Over 100k Infected Repos Found on GitHub
apiiro.com
Over 100k Infected Repos Found on GitHub
1–10 of 187 posts
Re: Over 100k Infected Repos Found on GitHub
#2I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.
Re: Over 100k Infected Repos Found on GitHub
#3I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.
> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.
The complexity of digital life takes on dimensions that make me doubt whether it can continue in the long term.
Re: Over 100k Infected Repos Found on GitHub
#4Despite its possibilities, GitHub cannot prevent all this - what happens to the other providers such as Codeberg, etc.?
Re: Over 100k Infected Repos Found on GitHub
#5I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.
Every year, qubes looks more reasonable:)
Re: Over 100k Infected Repos Found on GitHub
#6I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.
> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. The complexity of digital life takes on dimensions that make me doubt whether it can continue in the long term.
I think this is just another opportunity to create new services. I've seriously considered moving all my stuff (except gaming) into something like apache guacamole. I'm already used to remote dev-ing over ssh and once you can easily get your desktop anywhere without even needing a client, there's no real reason to run everything on the one system you happen to be sitting at. And if internet connectivity is still an issue in your country you could even run this setup locally. Maybe find a way to sync it with a remote system. I'm pretty sure this is the future anyways.
Re: Over 100k Infected Repos Found on GitHub
#7Despite its possibilities, GitHub cannot prevent all this - what happens to the other providers such as Codeberg, etc.?
> Despite its possibilities
You mean despite its (financial) resources?
Re: Over 100k Infected Repos Found on GitHub
#8Despite its possibilities, GitHub cannot prevent all this - what happens to the other providers such as Codeberg, etc.?
I don't know but I guess the smaller fish are protected by virtue of them not being worth the automation effort. A bad actor can spend a lot of time and effort attacking Github and have their efforts exposed to so many more developers than the same sort of effort on, say, Codeberg would achieve.
Re: Over 100k Infected Repos Found on GitHub
#9I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.
Check out container-shell [1] it is one of the use cases. Not a VM but a docker container. Chroot a directory in a container, and does some automatic house keeping etc
Re: Over 100k Infected Repos Found on GitHub
#10So who's behind this? Who's doing something about it? Where's Homeland Security on this?
This is their job. This is an attack.
"The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, along with dependency confusion campaigns plaguing package registries and generally malicious code being spread through source control managers, demonstrates how fragile software supply chain security is, despite the abundance of tools and available security mechanisms."