTotal graph with some of the malicious files discovered. If you want to check your PC for these files, that would be highly time-consuming.

Look for Python patterns in your PC environment that match these code strings:

• exec(Fernet
• exec(requests
• exec(_ _import
• exec(bytes
• exec(“””\nimport
• exec(compile
• _ _import_ _(“builtins”).exec(

The best practice is to run code in a sandbox to protect your primary PC. Look for any code communicating with social media platforms or crypto wallets. Be careful when downloading any code from GitHub until Microsoft can handle this issue. 

GitHub isn't the only cybersecurity issue Microsoft is facing. 

In the era of pervasive AI integration, Microsoft has a prime opportunity to prioritize internal security measures before expanding outward. Despite the advancements in AI, the indispensability of human analysts and engineers in frontline defense against cyber threats remains evident. As the cybersecurity landscape evolves, individuals interested in entering the field may find guidance valuable, such as our cybersecurity starter guide.

Microsoft has recently launched Security Copilot, a tool purported to enhance the performance of cybersecurity defenders. However, its effectiveness largely hinges on customer engagement, reflecting Microsoft's hands-off approach, a characteristic often associated with the company, notorious for its minimal investment in customer service. This ethos seems to extend to cybersecurity, where Microsoft's efforts appear mostly reactive despite regular maintenance and updates, such as Patch Tuesday.

GitHub, a subsidiary of Microsoft, has been exploited effectively by hackers, raising questions about the company's ability to leverage AI for defensive purposes. Nevertheless, if Microsoft can fortify its systems, including its OS, servers, and subsidiaries like GitHub, it can significantly reduce global breach incidents, benefitting all stakeholders.

What you need to know

• Advanced persistent threats (APTs) are always looking for ways to blend in with normal activity.
• By utilizing Microsoft's GitHub, a known good platform, to host malware or command and control techniques, APTs are finding more success.
• The Insikt Group, Recorded Future's threat research division, published a report on the increased malicious activity taking place through GitHub.
• While Microsoft is looking for every way to make money on Copilot, cleaning up GitHub would be an actual good use case that an LLM could likely achieve. 

With CES wrapping up, the entire corporate world is focused on AI and how it can make these corporations more money. There have been a lot of promises about how AI can facilitate a safer digital world, but I have yet to see much fruit from such talk. The Insikt group, the threat research team of Recorded Future, released a report today discussing how GitHub is increasingly used for malicious infrastructure by threat actors and Advanced Persistent Threats (APTs.)

This issue in and of itself is a problem and worthy of news, but it seems to me that this is the perfect opportunity for Microsoft to show the world what it can do. It reminds me of the cheating epidemic in games like Activision's Call of Duty Warzone. Activision had to make a bespoke machine-driven anti-cheat system called Ricochet, which repeatedly bans thousands of cheaters. Similarly, Microsoft should be looking to use Copilot to intelligently inspect, analyze, and verify every single piece of code uploaded to the extremely popular site GitHub, which it acquired in 2018. 

How are hackers abusing GitHub?

Microsoft is working on fixing its many cybersecurity woes. While hackers have been 'living off the land' in Windows for years, meaning using the programs and executables available on the operating system they gain initial access to, they are now finding similar success using trusted sites. Coined by The Insikt Group in their report, 'living off trusted sites' is similar to the well-known cybersecurity term 'living off the land.' Using trusted sites, these threat groups can bypass most enterprise controls and blend in with regular traffic, significantly increasing their effectiveness and anti-detection capabilities. 

If you're looking for an in-depth analysis of the GitHub issue and its prevalence, feel free to check out the Insikt Groups full report, but we have you covered for the cliff notes version. Sophisticated hackers, also called APTs, use GitHub for several essential infrastructure necessities to achieve an attack chain on a target. 

As the Insikt Group explains, threat actors are using GitHub to deliver payloads, meaning once they get initial access to a target machine, they will typically run a script to download a malicious payload to the host. This is the most common use case for GitHub, but some APTs are using it for C2, meaning they are sending and receiving commands from GitHub repositories and exfiltrating data to GitHub in some cases. 

The Insikt Group explains why GitHub is such a threat and so effective for threat groups as a delivery mechanism for their attacks. These are some of the advantages that GitHub gives to attackers. 

• No blocking of GitHub domains in most corporate networks, given its popularity among businesses and the fact that many of them rely on it. 
• Reduced operational overhead by simplifying the overall C2 server installation process by utilizing publicly endorsed TLS encryption. 
• Widespread practical experience with GitHub among malware developers, given its legitimate use cases beyond malicious activities. 
• Lower infrastructure costs by saving on typical hosting or registration fees. 
• High uptime as GitHub is designed to be highly available, with redundant servers and failover mechanisms.
• Minimal vetting to register new accounts on GitHub (for example, the absence of a requirement for a credit card during registration represents significant cost savings for sophisticated APTs, as creating untraceable financing and payment methods is time-consuming and introduces unnecessary complexity.) 
• Limited detection possibilities for service providers (especially with respect to human-controlled accounts.) 
• Tracing a threat actor upstream or identifying victims becomes more challenging when the threat actor uses an LIS. More specifically, if tracking efforts hinge on network traffic analysis, encountering an LIS becomes a major obstacle, making it difficult to distinguish malicious traffic from legitimate traffic, resulting in a virtual dead end in the investigation.
• Limited availability of tooling for threat modeling and little actionable threat intelligence specific to such infrastructure setups.

In my opinion, this is a pretty big black eye for Microsoft. People are comparing GitHub to Pastebin because of how insecure the site seems. Microsoft, of course, has integrated Copilot into GitHub. Still, I believe there should be a more significant focus on cleaning up the site before trying to integrate end-user AI solutions.

How Microsoft can use AI to clean up GitHub

While LLMs and AI generally have not mastered everything perfectly yet, it seems universally agreed that they have a good handle on coding and programming. ChatGPT helped code a game and was pretty adept at following instructions. That being said, it should be possible to use Copilot as a sort of content filter. Like how YouTube checks for inappropriate content, it should be able to run every piece of code uploaded to its platform in a virtual sandbox and analyze what the code is doing. If the code looks suspicious, it should be flagged for manual human review. 

Recorded Future shows how GitHub has been used maliciously in a real-world scenario. It is fascinating to see how Zscaler tracked a North Korean threat group's GitHub as they hosted malicious files on it and targeted several South Korean industries.

Overall, it's time for Microsoft to use Copilot/AI for improvements to its subsidiaries instead of constantly pushing consumer-focused solutions. It would take a significant workforce to clean up GitHub, which is likely why Microsoft has been so slow to do so, but with the help of AI, the task should be more manageable. 

Can Microsoft ever solve its security problems?

Microsoft is rolling out Security Copilot and has data that it is helping cybersecurity defenders perform better; however, as with so many things with Microsoft, this depends on the customer doing the work, and Microsoft is keeping a hands-off approach. 

Microsoft is known for not investing a lot in things like customer service, and that mentality seems to have rolled over to cybersecurity. Sure, they have engineers to keep things up and running, and they work to push updates for Patch Tuesday, but so much of what they do seems to be reactionary. With the tidal wave of AI integration into everything technology, it is the perfect time for Microsoft to start backing up its words and securing itself before looking outward to other enterprises. 

Something that doesn't seem to be changing throughout this news is that there is and will continue to be a need for human analysts and engineers on the frontlines to defend corporations from these malicious actors. If you are interested, check out our guide on how to get started in cybersecurity.

While Microsoft was responsible for leaking its plans for Xbox over the next several years, Sony's Insomniac was recently breached by a sophisticated threat group, and the damage done from that leak is hard to quantify. Suppose Microsoft can't keep its own house in order. In that case, it will be more difficult, as a company that sells cybersecurity solutions, to protect the enterprise clients that use Defender and other Microsoft security products. Suppose Microsoft can shore up its holes and weaknesses by hardening its OS, Servers, and subsidiaries like GitHub. In that case, it will drastically decrease the number of successful breaches worldwide, which is a win-win for everybody involved. 

What do you think about GitHub being used so successfully by hackers? Can Microsoft use AI to help moderate the code being uploaded to GitHub? Let us know what you think in the comments.

What you need to know

• GitHub has launched a new Copilot Chat feature in public beta.
• The feature is designed to help enhance developer productivity.
• Developers can leverage the tool's capabilities to identify messages.
• You can access it from Microsoft’s Visual Studio and Visual Studio Code apps.

At the beginning of this year, Microsoft began integrating generative AI across most of its products and services. As a result, Bing and Windows 11 now feature dedicated AI assistants (both called Copilot).

The company aims to enhance the consumer's user experience when interacting with these platforms, ultimately enhancing their productivity. Developers haven't been left out of this equation. GitHub Copilot has been available for a while now, designed to eliminate menial work, ultimately helping developers to write better code. 

And now, GitHub has debuted a new entry to enhance the coding experience further. The new Copilot Chat feature is designed to help developers with all their coding needs, though it's currently limited to a finite number of organizations since it's in public beta. 

Microsoft first discussed the new addition during its annual developer conference, Build 2023. The company further cited the importance of the feature and how it would let users code with natural language within Windows Terminal. Users can access it via Microsoft’s Visual Studio and Visual Studio Code apps.

