Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Giteabot account was compromised

github.com

Post reply on HN
Print view View original

51–60 of 66 posts

Re: Giteabot account was compromised

#51

Post by mikeash »

peterwwillis wrote: post #24

I haven't actually done cryptographically signed continuously released applications before. I was just thinking about how it should work, and it seems a little complicated. I'm not sure how to safely sign the build. 1) You have to sign your code, obviously. If the code isn't signed, none of the resulting build artifacts can be trusted, because where did the code come from? 2) Once your code is signed, you can run a b…

You need reproducible builds, a trusted compiler, or an audit of the compiled binaries. Most of us go for the “trusted compiler” approach, and just really hope we’re right.

Re: Giteabot account was compromised

#52

Post by zaarn »

Cyberdog wrote: post #11
ljm wrote: post #8

Earlier quoted context omitted.

Perfect time to attack, really. Take advantage of the MS+Github hysteria and hunt for some exploits while people are scrambling around to migrate elsewhere. Probably a bit of exaggeration there, but there's a good chance that whatever was used to exploit Gitea has been there for quite a long time. A leaked personal access token for the bot account that was there for the taking all the time, if someone cared to scan t…

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

There is few scrambling and lots of people ensuring they have viable exit strategies for when we enter the timeline where Github goes down the drain.

Re: Giteabot account was compromised

#53

Post by TeMPOraL »

behringer wrote: post #36
ljm wrote: post #27

Earlier quoted context omitted.

In the grand scheme of things likely not, it's just a vocal minority that can dominate the perspective on social media and places like Reddit, talking about exodus and betrayal and who knows what. Sadly, it works...and it twists the narrative. The reports from Gitlab that they've had a significant uptick in signups can't be ignored though. Probably people in search of a new underdog since Atlassian and Bitbucket are…

Twist's whose narrative? MS' history is written plainly for all the world to see. https://en.wikipedia.org/wiki/Microsoft_litigation

Creates a false perception that significant amount of projects are moving away from GitHub.

Re: Giteabot account was compromised

#54

Post by kingosticks »

aaron_m04 wrote: post #43
mhils wrote: post #29

GitHub's permission system is quite brittle here: Anyone with write access to a repository can silently swap out binaries on the releases page, which are then still listed as "Verified" if the commit is signed. It's a complex problem, but the current approach feels subpar.

Sounds like a good opportunity for integration with GPG, keybase, and other signing tools.

I was surprised that there was no gitlab integration with keybase when I signed up last night to check it out. Not just to save me manually copying my key but for the cross-platform identity verification.

Re: Giteabot account was compromised

#55

Post by dspillett »

tpfour wrote: post #14
josteink wrote: post #5

Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.

Gitea isn't meant to replace Github... it's meant to be a self-hosted alternative to it. That's subtly different. I use it for as my local git server on Debian 9. Binary is in the /home/me/gitea directory. Run the usual gitea setup, then copy this to /home/me/.config/systemd/user/gitea.service: [Unit] Description=Gitea (Git with a cup of tea) After=syslog.target After=network.target [Service] RestartSec=2s Type=simpl…

> Gitea isn't meant to replace Github... it's meant to be a self-hosted alternative to it. That's subtly different.

Furthermore it is not unusual to see people run Gitea, GitLab, or just stock git, for their main repository and use GitHub as a public mirror. This takes advantage of GitHub's inertia, and acts as an extra backup.

The way git is design to be distributed makes this easy to achieve for the actual repositories. Issue tracking, CI, and everything else that isn't actually git (the core source control feature-set) isn't as easy of course, as that is more product specific.

Re: Giteabot account was compromised

#56

Post by feikname »

ljm wrote: post #27
Cyberdog wrote: post #11

Earlier quoted context omitted.

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

In the grand scheme of things likely not, it's just a vocal minority that can dominate the perspective on social media and places like Reddit, talking about exodus and betrayal and who knows what. Sadly, it works...and it twists the narrative. The reports from Gitlab that they've had a significant uptick in signups can't be ignored though. Probably people in search of a new underdog since Atlassian and Bitbucket are…

Out of curiosity, why would BitBucket be out of question?

Re: Giteabot account was compromised

#57

Post by kingosticks »

cosmojg wrote: post #35
soulchild37 wrote: post #13

Was thinking to install Gitea earlier and saw this on hackernews, is it safe to install using binary yet?

Yeah, it should be safe now. They re-released the binaries and set up 2FA.

Why is it possible to even create a group that doesn't mandate all users have 2FA?

Re: Giteabot account was compromised

#58

Post by lucb1e »

soulchild37 wrote: post #13

Was thinking to install Gitea earlier and saw this on hackernews, is it safe to install using binary yet?

Linux version has always been safe as far as I understand it. Not sure what platform you would have downloaded. Some distributions also have it in their repositories, and those were not affected either. It was really just the Windows binary hosted there.

Re: Giteabot account was compromised

#59

Post by justinclift »

dabber wrote: post #40
justinclift wrote: post #32

Earlier quoted context omitted.

dabbler's HN comment a few below yours has a link to them. https://github.com/go-gitea/gitea/issues/4167#issuecomment-3...

Haha, I appreciate your typo in my username. When I created this account a little over two years ago I mistakenly dropped the "l" and didn't realize for a few months (having only copied it from a pw manager.) By that point what was done was done. Years later it makes me a bit happy to think people may actually be reading it as it was intended.

Heh Heh Heh

Didn't even realise I'd gotten it wrong until you mentioned it. :)

Re: Giteabot account was compromised

#60

Post by graystevens »

saagarjha wrote: post #2

Has anyone taken a look at the binaries themselves to see what they do and how they differ from the official releases?

I've started to take a look at the binary that was uploaded - it seems it wasn't just Gitea that got hit by this, but also https://github.com/opencompany/www.opencompany.org which too has a strange release associated with the repository.

My findings as they go are being shoved into a blog post: https://grh.am/2018/a-look-at-the-compromised-gitea-release/

Post reply on HN