Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Giteabot account was compromised

github.com

Post reply on HN
Print view View original

41–50 of 66 posts

Re: Giteabot account was compromised

#41

Post by briandear »

superflyguy wrote: post #31
anothergoogler wrote: post #15

Earlier quoted context omitted.

Rational MS hatred?

Shitty OSes, naff late to the party phones and music players, convicted monopolists, tend to have arseholes running the company and are now paying 7 billion dollars to buy a company purely for the reputation, and it's people who are leaving GitHub who are not rational?

Does the product still work and provide the advertised service? If yes, then yes, it’s irrational. It isn’t like leaving GitHub is a multi-month process. It could be done in an instant.

It’s evacuating a house because there might be a fire in the future.

Re: Giteabot account was compromised

#43

Post by aaron_m04 »

mhils wrote: post #29

GitHub's permission system is quite brittle here: Anyone with write access to a repository can silently swap out binaries on the releases page, which are then still listed as "Verified" if the commit is signed. It's a complex problem, but the current approach feels subpar.

Sounds like a good opportunity for integration with GPG, keybase, and other signing tools.

Re: Giteabot account was compromised

#44

Post by aaron_m04 »

peterwwillis wrote: post #24

I haven't actually done cryptographically signed continuously released applications before. I was just thinking about how it should work, and it seems a little complicated. I'm not sure how to safely sign the build. 1) You have to sign your code, obviously. If the code isn't signed, none of the resulting build artifacts can be trusted, because where did the code come from? 2) Once your code is signed, you can run a b…

> The only way I can think to "confirm" this build artifact is genuine is to get multiple hosts to independently build the artifact identically and compare them. So you have to have reproducible builds. Which I don't think many people have.

This is an excellent idea, and has been done for Bitcoin and other projects: https://github.com/devrandom/gitian-builder It's probably troublesome to setup for a new project of significant size.

Re: Giteabot account was compromised

#45

Post by _emacsomancer_ »

Cyberdog wrote: post #11
ljm wrote: post #8

Earlier quoted context omitted.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

Other than what I would consider perfectly rational dislike of Microsoft (they have a long history of making the world a worse place), some people are old enough to remember what has happened to some of Microsoft's other acquisitions†, like Skype (which went from a promising p2p client to a funnel for the NSA which still doesn't work well or reliably). And consider what they've done with Windows 10: ads in the 'free' solitaire game (unless you pay a monthly fee), ads in the start menu, &c. &c.

Anyway, I think for lots of people it's just an impetus to move, a final push: Github is closed source, and there are competitors which are open source or at least 'open core'.

† Linkedin admittedly still seems pretty much the same, but even Microsoft would presumably have a hard time making Linkedin worse.

Re: Giteabot account was compromised

#46

Post by [deleted] »

mhils wrote: post #29

GitHub's permission system is quite brittle here: Anyone with write access to a repository can silently swap out binaries on the releases page, which are then still listed as "Verified" if the commit is signed. It's a complex problem, but the current approach feels subpar.

[deleted]

Re: Giteabot account was compromised

#47

Post by lsaferite »

_emacsomancer_ wrote: post #45
Cyberdog wrote: post #11

Earlier quoted context omitted.

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

Other than what I would consider perfectly rational dislike of Microsoft (they have a long history of making the world a worse place), some people are old enough to remember what has happened to some of Microsoft's other acquisitions†, like Skype (which went from a promising p2p client to a funnel for the NSA which still doesn't work well or reliably). And consider what they've done with Windows 10: ads in the 'free'…

> old enough to remember what has happened to some of Microsoft's other acquisitions†, like Skype

But that was only 7 years ago.

Re: Giteabot account was compromised

#48

Post by bad_user »

behringer wrote: post #36
ljm wrote: post #27

Earlier quoted context omitted.

In the grand scheme of things likely not, it's just a vocal minority that can dominate the perspective on social media and places like Reddit, talking about exodus and betrayal and who knows what. Sadly, it works...and it twists the narrative. The reports from Gitlab that they've had a significant uptick in signups can't be ignored though. Probably people in search of a new underdog since Atlassian and Bitbucket are…

Twist's whose narrative? MS' history is written plainly for all the world to see. https://en.wikipedia.org/wiki/Microsoft_litigation

Fake news :-)

Re: Giteabot account was compromised

#49

Post by mikeash »

briandear wrote: post #41
superflyguy wrote: post #31

Earlier quoted context omitted.

Shitty OSes, naff late to the party phones and music players, convicted monopolists, tend to have arseholes running the company and are now paying 7 billion dollars to buy a company purely for the reputation, and it's people who are leaving GitHub who are not rational?

Does the product still work and provide the advertised service? If yes, then yes, it’s irrational. It isn’t like leaving GitHub is a multi-month process. It could be done in an instant. It’s evacuating a house because there might be a fire in the future.

If it can be done in an instant, why wait?

Re: Giteabot account was compromised

#50

Post by setquk »

briandear wrote: post #41
superflyguy wrote: post #31

Earlier quoted context omitted.

Shitty OSes, naff late to the party phones and music players, convicted monopolists, tend to have arseholes running the company and are now paying 7 billion dollars to buy a company purely for the reputation, and it's people who are leaving GitHub who are not rational?

Does the product still work and provide the advertised service? If yes, then yes, it’s irrational. It isn’t like leaving GitHub is a multi-month process. It could be done in an instant. It’s evacuating a house because there might be a fire in the future.

I think of it more like leaving a planet because the galactic empire just bought it and is about to hollow it out to build starkiller 2.
Post reply on HN