Giteabot account was compromised
github.com
Giteabot account was compromised
1–10 of 66 posts
Re: Giteabot account was compromised
#2Has anyone taken a look at the binaries themselves to see what they do and how they differ from the official releases?
Re: Giteabot account was compromised
#3Has anyone taken a look at the binaries themselves to see what they do and how they differ from the official releases?
Far as I know, no. Asked this question on the issue page. Really want to find out as I have at least one server that could have been affected. Kind of frustrating that this is all the information there is.
Re: Giteabot account was compromised
#4ouch, this is a case where things like red october by cloudflare could be a great idea. Having to have a minimum number of signers to agree to sign a package would be a good way to prevent this.
Re: Giteabot account was compromised
#5Funny to see this news posted on github, after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout.
Good thing on them being open about it though, despite it probably costing them some potential traction.
Re: Giteabot account was compromised
#6Yikes, no code signing certificate, no details filled out for details or even a copyright, at least on the exe I examined.
Re: Giteabot account was compromised
#7Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.
Many projects are ironically this way. Gitea, gogs, yunohost, sandstorm to name a few.
Re: Giteabot account was compromised
#8Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.
Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere.
Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan their CI logs. Something like that.
Re: Giteabot account was compromised
#9Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.
Many projects are ironically this way. Gitea, gogs, yunohost, sandstorm to name a few.
I think they solve different problems. Gogs is amazing for a self hosted git repo. Not so much for collaborating with thousands of people around the world. Centralization can be a very good thing if done by an ethical company with the right incentives. The only reason decentralization is useful is when you can't trust anyone for anything. I'd rather live in, and work towards, a world where that's not the case.
Re: Giteabot account was compromised
#10[deleted]