Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

41–50 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#41

Post by google234123 »

BlueTemplar wrote: post #24
rcbdev wrote: post #21

Earlier quoted context omitted.

The latency issue is increasingly disappearing or at least becoming negligible in most population centers. For example, in my country almost every company uses Citrix (no affiliation) or similar workspace solutions, where the entire workstation is virtualized in a data center and you only access via a thin client. Entire nations of people work like this already. Cloud gaming will probably be the next frontier in this…

(Real time) cloud gaming only works with a very low latency internet connection, which requires wiring, which leaves out most of the non-city users (and still some city ones). Not to mention that it's ridiculously wasteful.

What percent of consoles/gaming pcs are being used for gaming in average per hour? 15%?

Re: Over 100k Infected Repos Found on GitHub

#42

Post by mgii »

dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

There seems to be a lot of confusion between malware and vulnerabilities. None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities.

Good as they'll be in detecting vulnerabilities, you are still unprotected from malicious code planted in your code bases.

Re: Over 100k Infected Repos Found on GitHub

#43

Post by AlienRobot »

I have always wondered how do these malicious actors with their bots manage to do so much. Do they ever get caught? It's like there is no deterrent.

For example, if you use bots to spam Wordpress blogs with comments that contain links to your site (black hat SEO), that is obviously a bad thing to do, but I'm not sure if it's even against a law.

Re: Over 100k Infected Repos Found on GitHub

#44

Post by kristopolous »

This sounds solvable with some kind of painful to write and test heuristic tool.

Something like "find other repos with similar product names and similar code but no forking audit trail" ... If you do an automated code diff and find it's involving say, posting stuff to a server, you can become suspicious. All these signals can become rather shallow with the right tooling

centralizing this would make it a bit more efficient because you can just cache things and respond fairly immediately

Re: Over 100k Infected Repos Found on GitHub

#47

Post by prmoustache »

alentred wrote: post #27
dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

You may look into Trivy [0] , works very well for me so far. [0] https://trivy.dev/

Trivy only do a CVE / package version mapping. It will not tell you you are using a malicious package from an unknown repo because of typosquatting or bad practices.

Re: Over 100k Infected Repos Found on GitHub

#49

Post by jack_pp »

BlueTemplar wrote: post #24
rcbdev wrote: post #21

Earlier quoted context omitted.

The latency issue is increasingly disappearing or at least becoming negligible in most population centers. For example, in my country almost every company uses Citrix (no affiliation) or similar workspace solutions, where the entire workstation is virtualized in a data center and you only access via a thin client. Entire nations of people work like this already. Cloud gaming will probably be the next frontier in this…

(Real time) cloud gaming only works with a very low latency internet connection, which requires wiring, which leaves out most of the non-city users (and still some city ones). Not to mention that it's ridiculously wasteful.

I'd say it's rather more wasteful for everyone to have expensive rigs to play games a couple of hours a day when we could share computing resources in the cloud
Post reply on HN