Inside ZCode: Silently uploading your Git history to the cloud
Trending on Hacker News: Inside ZCode: Silently uploading your Git history to the cloud (226 points / 87 comments, via blog.ferstar.org)
In one line
ZCode silently packages your entire workspace along with full Git history and uploads it to cloud object storage with server-exclusive decryption keys; this post reconstructs the complete upload pipeline and encryption scheme via local forensics and reverse engineering, and provides a filesystem immutability lock to …
Opening excerpt
Table of Contents Table of Contents I am not a native English speaker; this article was translated by AI.
It started with a routine check while freeing up disk space: ~/.zcode was taking up over 700MB. After digging into it intermittently, I confirmed something pretty wild:
Whenever you are logged in, ZCode (Zhipu’s official AI coding desktop app) silently packages your entire workspace — complete .git history, LFS asset cache, reflogs, and global app configs — encrypts it, and uploads it directly to Aliyun OSS.
Even more ironic: the RSA public key used for encryption is delivered on the fly by the server, while the private key lives exclusively in the cloud. You cannot decrypt that multi-hundred-megabyte ciphertext sitting right on your own disk, and neither can the ZCode client itself.
(Excerpted from the original; full article via the source link below.)
This story hit the Hacker News front page today (226 points / 87 comments, via blog.ferstar.org). Our Tech Radar aggregates daily signals on AI engineering, backend architecture and DevOps — browse the related services and further reading below, or get in touch with our team.
Source: Hacker News