Here are the key offerings the new Copilot Chat feature ships with, as highlighted by GitHub in the blog post:

• Personalized assistance. GitHub Copilot Chat offers context-specific support to developers. So, whether your engineers are stuck on a particular code snippet or need guidance on a specific programming concept, GitHub Copilot Chat is ready to help.
• Real-time guidance. GitHub Copilot Chat suggests best practices, tips, and solutions tailored to specific coding challenges—all in real time.
• Fixing security issues. GitHub Copilot Chat can make suggestions for remediation, helping to reduce the number of vulnerabilities found during security scans.
• Code analysis. Don’t know what a code block is supposed to do? Ask GitHub Copilot Chat. It can also break down complex concepts and explain code snippets.
• Simple troubleshooting. Trying to debug code? GitHub Copilot Chat not only identifies issues, but also offers suggestions, explanations, and alternative approaches.

The new feature can identify code in real-time as well as error messages. It's also worth noting that it's deeply embedded into the IDE.

Windows Central's take

There's been a rising fear of professionals losing their jobs to generative AI as highlighted in Microsoft's recent Work Trend Index report. And while this new chat feature is an incredible feat that will lead to faster turnaround times for tasks and the development of apps, more improvements and enhancements continue to be made on these platforms.

Over time, the tools will likely get smarter and expand their reach to the tasks that they can accomplish without the intervention of a professional like a developer. This leaves us with one important question, Is the professional's presence important in such an instance?

The FTC has already started probing the safety of AI-powered tools, specifically OpenAI's ChatGPT chatbot, to determine whether the company has broken consumer protection laws. To this end, the rules and regulations that can be used to govern the development of these tools are slim at best.

What you need to know

• Windows Terminal will soon feature GitHub Copilot.
• GitHub Copilot allows developers to chat with AI to receive recommendations and help identify errors.
• Microsoft is also experimenting with GitHub Copilot with AI in other developer tools, including WinDBG.

Windows 11 and Bing aren't the only Microsoft products to gain Copilots at Build 2023. The company also announced that GitHub Copilot will make its way to Windows Terminal, giving developers another way to work with AI.

Windows Terminal, which launched in 2019, became the default command line experience in Windows 11 last year. It supports tabs, panels, and a command line palette that makes it easier to find actions. You can also customize Windows Terminal with a profile icon and various color options. Now, it is the latest Microsoft product to integrate with artificial intelligence.

"Users of GitHub Copilot will be able to take advantage of natural language AI both inline and in an experimental chat experience to recommend commands, explain errors and take actions within the Terminal application.  We are also experimenting with GitHub Copilot powered AI in other developer tools like WinDBG to help you complete your tasks with less toil," said Microsoft Chief Product Officer Panos Panay.

ChatGPT, which uses the GPT-4 large language model (LLM), has earned quite a bit of praise for its versatility relating to development. The ability to communicate with natural language and ask questions makes the chatbot act like a smart assistant that can scan through seemingly endless lines of code to determine what's gone wrong. Those same advantages are now coming to Windows Terminal through GitHub Copilot.

GitHub's page about GitHub Copilot X explains how AI can aid developers:

"Context aware conversations with your copilot. If you're stuck solving a problem, ask GitHub Copilot to explain a piece of code. Bump into an error? Have GitHub Copilot fix it. It’ll even generate unit tests so you can get back to building what’s next."

Microsoft is also testing GitHub Copilot's AI features in other dev tools, such as WinDBG.

You can add your name to the GitHub Copilot Chat waitlist to try out the new features as they become available.

What you need to know

• Amazon has officially thrown its hat into the generative AI arena with the announcement of its own batch of tools, including a competitor for GitHub Copilot. 
• CodeWhisperer is a similar product in that it has been designed to help code writing with the power of AI suggestions. 
• Unlike Github Copilot, CodeWhisperer is free for personal use (at least for now) 

We all knew it was coming. After Microsoft and Google both debuted their own respective AI projects, up steps Amazon. One of its new tools is called CodeWhisperer and it's a direct competitor for Microsoft-owned GitHub's AI Copilot. 

There's one key area Amazon has completely one-upped GitHub, though. CodeWhisperer is (at least for the time being) free to use for individuals. GitHub Copilot requires a subscription which starts at $10 a month or $100 a year. That's a pretty big deal and is sure to prick up more than a few ears. 

So, what's it all about then? From the official announcement: 

"Trained on billions of lines of code and powered by machine learning, CodeWhisperer has the same goal. Whether you are a student, a new developer, or an experienced professional, CodeWhisperer will help you to be more productive."

"CodeWhisperer will continually examine your code and your comments, and present you with syntactically correct recommendations. The recommendations are synthesized based on your coding style and variable names, and are not simply snippets."

Initially you'll be able to use CodeWhisperer inside a selection of popular IDEs, including PyCharm and Microsoft's Visual Studio Code. Initially supported languages include Python, JavaScript, and Java. 

To get started with Amazon CodeWhisperer all you need to do is sign up for the preview, get a code and then use that code in the extension in your chosen IDE. Unfortunately, at the time of writing, the link to sign-up for the preview doesn't seem to go anywhere, but hopefully that'll be resolved soon. 

Either way, it's a genuine competitor to GitHub Copilot and the fact that individual developers can use it for free makes it extremely tempting. It's not as mature, yet, but eventually it will be. It'll be interesting to see if, or how, GitHub responds. 

What you need to know

• GitHub previously announced that its Atom code editor would be sunset from December 15. 
• All repositories will be archived, active support and package management will end. 
• Community forks such as Pulsar will aim to keep Atom alive. 

Back in the summer, Microsoft-owned GitHub announced it would be sunsetting the Atom code editor in favor of other products such as Visual Studio Code and GitHub Codespaces. And that day has finally arrived. 

There's many a joke to be had about Microsoft canceling products, but Atom, despite its popularity, was always a likely casualty. Its impact will forever be felt, though, as it was one of the foundations for the Electron framework. This, in turn, led to Visual Studio Code, the current big dog in the yard. 

Atom has always been an open-source project, though, and prior to its repositories being archived at least one community-led project of note has popped up with the intention of keeping the Atom fire burning for a while longer. If you're still using the official build of Atom, here's what you can expect after the December 15 archiving of its repositories. 

• Pre-built Atom binaries can continue to be downloaded from the Atom repository releases
• Atom package management will stop working
• No more security updates
• Teletype will no longer work

But while the door is closing on official development of Atom, 

Pulsar rises from Atom's ashes 

Microsoft and GitHub are obviously hoping that Atom users will migrate over to Codespaces and Visual Studio Code, but there's already at least one fork of note that Atom fans could think about migrating to. 

Pulsar is still in the very early stages, but at its core retains the same user experience as those familiar with Atom have come to enjoy. 

The project is still in its very early stages so might not be ready to become your full-time code editor just yet, but it's available on Windows, Mac, and Linux to try out right now. There's also a portable version that doesn't require a full installation if you just want to see where it's at. Find out more about Pulsar through its GitHub repository, and pour one out for the passing of Atom. It gave so much. 

What you need to know

• GitHub Universe, an event focused on cloud, security, community, and AI, was held this week.
• At the conference, GitHub announced several new tools for developers and programmers.
• One of tools in an experimental feature called "Hey, GitHub!" that lets you code with your voice.

GitHub Universe is a global developer event from Microsoft that focuses on cloud, security, community, and AI. Quite a few new tools and options were unveiled this week during the event, including AI tools, new collaboration options, and security enhancements.

A new feature for Copilot will let developers code by using their voice with VS Code. Programmers will be able to summon the tool by saying "Hey, GitHub!" and then get to work by speaking. The tool is an experimental feature within Copilot, which uses AI to write code. It's certainly time-consuming to hand-write, or speak, and format each character of your code, so an AI helper should speed up the process. Doubtless, Microsoft's investments in OpenAI and Nuance are being leveraged here to benefit developers. 

Since Hey, GitHub! is an experimental tool, it may never become a full-fledged product. But developers can sign up to try it now.

GitHub CEO Thomas Dohmke outlined everything new for the developer platform that was announced at GitHub Universe 2022. The highlights are listed below, but Dohmke's post goes more into depth on each topic.

GitHub Copilot

• Business over busy work: GitHub Copilot for business helps you increase developer productivity by 55% with AI-based coding suggestions.
• An experiment from GitHub Next: “Hey, GitHub!” enables voice-based interaction with GitHub Copilot, enabling the benefits of an AI pair programmer while reducing the need for a keyboard.

Collaboration

• Ready when you are: now, individual developers will get up to 60 hours of GitHub Codespaces for free every month to start building in seconds.
• Browsing made better: code search and code view enable you to rapidly search, navigate, and understand code, right from GitHub.com.

Planning and tracking

• Your organizational buddy: roadmap empowers you to keep an eye on the timing and progress of your work and share it with anyone.
• Markdown reimagined: Tasklists decomposes issues into tasks, converts tasks to issues, visualizes your relationships in GitHub Projects, and more—all in a polished, new UI.
• Projects in your pocket: Projects on GitHub Mobile brings the power of GitHub to the palm of your hand, enabling you to contribute and collaborate from anywhere.

