Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

21–30 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#21

Post by rcbdev »

geraldhh wrote: post #12
sigmoid10 wrote: post #6

Earlier quoted context omitted.

I think this is just another opportunity to create new services. I've seriously considered moving all my stuff (except gaming) into something like apache guacamole. I'm already used to remote dev-ing over ssh and once you can easily get your desktop anywhere without even needing a client, there's no real reason to run everything on the one system you happen to be sitting at. And if internet connectivity is still an i…

> there's no real reason to run everything on the one system you happen to be sitting at theoretically. in practice the added latency is a problem outside of casual use. update: clarification seems to be neccessary as i was talking about audio/video/gaming type workload, NOT office stuff

The latency issue is increasingly disappearing or at least becoming negligible in most population centers. For example, in my country almost every company uses Citrix (no affiliation) or similar workspace solutions, where the entire workstation is virtualized in a data center and you only access via a thin client. Entire nations of people work like this already.

Cloud gaming will probably be the next frontier in this.

Re: Over 100k Infected Repos Found on GitHub

#22

Post by verisimi »

Animats wrote: post #10

So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…

> Where's Homeland Security on this?

Who knows who's behind it?

Re: Over 100k Infected Repos Found on GitHub

#23

Post by simonjgreen »

sigmoid10 wrote: post #2

I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.

I hate to call it out, but, isn’t that table stakes? Blending work and personal environments should be an obvious no. Are employers out there ok with this?

Re: Over 100k Infected Repos Found on GitHub

#24

Post by BlueTemplar »

rcbdev wrote: post #21
geraldhh wrote: post #12

Earlier quoted context omitted.

> there's no real reason to run everything on the one system you happen to be sitting at theoretically. in practice the added latency is a problem outside of casual use. update: clarification seems to be neccessary as i was talking about audio/video/gaming type workload, NOT office stuff

The latency issue is increasingly disappearing or at least becoming negligible in most population centers. For example, in my country almost every company uses Citrix (no affiliation) or similar workspace solutions, where the entire workstation is virtualized in a data center and you only access via a thin client. Entire nations of people work like this already. Cloud gaming will probably be the next frontier in this…

(Real time) cloud gaming only works with a very low latency internet connection, which requires wiring, which leaves out most of the non-city users (and still some city ones).

Not to mention that it's ridiculously wasteful.

Re: Over 100k Infected Repos Found on GitHub

#25

Post by chha »

dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

We tend to avoid using github repos, but go for published packages from the usual sites; Nuget, Pypi, Npm etc, using Repository and Firewall from Sonatype to act as a proxy between us and the package repos. All packages are analyzed and tagged with various metadata by Sonatype. Firewall lets us define policies for what we can use, and will filter out everything else.

This only works for published dependencies, but based on a couple years experience it works really well. No issues with malware (so far), we don't let packages with known vulns into our codebases and we are notified if a vuln is discovered in something we use.

Re: Over 100k Infected Repos Found on GitHub

#26

Post by bagels »

verisimi wrote: post #22
Animats wrote: post #10

So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…

> Where's Homeland Security on this? Who knows who's behind it?

Isn't that what they should be investigating? Are you trying to imply something with that question?

Re: Over 100k Infected Repos Found on GitHub

#27

Post by alentred »

dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

You may look into Trivy [0] , works very well for me so far.

[0] https://trivy.dev/

Re: Over 100k Infected Repos Found on GitHub

#28

Post by verisimi »

bagels wrote: post #26
verisimi wrote: post #22

Earlier quoted context omitted.

> Where's Homeland Security on this? Who knows who's behind it?

Isn't that what they should be investigating? Are you trying to imply something with that question?

Its not unheard of for intelligence agencies to create and exploit weaknesses.

Re: Over 100k Infected Repos Found on GitHub

#29

Post by Pepe1vo »

dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

We use Semgrep Supply Chain at work and are reasonably satisfied with it. It splits the supply chain vulnerabilities it found into the categories: reachable, unreachable and undetermined. This makes triaging much easier and it has reduced the time we spent on assessing new vulnerabilities by quite a lot.

Re: Over 100k Infected Repos Found on GitHub

#30

Post by TaylorAlexander »

simonjgreen wrote: post #23
sigmoid10 wrote: post #2

I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. I hate to call it out, but, isn’t that table stakes? Blending work and personal environments should be an obvious no. Are employers out there ok with this?

I used to work at Google where all computers were militantly segregated from non work stuff. Now I run a little non profit robotics org with one other person, and when I work from home I just use my personal desktop with no separation.

It depends on where you work, how much people will care and whether there are resources to do anything about it.

Post reply on HN