Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Giteabot account was compromised

github.com

Post reply on HN
Print view View original

11–20 of 66 posts

Re: Giteabot account was compromised

#11

Post by Cyberdog »

ljm wrote: post #8
josteink wrote: post #5

Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

Re: Giteabot account was compromised

#12

Post by ljm »

amaccuish wrote: post #4

ouch, this is a case where things like red october by cloudflare could be a great idea. Having to have a minimum number of signers to agree to sign a package would be a good way to prevent this.

Even simpler, have the releases performed by a human account. It can still be compromised but you're not going to be storing your own GitHub credentials on a server or inside a CI flow so it can automatically write on your behalf. You probably shouldn't be releasing so often that it's a pain in the ass to perform it manually (in terms of tagging in git rather than doing a full on deploy to a server or something).

It also means that maintainers are accountable for each release and if something like this happens, you know exactly who you need to talk to to get the situation resolved, which might be something as simple as setting a stronger password or not committing a GitHub token into their public dotfiles.

Re: Giteabot account was compromised

#14

Post by tpfour »

josteink wrote: post #5

Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.

Gitea isn't meant to replace Github... it's meant to be a self-hosted alternative to it. That's subtly different.

I use it for as my local git server on Debian 9. Binary is in the /home/me/gitea directory. Run the usual gitea setup, then copy this to /home/me/.config/systemd/user/gitea.service:

  [Unit]
  Description=Gitea (Git with a cup of tea)
  After=syslog.target
  After=network.target

  [Service]
  RestartSec=2s
  Type=simple
  WorkingDirectory=/home/me/gitea
  ExecStart=/home/me/gitea/gitea web
  Restart=always

  [Install]
  WantedBy=default.target
Then just systemctl --user daemon-reload && systemctl --user enable gitea. Then visit localhost:3000 and add it to your remotes (git remote add local ...) and you can push your changes to your own gitea instance.

Re: Giteabot account was compromised

#15

Post by anothergoogler »

Cyberdog wrote: post #11
ljm wrote: post #8

Earlier quoted context omitted.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

Rational MS hatred?

Re: Giteabot account was compromised

#16

Post by jcahill »

josteink wrote: post #5

Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.

"I get all my news from facebook. Look, a Trending story about a facebook competitor. hheheheheh"

Italics doesn't make your comment any less circular or beside the point for people looking to move away from github.

Re: Giteabot account was compromised

#17

Post by hk__2 »

tpfour wrote: post #14
josteink wrote: post #5

Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.

Gitea isn't meant to replace Github... it's meant to be a self-hosted alternative to it. That's subtly different. I use it for as my local git server on Debian 9. Binary is in the /home/me/gitea directory. Run the usual gitea setup, then copy this to /home/me/.config/systemd/user/gitea.service: [Unit] Description=Gitea (Git with a cup of tea) After=syslog.target After=network.target [Service] RestartSec=2s Type=simpl…

> Then visit localhost:3000 and add it to your remotes (git remote add local ...) and you can push your changes to your own gitea instance.

Why would you want to run a git server on your personal computer?

Re: Giteabot account was compromised

#19

Post by Zamicol »

Cyberdog wrote: post #11
ljm wrote: post #8

Earlier quoted context omitted.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

I don't think it's irrational.

I actively choose not to support such an organization. If Microsoft got serious about being moral and then I'd play ball.

https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...

Re: Giteabot account was compromised

#20

Post by arwineap »

hk__2 wrote: post #17
tpfour wrote: post #14

Earlier quoted context omitted.

Gitea isn't meant to replace Github... it's meant to be a self-hosted alternative to it. That's subtly different. I use it for as my local git server on Debian 9. Binary is in the /home/me/gitea directory. Run the usual gitea setup, then copy this to /home/me/.config/systemd/user/gitea.service: [Unit] Description=Gitea (Git with a cup of tea) After=syslog.target After=network.target [Service] RestartSec=2s Type=simpl…

> Then visit localhost:3000 and add it to your remotes (git remote add local ...) and you can push your changes to your own gitea instance. Why would you want to run a git server on your personal computer?

If you have ssh enabled with an accessible git repo; you already do!
Post reply on HN