Enterprise

• Enterprise in the cloud: with GitHub Enterprise Cloud, you get access to our newest features as soon as they’re released.
• Run with the best: GitHub-hosted runners give you access to more powerful compute resources, fixed IP ranges, and increased concurrency for your workflows.
• CI/CD migration made easy: GitHub Actions Importer gets you up and running faster by planning and executing migrations from your former CI/CD tool to GitHub Actions.
• Fine-grained goodness: organization admins now have personal access tokens (PATs), along with developers, enabling granular control over permissions and repository access.
• Tap your tokens: enable authentication token data in your enterprise audit log to display for audit log events.
• Revolutionize Internet of Things (IoT) software development: Arm Development tools are natively available inside GitHub Actions.
• Keep building: GitHub Enterprise Server 3.7, with 70 new features, is generally available for those who want to self-host the power of GitHub.

Security

• Shhh! Maintainers of open source repositories can now receive private vulnerability reports from the community and collaborate on a solution.
• Stay secure in Ruby: CodeQL support for Ruby is now generally available by default in GitHub.com code scanning, CodeQL CLI, and the CodeQL extension for VS Code.
• Protection unlimited: security overview’s new risk and coverage views provide greater security visibility for GitHub Enterprise users.

Community

• Celebrating 10 years of Octoverse: what does the world of open source development look like in 2022? Explore how communities, organizations, and companies are collaborating and investing in open source.
• Committing to the future: GitHub Accelerator will provide stipends and mentorship for 20 maintainers and teams to launch full-time open source careers.
• Open source forever: the new $10 million M12 GitHub Fund will ensure that open source continues to get the funding it needs.
• All for one: GitHub Sponsors will let you support your dependencies all at once, by uploading a list of maintainers you want to support plus the amounts of the sponsorships.

What you need to know

• A new campaign by the North Korean advanced persistent threat group Lazarus was recently discovered.
• The campaign used malicious documents pretending to be about a job for Lockheed Martin as part of spear phishing attacks.
• The Lazarus group also took advantage of Windows Update to bypass security detection mechanisms.

Malwarebytes recently discovered a campaign perpetrated by the advanced persistent threat group (APT) known as Lazarus. The campaign used spear phishing attacks that included malicious documents disguised as information about job opportunities with Lockheed Martin. As part of its attack methodology, the Lazarus group uses Windows Update and GitHub to bypass security software.

Malwarebytes thoroughly breaks down the attack in technical terms. One part of the campaign uses Windows Update to bypass security detection mechanisms. Malwarebytes notes that this is a "clever" use of Windows Update.

"This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms," said Malwarebytes. "With this method, the threat actor can execute its malicious code through the Microsoft Windows Update client..."

The Lazarus group also used GitHub in its attack. Using GitHub makes it difficult for security products to tell the difference between malicious and legitimate content. This is the first time that Malwarebytes has observed the group using GitHub in this way.

"Rarely do we see malware using GitHub as C2 and this is the first time we've observed Lazarus leveraging it," explained Malwarebytes. "Using GitHub as a C2 has its own drawbacks but it is a clever choice for targeted and short term attacks as it makes it harder for security products to differentiate between legitimate and malicious connections."

The Lazarus group previously used spear phishing tactics to obtain COVID-19 research. Lazarus was also connected to the well-known attack on Sony and the WannaCry ransomware attack.

Lazarus was also alleged to be involved in the theft of $400 million worth of cryptocurrency in 2021.

Microsoft-owned GitHub is the biggest code-sharing platform on the planet and while using it through the web browser is simple, when you're interacting with your code and local files you're more than likely using a terminal.

That's where GitHub CLI comes in. An official tool made by GitHub, it's good to use both on Windows 10 and Windows 11 in PowerShell or within the Windows Subsystem for Linux (WSL). Once you're familiar with it, it could speed up a number of areas of your GitHub workflow.

Here's how to install it, get set up and carry out some basic processes.

Set up a GitHub account before anything else

You don't need a GitHub account to browse code and clone repos, but it's still worth signing up. Only with your own account and repo space can you store your own files and fork other projects, follow other members, and star repos for easy access later on. It's completely free to use and doesn't require you to have a Microsoft Account.

A GitHub account also allows you to make use of the oft-overlooked GitHub CLI terminal application, which due to some changes in how GitHub allows accounts to be authenticated, is actually something you should have. More on that later.

You don't have to interact with GitHub through the terminal, but in many cases, it's the most efficient workflow.

Installing GitHub CLI onto Windows or WSL

The GitHub CLI tool is an official GitHub application, and if you're going to be using GitHub, it's well worth having. For one, it gets around using personal access tokens with Git to push local repositories up to GitHub, as you can use the GitHub CLI application to authenticate your whole system.

To install the GitHub CLI on Windows you can use the Windows Package Manager again by entering this into PowerShell.

winget install github.cli

Alternatively, you can grab it directly from GitHub and it's also available through the Scoop and Chocolately package managers, too. 

On WSL, the process is a little more involved, but GitHub has full documentation you can follow. Since most people using WSL are likely to have Ubuntu or Debian installed as they're officially distributed through the Microsoft Store, you can use the following commands in your WSL terminal to install it.

curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpgecho "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/nullsudo apt updatesudo apt install gh

As with Git, the WSL installation of the GitHub CLI is separate from the Windows installation you would use in PowerShell. The two operate the same way, but if you switch between WSL and PowerShell, you'll need to have it installed in both locations.

How to set up GitHub CLI and authenticate your account

The GitHub CLI, unlike Git, can use your account login and password for authentication with the added bonus of then also allowing Git to push to your GitHub repositories. To authenticate GitHub CLI, open up your terminal and follow these steps. Again, all the steps are the same whether you use Windows or WSL.

1. In the terminal enter gh auth login
2. Choose GitHub.com.
3. Select HTTPS as the protocol.

4. Type Y to authenticate with your GitHub credentials
5. Hit Enter to login with a web browser.

6. Note down the one-time code you're presented with, and press Enter.
7. A browser will now open, and you'll need to log into GitHub if you aren't already.
8. Enter the one-time code in the box.

You'll now be logged into the GitHub CLI client. To see the full list of commands available simply type:

gh --help

Using GitHub CLI

There is a basic command template for using GitHub CLI that looks like this:

gh [command] [sub-command] [flags] 

All commands you enter will begin with "gh" in order to trigger GitHub CLI. There are a number of commands to use, but here are some examples of how you would carry out some basic functions.

Create a new GitHub repository

GitHub CLI gives you the ability to create a new remote repository without having to first go to the GitHub website and then link it back to your local machine. To do so you need to have Git initialized in your local directory and then navigate there in the terminal. Then enter:

gh repo create

You'll be asked to give it a name, an optional description, its visibility and to confirm you want to create an "origin" Git remote in your local directory. Once all are completed, you can go check out your new repo on the GitHub website. You can open up this or any of your other GitHub repos from their local directories by entering:

gh browse

Clone or fork a GitHub repository

Most of the time you'll use the "git clone" command to clone a local copy of a GitHub repository, but you can do the same using the GitHub CLI tool using this command.

gh repo clone [user/repo name or URL]

So, for example, to clone Microsoft Visual Studio you would simply enter:

gh repo clone microsoft/vscode

The end result is the same as using Git, and a new directory will be created on your local machine with all contents of the remote repository contained within. You can also use GitHub CLI to clone repos with the full URL if you have that instead, and using the same command without the username will allow you to clone your own repos easily.

gh repo clone [your repo name]

You can also use GitHub CLI to fork a repository and clone a local copy if you wish. You don't have to clone it, however, but it's a quick way to achieve both goals with one command.

gh repo fork [user/repo name or URL]

For example:

gh repo fork microsoft/winget-pkgs

Once you hit Enter, you'll be asked whether you want to clone the fork or not.

The GitHub CLI tool also has an easy way to find repos you might want to clone, assuming you know the organization or username. For example, to see all Microsoft repositories on GitHub you might enter:

gh repo list microsoft

Creating a new issue

Creating issues is a key part of the GitHub process, and you can do that right from the command line using this command.

gh issue create

The tool will then ask you to give your issue a title, followed by opening a text editor, such as Nano in WSL, to fill out the body of the issue, then the option to submit or to continue in the browser. It's really straightforward, and the prompts will guide you at every step.

Viewing and closing issues

To get a full list of the available tools for the issue in question use this command: 

gh issue --help

One of the most common you'll want to use is viewing issues and then closing them if dealt with. To view all issues for your GitHub repository, enter this command.

gh issue list

You'll now be given a printout of all issues submitted to that repository. To close off issues that have been dealt with, take note of the issue number and enter this command.

gh issue close 1

You'll be given a confirmation that the issue has closed, and to confirm you can run the list command again, and it should be gone.

Creating a pull request

There are a number of options you have when creating pull requests in GitHub CLI, but the basic template is as follows.

gh pr create [subcommand] 

At any time, you can add "--help" to the above to get a full breakdown of all available options. If you wanted to create a pull request and continue it on the web, for example, you would enter:

gh pr create -w

Pull requests behave in exactly the same way as on the web, so naturally won't work if you're on the master branch.

There's a lot more to GitHub CLI than we've talked about here, but hopefully, this gets you pointing in the right direction, particularly if you're a beginner to using GitHub at all. We have a full beginner's guide to GitHub that's a good companion to this, but once you're comfortable with the basics there's a lot to explore. Most of GitHub's main features can be interacted with using the CLI tool.

If at any point you need a bit more information, the "--help" flag after a command is your friend, as it'll break down everything you can do with every possible command available in GitHub CLI.

