Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Giteabot account was compromised

github.com

Post reply on HN
Print view View original

21–30 of 66 posts

Re: Giteabot account was compromised

#21

Post by Zamicol »

aphextron wrote: post #9
the_common_man wrote: post #7

Earlier quoted context omitted.

Many projects are ironically this way. Gitea, gogs, yunohost, sandstorm to name a few.

I think they solve different problems. Gogs is amazing for a self hosted git repo. Not so much for collaborating with thousands of people around the world. Centralization can be a very good thing if done by an ethical company with the right incentives. The only reason decentralization is useful is when you can't trust anyone for anything. I'd rather live in, and work towards, a world where that's not the case.

Would decentralization's value also hold true as technical barriers fall?

The costs of centralized organization must continue to fall (even "negative" costs) to compete against any advantage decentralized solution realize as the cost of the technology falls.

Re: Giteabot account was compromised

#22

Post by m_sahaf »

amaccuish wrote: post #4

ouch, this is a case where things like red october by cloudflare could be a great idea. Having to have a minimum number of signers to agree to sign a package would be a good way to prevent this.

This approach is probably an overkill, but this project called Cothority[0] can be used to verify binaries by semi-independent authorities to be released. One of the applications referenced in their dotSecurity talk[1] was this usecase.

[0] https://github.com/dedis/cothority

[1] https://www.youtube.com/watch?v=YostyJRwqVU

Re: Giteabot account was compromised

#23

Post by tpfour »

hk__2 wrote: post #17
tpfour wrote: post #14

Earlier quoted context omitted.

Gitea isn't meant to replace Github... it's meant to be a self-hosted alternative to it. That's subtly different. I use it for as my local git server on Debian 9. Binary is in the /home/me/gitea directory. Run the usual gitea setup, then copy this to /home/me/.config/systemd/user/gitea.service: [Unit] Description=Gitea (Git with a cup of tea) After=syslog.target After=network.target [Service] RestartSec=2s Type=simpl…

> Then visit localhost:3000 and add it to your remotes (git remote add local ...) and you can push your changes to your own gitea instance. Why would you want to run a git server on your personal computer?

For me it has the following advantages:

- In-browser viewing of diffs and code - Issues management - Showing code to clients/other devs is simpler and prettier. - Can push to local and run tests on a fresh repo pulled in a VM

Honestly as with mostly everything, it can be achieved by other means. It's just what feels good to me. It's extremely lightweight but robust and fits well in my work environment. That is all code editing is done in Emacs with millions of opened tabs in Chrome. I make extensive use of workspaces in xfce and I just Ctrl-Alt-(Right/Left) my way around going back and forth Emacs/Chrome. I could just have a file manager opened and double click on every file, or open them in Emacs, but that isn't always necessarily faster (for me).

Tldr: Personal preference.

Re: Giteabot account was compromised

#24

Post by peterwwillis »

I haven't actually done cryptographically signed continuously released applications before. I was just thinking about how it should work, and it seems a little complicated. I'm not sure how to safely sign the build.

1) You have to sign your code, obviously. If the code isn't signed, none of the resulting build artifacts can be trusted, because where did the code come from?

2) Once your code is signed, you can run a build on verified-only code artifacts, which can produce a build artifact. But if the server doing the build is compromised, you can just put anything at all in the built artifact before it's signed. Sure, you had signed code, but if I can inject my own code into the compiler (or whatever) or just take over the build process and give it my own code, then I can make any kind of build artifact I want.

The only way I can think to "confirm" this build artifact is genuine is to get multiple hosts to independently build the artifact identically and compare them. So you have to have reproducible builds. Which I don't think many people have.

So, what part of the pipeline am I missing?

Re: Giteabot account was compromised

#25

Post by dmurray »

Cyberdog wrote: post #11
ljm wrote: post #8

Earlier quoted context omitted.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

Even if only 2% of projects have an irrational hatred of MS and are scrambling to migrate away, that's still a huge influx to Gitea/Gitlab/etc in a short space of time.

Re: Giteabot account was compromised

#27

Post by ljm »

Cyberdog wrote: post #11
ljm wrote: post #8

Earlier quoted context omitted.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

In the grand scheme of things likely not, it's just a vocal minority that can dominate the perspective on social media and places like Reddit, talking about exodus and betrayal and who knows what. Sadly, it works...and it twists the narrative.

The reports from Gitlab that they've had a significant uptick in signups can't be ignored though. Probably people in search of a new underdog since Atlassian and Bitbucket are out of the equation there.

Re: Giteabot account was compromised

#28

Post by jelevoir »

Cyberdog wrote: post #11
ljm wrote: post #8

Earlier quoted context omitted.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

A little careless and embarrassing to admit on my part... but I migrated away because the Microsoft purchase reminded me I was paying for a service I no long used. GitLab has free private repos. GitHub does not.

Re: Giteabot account was compromised

#29

Post by mhils »

GitHub's permission system is quite brittle here: Anyone with write access to a repository can silently swap out binaries on the releases page, which are then still listed as "Verified" if the commit is signed. It's a complex problem, but the current approach feels subpar.
Post reply on HN