The Microsoft-owned GitHub platform is the largest of its kind for sharing and collaborating on a variety of code projects. It's also completely free to use for individuals and if a repository is public, anyone can clone it and use the files within.

GitHub is used for a variety of reasons, not least as a way to distribute your own code. One of the absolute basics is cloning a repository from GitHub to your local machine. If you've never done this before it could seem like a foreign concept, but it's really easy to do.

Whether you want to use regular old Windows or the Windows Subsystem for Linux (WSL) this is what you need to know.

Installing Git onto your PC

The main tool you'll be using with GitHub is Git. This can be confusing, but Git is the tool and GitHub is the service that interacts with it; Git is completely separate and has nothing to do with Microsoft.

The basic definition of Git is that it's a version control tool, allowing multiple people to interact with the same files independently with the option to merge changes into the master branch.

Git is also the tool that we'll be using to clone a GitHub repo from the cloud to a local machine.

To install Git on Windows you can simply go to the website and download the executable, or if you want to use the Windows Package Manager, open up a new PowerShell window and enter

winget install git

.

In WSL distros like Ubuntu and Debian you can install Git using the command

sudo apt install git

. It should already be installed when you set up your WSL installation, but if it isn't this command is all you need.

On Windows, the Git installation will come with its own terminal. You can use this if you wish, but you can also just interact with it inside PowerShell. Especially if it's an environment you're already comfortable with.

How to clone a GitHub repo to your PC

Cloning is one of the most basic functions of Git and one that you can use happily without getting in the weeds too much if all you're interested in is being able to pull content from GitHub. Cloning is essentially downloading, in so much as you point your local Git client at the destination on GitHub and it will pull the content down, creating a new directory on your local machine.

Whether you're working within PowerShell using Git for Windows or you're inside WSL, the commands you need are the same. Git is platform-agnostic, so you can learn it once and use it everywhere.

When you clone the repo in the terminal, it will create your local folder inside whatever directory your command line is in at that point. So if you want to put it somewhere specific, find the right location in File Explorer then right-click and open in PowerShell/Windows Terminal. WSL distros can also access the Windows filesystem so if you're using Linux on your Windows box, the same idea applies. It will only save to the Linux file system if you tell it to.

Cloning from GitHub basically requires you to get a web address to feed into the Git client. For this example, we're going to clone the Microsoft Visual Studio Code repo.

1. Find the repo you want on the GitHub website. For this example, we're using https://github.com/microsoft/vscode
2. Click the button labeled Code.
3. Select HTTPS.

4. Copy the URL.
5. Open up your chosen terminal. Whether it's WSL or PowerShell the Git commands are the same.
6. In the terminal enter git clone https://github.com/microsoft/vscode

Git will now pull the entire contents of the chosen repository down to your local machine. It doesn't pick and choose; you get the whole lot. You'll also get the README.md file which is used to create any text and instructions on the front page of the repo.

You now have a local copy of a GitHub repository, but what if it gets updated? Everything you pull from GitHub will be an initialized Git repository, with files inside that allow it to interact with Git, and in turn, allow you to pull updates. It allows much more but as this tutorial is only focused on cloning, updates are all we're interested in.

To get the latest update to a GitHub repository, open up your terminal inside the folder you initially cloned (using the steps above if it's easier) and enter

git pull

. That's all there is to it, and Git will now compare your copy of the repository to that hosted on GitHub and will download any changes.

You now know how to clone and pull updates from any GitHub repository. Unless you have the right permissions you won't be able to make any changes to the hosted files, so anything you do locally is totally fine. Go forth and clone!

What you need to know

• Microsoft has folded Channel 9 into Microsoft Learn and is in the process of migrating all of the former's content to the latter.
• While that happens, a Twitter user and follower of Microsoft's activities took it upon themselves to create a Channel 9 index page so anyone can easily find legacy Channel 9 content.
• The page is live right now.

In November 2021, Microsoft announced it was folding Channel 9 into the Microsoft Learn family, meaning it'd no longer be a standalone entity. Now, when you go to its announcement page on the subject, you'll be met with this disclaimer:

As to where you can easily enjoy said legacy content and other videos in the interim, there's now an index page built for that singular purpose. Created by Twitter user WalkingCat, otherwise known as the tweeter with the fun Garfield profile picture, a Channel 9 github.io page now exists for your video-browsing pleasure.

The videos on that index page stretch all the way back to content from the early 2000s, so rest assured, if you're looking for old Channel 9 videos, you should be good. And everything could very well make its way to Microsoft's current Channel 9 setup, so keep an eye on the official channels (no pun intended) as well.

Besides being a Microsoft property these days, GitHub is the largest place on earth for programmers to sync, share, and collaborate on code. Big companies and solo superstars use GitHub as well as everyone in between. If there's an open-source project, chances are pretty high it's hosted on GitHub.

But it's not just useful for folks writing code. Anyone can pull code and files from a public GitHub repo, and there are limitless projects you might want to interact with at some point. From bigger ones like Microsoft's Visual Studio Code or Windows Package Manager to smaller ones like using someone else's configuration files to theme your terminal. If it needs some form of code, it can be done through GitHub.

But while you don't need to know how to write code to use GitHub, to absolute beginners things can be a little confusing. It doesn't have to be, though, so here are some of the basics you need to know.

Set up a GitHub account

You don't need a GitHub account to browse code and clone repos, but it's still worth signing up. Only with your own account and repo space can you store your own files and fork other projects, follow other members, and star repos for easy access later on. It's completely free to use and doesn't require you to have a Microsoft Account.

A GitHub account also allows you to make use of the oft-overlooked GitHub CLI terminal application, which due to some changes in how GitHub allows accounts to be authenticated, is actually something you should have. More on that later.

You don't have to interact with GitHub through the terminal, but in many cases, it's the most efficient workflow. There is a GitHub desktop application for Windows, Mac, and Linux instead if you'd rather have something with a GUI. But for the purposes of this guide, we'll be focusing on the terminal. It's not scary, promise!

Installing Git and GitHub CLI onto your PC

The main tool you'll be using with GitHub is Git. This can be confusing, but Git is the tool and GitHub is the service that interacts with it, Git is completely separate and has nothing to do with Microsoft. The basic definition of Git is that it's a version control tool, allowing multiple people to interact with the same files independently with the option to merge changes into the master branch.

For now, we'll only be touching on the main commands you need to know to get started cloning GitHub repos to your PC, but look out for a more detailed guide on Git soon.

To install Git on Windows you can simply go to the Git for Windows website and download the executable, or if you want to use the Windows Package Manager, open up a new PowerShell window and enter

winget install git

.

In WSL distros like Ubuntu and Debian you can install Git using the command

sudo apt install git

. Easy.

The GitHub CLI tool is an official GitHub application and for now, you can hold off if you're not planning to upload anything yourself to a GitHub repo. If you are, it's well worth having, as it gets around using personal access tokens with Git.

To install the GitHub CLI on Windows you can use the Windows Package Manager again by entering

winget install github.cli

, or grab it directly from GitHub. Alternatively, it's available through the Scoop and Chocolately package managers, too, where you'll simply need to install

gh

.

On Linux and WSL, there are various different methods depending on the distribution you're running, but GitHub has full documentation you can follow. Mac users can also get the GitHub CLI application, either from the releases page or through Homebrew, Conda, MacPorts and Spack where it can be found as

gh

.

Cloning your first GitHub repo

Cloning a GitHub repo is basically like syncing a folder to your PC from the cloud. The repo will create a new local folder and contained within it will be everything that was available on that repo. Generally, a GitHub repo is only dedicated to one project, so when you clone it you'll get everything you need. If any further dependencies are required, there will nearly always be a

README.md

file with full instructions.

When you clone the repo in the terminal, it will create your local folder inside whatever directory your command line is in at that point. So if you want to put it somewhere specific, find the right location in File Explorer then right-click and open in PowerShell/Windows Terminal. WSL distros can also access the Windows filesystem so if you're using Linux on your Windows box, the same idea applies. It will only save to the Linux file system if you tell it to.

So, time to get cloning. For this example, we're going to clone the Microsoft Visual Studio Code repo.

1. Find the repo you want on the GitHub website. For this example, we're using https://github.com/microsoft/vscode
2. Click the button labeled Code.
3. Select HTTPS.

4. Copy the URL.
5. Open up your chosen terminal. Whether it's WSL, PowerShell, Mac, or Linux, the Git commands are the same.
6. In the terminal enter git clone https://github.com/microsoft/vscode

There are other options to clone, including SSH and using the GitHub CLI client, but this is the simplest method, especially for beginners. It's also the method you'll find in most tutorials and in a lot of the installation instructions you might find on GitHub.

You now have the entire contents of the Visual Studio Code repo downloaded to your PC. You can't make changes and re-upload them to GitHub (known as a Push) because you don't have the permissions needed, but if you wanted to use or tinker with the code on your local machine, you can. To see the contents of the directory you can enter

cd vscode

in the terminal and do an

ls

or on Windows, you can enter

explorer.exe .

to open File Explorer into that directory.

You now know the very basics of using Git to clone any GitHub repo. The only ones you can't clone are private repos not under your ownership, but everything else that's public is fair game. If you don't want the files anymore, simply delete them from your local machine. They won't affect the remote repo. If you want to get the latest files from this repo at any time, ensure you're in that directory in the terminal and simply enter

git pull

to download the latest changes.

Authenticating GitHub CLI with your account credentials

If you want to go a bit further with GitHub and start pushing your own files to it then I highly recommend also having the GitHub CLI application in your arsenal. It's a command-line tool that exists alongside Git and is specific to GitHub (Git itself can interact with multiple services such as GitLab and BitBucket also).

GitHub no longer allows you to authenticate with Git using your account login and password, instead requiring a personal access token instead. The easier way to authenticate your system is with GitHub CLI, which can use your account login and password. To use it, open up your terminal and follow these steps. Again, all the steps are the same whether you use Windows, Mac, WSL, or Linux.

1. In the terminal enter gh auth login
2. Choose GitHub.com.
3. Select HTTPS as the protocol.

4. Type Y to authenticate with your GitHub credentials
5. Hit Enter to log in with a web browser.
6. Note down the one-time code you're presented with and press Enter.

7. A browser will now open, and you'll need to log into GitHub if you aren't already.
8. Enter the one-time code in the box.

You'll now be logged into the GitHub CLI client, and there are a number of things you can do with it besides just now being able to push code with Git. To see the full list of commands simply type

gh --help

into the terminal.

Setting up your first GitHub repository

There are two ways you can easily set up your first GitHub repository. You can either use the website or if you're now logged into GitHub CLI you can create one with a few commands in a terminal.

Here's what you need to do for both methods.

Using GitHub.com

Fire up the GitHub homepage and make sure you're logged into your account. To create a new repo follow these steps.

1. Click the + in the top right-hand corner.
2. Select New repository.
3. Give your repository a name. This is mandatory whether public or private.
4. Choose public or private depending on what you need.
5. Choose any of the optional files or licensing if you need them.
6. Click Create repository.

One of the files you can auto-generate is a

README.md

text file. You don't need one of these, but it's a good idea to have one since it's the file that will contain all the front-facing information. Anything you enter into this file is displayed in your repo. If it's private and you're not going to share the contents, it's not quite as important.

You now have your first GitHub repo created! To sync it to your local PC follow the steps above to clone it.

Using GitHub CLI

Since a lot of the time using GitHub will be spent in a terminal, the command line is a quick and easy place to initialize a new GitHub repo using GitHub-CLI. The added bonus here is that the repo will be already linked to a local folder, set up, and ready for Git.

1. Navigate to the local directory you want to sync to a GitHub repo, either by using cd in the terminal or by opening to the terminal from File Explorer.
2. Enter git init and press enter.
3. Once the empty Git repository has been created, enter gh repo create.
4. Name the repo (press enter to use the folder name).
5. Give the repo an optional description and press enter.
6. Choose the visibility for the repo with the cursor keys and press enter.
7. Type Y and press enter to continue and create an origin git remote.
8. When complete you'll see a success message and confirmation of the remote you just created.

The key steps here are the first two as without them you can't create a repo with GitHub CLI. All Git repositories need to be initialized, and if you clone one from GitHub it will already have the necessary files within. The end result is the same, but with this method, you can quickly create a GitHub repo and link it to your local folder/Git repository ready to commit and push.

Pushing to GitHub from the command line

Now you have your own GitHub repository it's time to push some files to it. Whichever method you used to create it, once it's linked to your local machine there are a few more steps to do. The following steps assume you've followed everything to this point and have used the GitHub CLI to authenticate your system with your account.

The first thing you need to do is to tell Git who you are. You can't commit anything to GitHub without first doing this. Open up a terminal and enter these two commands.

git config --global user.name "YourUserName"git config --global user.email "YourEmailAddress"

Now, every time you commit something to GitHub from your PC, this information will be attached. In smaller cases like personal repos it's not that important, but the system is built to cater right up to large organizations.

Now we're ready to push the contents of our local Git repository to GitHub.

1. Enter git add . into the terminal. As this is a first-time push we're assuming you want to send all files. For individual files substitute the filename for the period.
2. Confirm the files are now staged with git status.

3. You now need to commit the staged files with git commit -m "Insert a message here". The message is compulsory, but for the first time "First commit" is fine.

4. To push, enter git push --set-upstream origin master and press enter.

How long the push takes depends on how large the directory is, but once it's done you'll get a confirmation and be sent back to an empty prompt. You can use

git status

at any time to check whether there are staged files to be committed. It's also worth noting that step 4 is only necessary on the first commit. For future pushes, you can simply use

git push

to push all committed files up to the GitHub repo.

This may seem like a lot to take in, but once you're set up to use GitHub and have spent a little time using it both on the web and your local machine, it all becomes second nature pretty quickly. Everything discussed here will get you fully set up and covers the basics you need to clone, push, and pull to and from GitHub.

What you need to know

• Nat Friedman announced he will no longer be CEO of GitHub.
• Thomas Dohmke, GitHub's current Chief Product Officer, will take his place.
• Friedman will gain the new title of Chairman Emeritus, which Friedman is happy about because it's a title in Latin.

Nat Friedman released a lengthy note on GitHub today announcing he'll no longer be the developer platform's CEO. On November 15, 2021, GitHub Chief Product Officer Thomas Dohmke will take his place.

But Friedman's not just disappearing in a puff of smoke. Instead, he'll adopt the title of Chairman Emeritus, which sits well with him as it checks off the box for his "lifelong ambition of having a title in Latin."

As to where Friedman will be going? Here's the teaser he gave for his upcoming plans. "With all that we've accomplished in mind, and more than five great years at Microsoft under my belt, I've decided it's time for me to go back to my startup roots," he said. "That's why I'm moving on to my next adventure: to support, advise, and invest in the founders and developers who are creating the future with technology and tackling some of the biggest opportunities of our day."

He follows that up with a bit of discussion about why his colleague, Dohmke, is qualified for the job of CEO, and then continues with a paragraph of thank yous. You can read the whole note at the hyperlink in the first sentence of this article.

If you're not familiar with GitHub or its activities, know that a lot of interesting code ends up there. For example, there was a mod that made Grand Theft Auto V look photorealistic, and you could look at its programming innards over on GitHub.

What you need to know

• GitHub and OpenAI have teamed up to develop Copilot.
• It will help do the tedious coding work for developers.
• It is not designed to replace humans.

GitHub and OpenAI are partnering up to ensure coders have an easier future ahead wherein they're not even needed in order to write certain code. Via the partnership, a new technology, dubbed Copilot, is being developed to help speed along programmers' endeavors via AI-written code.

Here's a bit of what GitHub's Copilot page has to offer in terms of explaining the AI programmer's functions: "GitHub Copilot is powered by Codex, the new AI system created by OpenAI," the page reads. "GitHub Copilot understands significantly more context than most code assistants. So, whether it's in a docstring, comment, function name, or the code itself, GitHub Copilot uses the context you've provided and synthesizes code to match."

That larger knowledge base is what GitHub says separates Copilot from other superficially similar programs. GitHub also has a detailed breakdown of what Copilot can do, to further underscore its utilities. Here's what it can do:

• Write a comment describing the logic you want, and let GitHub Copilot assemble the code for you.
• GitHub Copilot works great for quickly producing boilerplate and repetitive code patterns.
• Import a unit test package, and let GitHub Copilot suggest tests that match your implementation code.
• Want to evaluate a few different approaches? GitHub Copilot can show you a list of solutions. Use the code as provided, or edit it to meet your needs.

Copilot's not quite ready for primetime yet, but you can read the testimonials from developers on the GitHub page linked above. Furthermore, you can also sign up for the technical preview if you don't want to wait for a public release.

What you need to know

• GitHub now supports uploading videos in issues, pull requests, discussions, and more.
• The ability to upload videos makes it easier to show how to reproduce a bug or to show how a feature could look.
• You can also upload videos to GitHub from iOS and Android devices.

Microsoft's GitHub now supports uploading videos. The ability to upload videos makes it much easier for developers to show how to reproduce a bug, to showcase a new feature, and to provide context for people that they're working with. The feature entered beta testing in December 2020 and is now generally available. GitHub's Lauren Brose explains the benefit of using videos in a recent blog post.

Describing a bug with only words can make it difficult to replicate. Uploading a video showing how to make a bug occur can streamline the collaboration process. Videos should reduce the amount of back and forth required to make sure a bug is reproduced correctly. Brose explains, "By enabling users to upload videos, we've seen the ability to visually reproduce the way in which a collaborator came across a bug significantly decrease the time spent for a maintainer to try and reproduce from text."

Developers can also use videos to provide walkthroughs, demos of functionality, and provide context for more complex code changes. Video support on GitHub also makes it easier to showcase prototypes for new features.

GitHub supports uploading videos from its desktop applications as well as its mobile apps on iOS and Android. The ability to upload videos from mobile devices improves the experience for mobile developers who record bugs and issues on their phones.

What you need to know

• The GitHub app for Microsoft Teams entered public preview in September.
• It's been updated with new personalization features and settings.
• More updates are on the way.

Microsoft Teams' GitHub app just got even better, as outlined in a Microsoft Teams blog post (via ZDNet). The post outlines that the purpose of the app is to help make coordinating coding projects easier from within Teams, then expands on how the app's been improved to make that core objective more attainable.

Some of the features highlighted in the post include enhanced personalization tools, such as the ability to subscribe to your repositories and receive notifications for commits, pull requests, and issues.

The Teams GitHub app now also allows for scheduling reminders for pull requests. Here's how the scheduling reminder feature is explained in the post:

The blog goes over a lot more of the improvements that have been made to the GitHub app recently, and at the very end mentions that more updates are on the way. Keep it tuned to Windows Central since we'll cover the updates as they go live. And don't forget that GitHub's making moves outside of its Teams app, such as with its new push notifications on mobile.

What you need to know

• GitHub announced new push notification types for its mobile app.
• The new notification types include "assigned," "review requested," and "deployment review."

GitHub Mobile, an app that lets you manage your coding projects while on the go, now supports additional push notification options. Announced today by GitHub on Twitter, additional push notification types are chief among the things that users asked for and are now receiving.

The notifications you can now send include:

• Direct Mentions
• Assigned
• Review Requested
• Deployment Review

Github knows that not everyone is a fan of receiving push notifications, which is why it has also implemented a "Working Hours" feature to help users control the amount of ringing their phone does. With Working Hours, users can decide when to pause notifications by setting timers. It's a simple, elegant solution to the far too common problem of people overwhelming their teammates with notifications.

GitHub Mobile also features custom repository watch settings, giving users the choice to opt-in to inbox notifications so they can choose what they do and don't receive.

GitHub Mobile is available on both iOS and Android.

What you need to know

• GitHub offered a job back to the employee who was fired for warning employees about Nazis.
• The former employee declined to take the offer to return to GitHub.
• The parties have reportedly come to an "amicable resolution."

Earlier this year, a GitHub employee lost their job following comments warning other employees on Slack about Nazis at the attacks on the U.S. Capitol. GitHub has since performed an investigation of the incident and offered the person their job back. The person, however, declined to return to GitHub.

According to TechCrunch, the employee and GitHub reached an "amicable resolution," though the details of that resolution have not been revealed.

A GitHub spokesperson told TechCrunch, "We offered the employee his job back immediately after reviewing the investigation findings, and he declined."

"Me and the company reached an amicable resolution," said the former employee to TechCrunch. "I appreciate that they have denounced white supremacy and the dangers it poses to everybody."

The employee warned coworkers by stating, "stay safe homies, Nazis are about." A different employee took issue with the comment and the person warning coworkers was fired.

GitHub issued a public apology for the incident, and GitHub's former head of HR, Carrie Olesen, resigned as part of an effort to take "personal accountability."

The former employee shared a statement with TechCrunch. Below are a couple of exerpts:

What you need to know

• GitHub apologized for firing a Jewish employee who warned people about Nazis at the U.S. Capitol.
• The company admits that "significant errors of judgment and procedure" occurred.
• The company is offering the employee their job back.

Microsoft-owned GitHub admitted that "significant errors of judgment and procedure" occurred that led to the firing of a Jewish employee who warned people about Nazis. The company issued a public apology and has offered the person their job back, according to The Verge. GitHub's head of HR, Carrie Olesen, has also resigned as part of an effort to "[take] personal accountability" for the situation.

GitHub met criticism when an employee warned coworkers about Nazis at the U.S. Capitol building. The employee stated, "stay safe homies, Nazis are about" in a Slack channel at GitHub. A coworker took offense at the word Nazi and reported the message to GitHub's HR department. The poster of the word Nazi was later fired.

Close to 200 GitHub employees signed an open letter asking about the situation. Additionally, people in GitHub's Slack channels started using the word Nazi frequently following the event. The Verge shared several screenshots of GitHub's Slack channels surrounding the incident.

GitHub's CEO, Nat Friedman sent an internal message to employees on January 16, stating:

GitHub also offered a public apology to the fired employee and is offering them their job back.

The public apology includes several statements on the issue that were shared internally:

• It was appalling last week to watch a violent mob, including Nazis and white supremacists, attack the US Capitol. That these hateful ideologies were able to reach the sacred seat of our democratic republic in 2021 is sickening. The views that propelled this attack are morally abhorrent to me personally, and, I know, to our entire leadership team and company.
• GitHub condemns the attack on the US Capitol on January 6th and any and all belief systems that are discriminatory. Antisemitism, neo-Nazis, and white supremacy – along with all other forms of racism – are vile and have no place in our community.
• We do not and will not tolerate discrimination, harassment, or retaliation in any of its forms, period.
• Employees are free to express concerns about Nazis, antisemitism, white supremacy or any other form of discrimination or harassment in internal discussions. We expect all employees to be respectful, professional, and follow GitHub policies on discrimination and harassment.

GitHub's move came after the company hired an independent law firm to investigate the person's termination of employment. The investigation found that "significant mistakes were made."

What you need to know

• GitHub allegedly fired a Jewish employee after the employee warned co-workers about Nazis.
• The fired employee reportedly posted "stay safe homies, Nazis are about" on the day of the siege on the U.S. Capitol.
• Roughly 200 GitHub employees have signed a letter asking for the company to take a stance against anti-Semitism and white supremacy.

A Jewish former employee of GitHub was allegedly fired following warning co-workers about Nazis on the day of the siege on the U.S. Capitol. According to Business Insider, the employee posts "stay safe homies, Nazis are about" on the day of the attack on the Capitol (via The Verge).

The message reportedly caused conflict among GitHub employees. One member of GitHub's staff criticized the message for divisive language, and GitHub's HR team reportedly chastised the employee for the use of the word "Nazi." Two days after the alleged comment, GitHub reportedly fired the employee. Upon the alleged termination, GitHub reportedly cited vague patterns of behavior.

Following the alleged firing, around 200 GitHub employees have signed a letter asking the company to take a stance against white supremacy and anti-Semitism. The letter also asks why the employee was fired.

"The company is actively looking into the circumstances surrounding the separation of an employee last week and will take any and all appropriate action following a thorough investigation," said GitHub CEO Nat Friedman.

The employee that was fired has relatives in co-workers in Washington, DC, and had family members die in the Holocaust. The employee states that they saw that some rioters were associated with neo-Nazi groups.

Thousands of people were involved in the attack on the U.S. Capitol, and at this point, authorities are still determining which groups and individuals were involved. Several reports claim that white supremacy and neo-Nazi groups were at the attack.

The former GitHub employee post on Slack before his account was deactivated, stating:

GitHub is owned by Microsoft, which acquired the developer platform in 2018. Microsoft President Brad Smith spoke about the peaceful transition of power on January 4 but was met with pushback by people highlighting politicians that received donations from Microsoft's PAC. Microsoft has since paused political donations.

What you need to know

• Microsoft's GitHub has removed cookie banners from its website.
• It did so by removing all cookies that aren't required for the website to work.
• GitHub still has cookies, but they are essential for the website to function.

You won't see cookie banners on GitHub anymore. The team behind GitHub removed all unnecessary cookies from the website, which allows them to remove any cookie banners. GitHub still has cookies, but they are essential for the website to function, so the site isn't required to have a banner for them.

EU law requires websites to have a cookie banner if a site contains any cookies that aren't required for the site to work. Some examples include cookies for analytics and advertising. These are often used for personalized ads and in other ways, but the EU wants to make sure people know when these cookies are in use.

GitHub's Nat Friedman explains in a blog post why GitHub removed unnecessary cookies, stating:

As a result of removing non-essential cookies, GitHub no longer sends information to third-party analytics services. Friedman highlights that "GitHub still does not use any cookies to display ads, or track you across other sites," emphasizing that GitHub did not do this before and will continue to not do so in the future.

What you need to know

• Microsoft-owned GitHub announced a slate of new features at a virtual conference today.
• Key additions include the arrival of dark mode, along with auto-merge pull requests and more.

At its virtual GitHub Universe conference today, GitHub took the wraps off of a whole slew of new features for developers to take advantage of. The highlight, however, is something that will surely elicit a huge, collective sigh of relief (or cacophany of cheers): dark mode. No longer will you have to shield your eyes from your screen if you just happen to open GitHub in a dark room.

GitHub's dark mode is available now as part of a public beta. You can enable it in the "appearance" portion of GitHub's settings. Though, with this being a public beta, expect there to be at least some wonkiness involved.

Beyond just being kinder to your eyes, GitHub is making it simpler for pull request authors to merge their requests after reviews and checks have passed. Pull request auto-merge will let authors opt in to have their pull requests merged automatically once all reviews and status checks are completed. This new feature is set to launch in public beta starting next week.

GitHub repositories are also getting access to a new space for their communities to interact. Fittingly called "Discussions, the feature allows people to have ongoing conversations about a project in a dedicated space, ask questions, and more. Discussions can be pinned, issues can be converted into discussions, and more.

Discussions is available now in beta for all public repositories.

GitHub Unicerse is set to run through December 10, with lots of discussions for developers to dive into. For more, you can check out the GitHub Universe page.

What you need to know

• Microsoft announced a global skills initiative to teach 25 million people digital skills this year.
• The initiative brings together resources from LinkedIn, GitHub, and Microsoft.
• Microsoft is also committing $20 million in cash grants to help nonprofit organizations.

Microsoft announced a new global skills initiative today that aims to teach 25 million people digital skills by the end of 2020. The initiative is in response to the economic crisis around the globe that's occurred as a result of the coronavirus (COVID-19) pandemic. The digital skills taught through the initiative should help people find jobs that need to be filled, develops skills for jobs, and obtain certifications at a low cost.

The initiative brings together resources from LinkedIn, GitHub, and Microsoft to help people reskill and upskill to improve their employability. A news post from Microsoft outlines three areas that the resources will help with:

• The use of data to identify in-demand jobs and the skills needed to fill them.
• Free access to learning paths and content to help people develop the skills these positions require.
• Low-cost certifications and free job-seeking tools to help people who develop these skills pursue new jobs.

As part of the initiative, people have access to content on LinkedIn Learning, Microsoft Learn, and the GitHub Learning Lab. Additionally, people can utilize Microsoft Certifications and LinkedIn job seeking tools. All of these resources can be accessed on LinkedIn's website.

In addition to making these resources available, Microsoft will provide $20 million in cash grants to help nonprofit organizations around the world. One fourth of that total will be in the form of cash grants to community-based nonprofit organizations that "are led by and serve communities of color in the United States," according to Microsoft.

Microsoft will also make data and analytics, such as data from the LinkedIn Economic Graph, available to governments around the world to help assess local economic needs.

As part of its new post, Microsoft CEO Satya Nadella shared his thoughts, stating, "COVID-19 has created both a public health and an economic crisis, and as the world recovers, we need to ensure no one is left behind." He adds, "Today, we're bringing together resources from Microsoft inclusive of LinkedIn and GitHub to reimagine how people learn and apply new skills — and help 25 million people facing unemployment due to COVID-19 prepare for the jobs of the future."

Microsoft also announced a new learning app within Microsoft Teams that is built to help employers teach and upskill new and returning employees.

What you need to know

• GitHub's mobile apps on iOS and Android just received an update.
• The update makes it easier to find relevant users in comments.
• The iOS version now has a redesigned issue creation flow with templates.

GitHub's mobile apps have an update on iOS and Android. The update focuses on delivering highly requested features from GitHub users, including the ability to switch branches when browsing repositories and the option to view a list of commits in pull requests or repositories.

GitHub's mobile apps allow developers to manage GitHub accounts and projects on the go. The Microsoft-owned GitHub launched the apps last month.

The update brings the app to version 1.1.0 on both Android and iOS. Here's the complete changelog for the Android version of Github:

• Type @ in a comment, issue, or review to show a list of relevant users
• Switch branches when browsing repositories
• View a list of commits in pull requests or repositories
• Create new issues using issue templates
• Easily quote & reply to comments
• Select from your saved replies when leaving comments

The changelog for the iOS version of GitHub has several of the same features, but also has some other changes:

• Typing "@" in a comment, issue, or review will autocomplete a list of most-relevant users that you can select from
• Switch branches when browsing repositories
• View a list of commits in pull requests or repositories
• A new, native commit details view accessible from commit lists or pull request timelines
• Totally redesigned issue creation flow with templates

The updates are available now in their respective app stores.

What you need to know

• The GitHub app is now generally available on iOS and Android.
• The app was in beta testing for several months to receive feedback.
• The app lets you manage your GitHub account and projects on the go.

Microsoft's Github announced the beta version of it's GitHub mobile app last November. Now, after months of beta testing, the app is generally available for iOS and Android. The app allows you to manage your GitHub account and projects on the go. You can grab the app from the Google Play Store or Apple's App Store for free.

GitHub's post announcing the app's general availability breaks down some of the things you can do with the app:

• Organize tasks in a swipe: Get your inbox to zero in no time—swipe to finish a task or save the notification to return to it later.
• Give feedback and respond to issues: Respond to comments while you're on the go.
• Review and merge pull requests: Merge and mark pull requests to breeze through your workflow, wherever you are.

The Github mobile app works with GitHub individual plans, Team, and Enterprise Cloud. GitHub states that it is working on adding features and APIs so the app can work with Enterprise Server later this year.

What you need to know

• Microsoft's GitHub will acquire npm.
• npm has over 1.3 million packages and helps developers with its registry of JavaScript packages.
• The npm registry is free, and will always be free, according to GitHub's Nat Friedman.

Microsoft's GitHub announced that it will acquire npm, a popular company that has a massive registry of JavaScript packages. GitHub's Nat Friedman discussed the deal from GitHub's side, while an npm blog post by the company's founder talks about the deal from npm's side. GitHub and npm both focus heavily on open source development.

For developers that currently use the registry, the most important takeaway is that it will remain free. npm's blog post states that its registry of packages will remain "public, free, and as available as ever." GitHub's Friedman states that "the public npm registry... will always be available and always be free." Paying customers that use npm Pro, Teams, and Enterprise to host private registries will still be able to do so.

Friedman explains that the focus of this deal is to invest infrastrucutre and platform, improve the core experience, and engage with the community. In the future, GitHub will integrate with npm, allowing developers to trace a change from a GitHub pull request all the way to an npm package version.

npm's story began in 2009 when its founder created a package manager for "sharing modules in a tiny group of nerdy weirdos who'd decided to write web servers in JavaScript." In 2014, npm transitioned into a business, growing into a major player in the JavaScript development space.

Friedman states that "The work of the npm team over the last 10 years, and the contributions of hundreds of thousands of open source developers and maintainers, have made npm home to over 1.3 million packages with 75 billion downloads a month. Together, they've helped JavaScript become the largest developer ecosystem in the world."

When npm was founded, it had a set of goals that its founder says have stayed mostly the same:

1. Keep the npm registry running forever (not only for the life of the company).
2. Be a company that we can all enjoy working at, and do the best work of our careers up until now.
3. Get a big enough exit that I can quit my job and see what comes out of me a second time.
4. Share the rewards equitably with the people who got npm to where it is.

The first goal is the most important in relation to this deal. With the GitHub acquisition of npm, the npm team feels comfortable that its registry will be available long after the company is gone. The npm blog post concludes by saying, "This is the end of 'npm, Inc.', the Delaware C Corp. But it's an exciting upgrade for npm."

What you need to know

• GitHub launched its mobile app into beta today.
• GitHub mobile allows developers to work and communicate with their teams on the go.
• The app is first available for testing on iPhone and iPad, but an Android version is "coming soon."

GitHub today launched its new mobile app into beta. The mobile app is first available for testing on iPhone and iPad, but says an Android version is "coming soon."

"There's a lot you can do on GitHub that doesn't require a complex development environment, like sharing feedback on a design discussion and reviewing a few lines of code," GitHub said in its blog post announcing the app. "Now we are making these tasks easy for you to perform, no matter where you work, with a beautifully native experience."

The app allows you to stay productive when away from your PC, reviewing code and merging changes wherever you may be. The app is built to automatically adapt to differing screen sizes, and GitHub has included a dark mode that will change based on your system settings.

If you're interested in jumping in the beta pool, you can sign up to participate in the iOS TestFlight beta at GitHub's website. If you have an Android phone, you can also join the waitlist for the beta ahead of launch.

What you need to know

• GitHub CEO Nat Friedman held an all-hands meeting with employees this week to address concerns over the company's recently renewed contract with ICE.
• Friedman told employees its position on continuing to work with ICE is meant to stay in sync with Microsoft's policies.
• Renewal of the $200,000 contract has caused backlash from employees over concerns about the Trump administration's immigration policies.

GitHub CEO Nat Friedman told employees this week that the company's decision to continue to work with U.S. Immigration and Customs Enforcement (ICE) was made in an effort to align with Microsoft's policies. Friedman's comments were made at an all-hands meeting with GitHub employees, a transcript of which was obtained by Motherboard.

The meeting comes after GitHub faced backlash with a recent decision to renew a $200,000 contract with ICE earlier this week.

In response to a question about whether GitHub has the "autonomy to make this decision independent of Microsoft," Friedman responded:

Friedman continued, saying the decision was the result of a conversation with Microsoft. "It's not a matter of taking orders purely, but it was a conversation with folks at Microsoft. So I'd say it's an area of interdependence at least. I hope that's clear enough."

ICE and the Trump administration have come under fire over the treatment of migrants at the U.S.-Mexico border. Microsoft last year faced criticism for its decision to continue to work with ICE, despite its stated support for family unification.

Speaking with Motherboard, a GitHub employee stated that the company's work with ICE has been a point of concern since 2017.

"People wanted the contract cancelled basically as soon as early 2017, as soon as the travel ban came up," the employee stated. "The calls to cancel got a lot louder as soon as the Microsoft acquisition was announced."

The contract, which provides for a GitHub Enterprise Server, was initiated in 2016.

GitHub employees have spoken out through an open letter issued through an anonymous Twitter account called GitHubbers.

"We implore GitHub to immediately cancel its contract with ICE, no matter the cost. Now is the time to take a stand, or be complicit," the letter states after calling attention to issues of "overcrowding, sexual abuse, and inadequate food and medical care" faced by thousands of immigrants detained at the border.

In an email to employees announcing the contract's extension earlier this week, Friedman called the contract "not financially material." The CEO added that GitHub will donate $500,000 to "nonprofit organizations working to support immigrant communities targeted by the current administration."

What you need to know

• GitHub will renew a contract with Immigration and Customs Enforcement according to a leaked email.
• The email addresses concerns regarding the Trump administration's policies.
• GitHub's CEO states that GitHub wants developers to "have the freedom to operate with a level of privacy."

GitHub will renew a $200,000 contract with Immigration and Customs Enforcement (ICE) according to an email that was leaked to Fight for the Future (via The Verge). In the email, GitHub CEO Nat Friedman discussed the Trump administration's policies and how he, GitHub, and Microsoft have issues with certain policies. He also adds, however, that GitHub wants "software developers around the world to have the freedom to operate with a level of privacy." ICE's policies towards migrant children and immigration are controversial and have been criticized by many, including several GitHub and Microsoft employees, including Friedman himself.

The contract for GitHub enterprise server was purchased in 2016 and was up for renewal according to the email.

In the email, Friedman goes into several details and factors that affect the decision for GitHub to renew the contract with ICE. Friedman points out that while ICE has many controversial policies, it also combats several serious issues, including human trafficking and terrorism,

Friedman also states that a level of privacy is important for developers,

Friedman compares the decision to Microsoft licensing Microsoft Word to people without demanding to know what people use Word to write.

Friedman states that the $200,000 contract is "not financially material." He adds in the email that GitHub will donate $500,000 to "nonprofit organizations working to support immigrant communities targeted by the current administration."

The GitHub CEO also invited recipients of the email to a Q&A that will be held tomorrow at 10 am Pacific time.

What you need to know

• Microsoft today announced that it has acquired Semmle and plans to integrate its team with GitHub.
• Semmle is the company behind a code analysis engine used by NASA, Microsoft, Google, and more.
• Semmle's tools have been used to find vulnerabilities "some of the largest codebases in the world," Microsoft says.

Microsoft announced the acquisition of Semmle, a company that develops code analysis tools for companies and organizations ranging from NASA and Microsoft to Google and Microsoft. Semmle will join GitHub, which Microsoft acquired last year for 7.5 billion.

Semmle began life in 2006 and set out to develop tools that treat "code as data," according to the company's blog post announcing the acquisition. "Semmle's revolutionary semantic code analysis engine allows developers to write queries that identify code patterns in large codebases and search for vulnerabilities and their variants," GitHub explaines in its own blog post.

Security researchers can use Semmle to "quickly find vulnerabilities in code with simple declartive queries," Microsoft says. Those results are then shared through the Semmle community to help improve code quickly across different codebases.

Semmle says that current Semmle users won't see a disruption as part of the acqisition:

On GitHub's side of things, Semmle's platform will see deeper integration throughout the platform.

What you need to know

• GitHub has placed restrictions on users due to U.S. trade sanctions.
• The restrictions affect users in Crimea, Cuba, Iran, North Korea, and Syria.
• Private repos and paid accounts are now restricted, though public repos are available and open-source repos are unaffected.

GitHub placed new restrictions on developers in Crimea, Cuba, Iran, North Korea, and Syria. Developers face restrictions as a result of U.S. trade sanctions. Private repositories (repos) and paid accounts are under these new restrictions, but public repos are still available, and open-source repos are unaffected. Several reports surfaced over the weekend of developers being affected by the restrictions (via The Verge).

ZDNet reports that a developer based in Crimea lost access to his private GitHub repos and a developer from Iran posted on Medium about his account being restricted.

Nat Friedman, GitHub CEO, took to Twitter to explain the restrictions, stating "We have gone to great lengths to do no more than what is required by the law, but of course people are still affected. GitHub is subject to U.S. trade law, just like any company that does business in the U.S."

Friedman added in the same Twitter thread that "The restrictions are based on place of residence and location, not on nationality or heritage."

According to a GitHub support page, restricted accounts have "limited access to GitHub public repository services... for personal communications only, and not for commercial purposes." Access to private repos and access to paid services are suspended for restricted developers. Developers cannot get an export of the disabled content from GitHub according to a tweet from a developer which includes a screenshot of an email from GitHub.

The Verge received a statement from Microsoft on the situation.

Developers are not able to surpass the ban with a VPN. Blocking is done based on I.P. addresses and payment histories.

Portable (and affordable) power accessories we love

Each and every one of these charging gadgets will keep your favorite gear and gadgets going for longer, and none of them costs more than $30.

VisionTek 8,000 mAh micro-USB power bank ($13 at Dell)

This compact dual-output powerbank can speedily recharge any and all your devices, thanks to a two-amp "fast charge feature," using its micro-USB out port. Its simple design includes an LED indicator, and it costs about as much as a single ticket to the movies.

Panasonic eneloop AA batteries (From $13 at Dell)

Panasonic's rechargeable batteries are among the best available, and just a couple of them will keep your favorite remote, mice or other peripherals powered up when you need them. They're also eco. And the company's affordable charger fits and charges both AA and AAA batteries at the same time.

Belkin Qi Wireless Charging Pad ($30 at Dell)

This unobtrusive Qi wireless charging pad looks good (and kind of like a UFO …) and easily charges all your Qi-compatible device up to 5W. Its LED indicator lights up when you're charging. And it costs just $30.

What you need to know

• Microsoft today acquired Pull Panda and its suite of code review tools.
• The company's Pull Reminders, Pull Analytics, and Pull Assigner tools are now available for free as a GitHub Marketplace application.
• Microsoft plans to integrate the tools into GitHub in the future.

Microsoft-owned GitHub today announced that it has acquired Pull Panda, a firm that creates code review tools for the platform. Monetary details of the deal were not revealed, but Microsoft has made Pull Panda's tools available for free as a GitHub Marketplace application.

Pull Panda is behind three tools that make it easier for teams to collaborate on GitHub projects. Here's an overview, from GitHub:

• Pull Reminders: Get a nudge in Slack when a collaborator needs your review. Automatic reminders ensure that pull requests never slip through the cracks.
• Pull Analytics: From wait times to top contributors, get real-time insight into the effectiveness of your team's process. Then make data-driven improvements that create a more transparent and accountable culture.
• Pull Assigner: Automatically distribute code across your team, so no one gets overloaded and knowledge gets spread around.

As of the acquisition, Microsoft and GitHub are making all three tools available for free on the GitHub Marketplace. Going forward, GitHub says it plans to integrate these features into the platform, but there's no timetable for when that might take place.

Cheap PC accessories we love

Take a gander at these awesome PC accessories, all of which will enhance your Windows experience.

Anker 4 port USB 3.0 hub ($10 at Amazon)

Whether on a desktop or laptop PC, you always need more ports to connect things to. This hub gives you an additional four USB 3.0 Type A ports.

Ikea Fixa Cable Management System ($11 at Amazon)

This IKEA cable management kit is your ticket to a clean setup. It's simple and functional.

NZXT Puck ($20 at Amazon)

This clever little accessory has powerful magnets on the rear to make it stick to any of the metal panels on your PC case or anything else. It's great for hanging accessories like headsets.

What you need to know

• GitHub Sponsors lets you give money to the developers upong whose open source projects you rely.
• The program launches today in beta.
• Microsoft and GitHub have started a matching fund, which will see the companies match up to $5,000 in donations in the first year. GitHub also won't charge fees for the first year.

GitHub today launched a fresh way for developers to monetize their work on open source projects. Called GitHub Sponsors, the program launches in beta today and allows developers to contribute money to those who build open source software that others rely on.

Open source projects will now be able to add a "Sponsor" button to their repositories. Developers can set their own funding models, either through GitHub or with links to alternative platforms like Patreon and Open Collective.

"GitHub Sponsors is launching small and simple, but our mission is vast: to expand the opportunities to participate in and build on open source," GitHub said in a blog post announcing the project. "We're here to serve the developer community, and we're eagerly listening for your input about what else you'd like to see in GitHub Sponsors."

According to GitHub, anyone who contributes to open source projects, including writing code, documentation, or providing leadership, is "eligible for sponsorship." There are zero platform fees involved in the trnsactions. GitHub says it will also cover processing fees for the first 12 months of the program and it has also set up a "matching fund" that will match up to $5,000 in contributions through a developer's first year using GitHub Sponsors.

For now, the beta is limited to a "small number of sponsored developers," but you can currently join a waitlist to be considered for the next phase of the beta. For more on GitHub Sponsors, you can view GitHub's full FAQ.

Cheap PC accessories we love

Take a gander at these awesome PC accessories, all of which will enhance your Windows experience.

Anker 4 port USB 3.0 hub ($10 at Amazon)

Whether on a desktop or laptop PC, you always need more ports to connect things to. This hub gives you an additional four USB 3.0 Type A ports.

Ikea Fixa Cable Management System ($11 at Amazon)

This IKEA cable management kit is your ticket to a clean setup. It's simple and functional.

NZXT Puck ($20 at Amazon)

This clever little accessory has powerful magnets on the rear to make it stick to any of the metal panels on your PC case or anything else. It's great for hanging accessories like headsets.

A group of Microsoft employees today called on the company to stand in solidarity with Chinese tech workers who have adopted GitHub as a platform to protest unfair labor practices. In an open letter posted to GitHub in English and Chinese, the Microsoft employees urge their employer to resist any pressure to censor or remove the GitHub repository used by the Chinese workers (via Bloomberg).

The repository in question is called "996.ICU," which is a reference to the working hours that tech workers in China are protesting: 9 a.m. to 9 p.m., six days a week. The ICU refers to employees who work these hours eventually ending up in the Intensive Care Unit at hospitals from the grueling schedules. The repository serves as a place for workers to protest the working conditions and demand change.

Since its inception in March, a number of Chinese browsers have censored the repository. In their open letter, Microsoft employees are urging the company to resist pressure to remove the repository:

The letter is signed by "30 tech workers."

The letter is another effort by the "Microsoft Workers 4 Good" movement, which has advocated for change on a range of issues related to Microsoft and the tech industry at large, including efforts to combat climate change and ethical concerns over work with the U.S. military on lethal technology.