Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

61–70 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#61

Post by UrineSqueegee »

silvestrov wrote: post #54

Github is failing the same way usenet failed: everybody could post stuff to usenet just like everybody can create a github repository and there is nothing that sets an official repository apart from a spammers repository. When Amazon has "the everything store" as main strategic goal, they get hit by "90% of everything is junk". So they end up being a store of mostly junk. Github should figure out if their product is…

I don't think you truly grasp how small this number is, this is actually good, like really really good. Github has about half a billion repositories.

Re: Over 100k Infected Repos Found on GitHub

#62

Post by 63stack »

jack_pp wrote: post #49
BlueTemplar wrote: post #24

Earlier quoted context omitted.

(Real time) cloud gaming only works with a very low latency internet connection, which requires wiring, which leaves out most of the non-city users (and still some city ones). Not to mention that it's ridiculously wasteful.

I'd say it's rather more wasteful for everyone to have expensive rigs to play games a couple of hours a day when we could share computing resources in the cloud

I would love to have this, but this is very naive in the current economic climate. There is already a notion of trying to get rid of general computing devices from Apple, Google, and Microsoft. They would immediately use the opportunity to corner the market, lock down everything, and start extorting more money. There is no way I would give up my personal desktop.

Re: Over 100k Infected Repos Found on GitHub

#63

Post by boffinAudio »

verisimi wrote: post #28
bagels wrote: post #26

Earlier quoted context omitted.

Isn't that what they should be investigating? Are you trying to imply something with that question?

Its not unheard of for intelligence agencies to create and exploit weaknesses.

The Vault7 operators called. They want their exploit back.

Re: Over 100k Infected Repos Found on GitHub

#64

Post by KronisLV »

sigmoid10 wrote: post #6
Ringz wrote: post #3

Earlier quoted context omitted.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. The complexity of digital life takes on dimensions that make me doubt whether it can continue in the long term.

I think this is just another opportunity to create new services. I've seriously considered moving all my stuff (except gaming) into something like apache guacamole. I'm already used to remote dev-ing over ssh and once you can easily get your desktop anywhere without even needing a client, there's no real reason to run everything on the one system you happen to be sitting at. And if internet connectivity is still an i…

I remember using a variety of VNC/RDP over local network for connecting to my laptop, so I could do development there and keep the codebase completely separate from my other machines, while still using my desktop keyboard, mouse and larger monitor. I'd just turn it on, connect to it and treat it as another window in the OS.

That said, I think we either need proper OS level sandboxing, something like Qubes or just using multiple VMs or devices with remoting. It doesn't feel viable to have something like Discord or other communication software or things with account tokens, and executables like software or games running on the same install, whereas dual booting isn't viable for that either.

Re: Over 100k Infected Repos Found on GitHub

#65

Post by dspillett »

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question:

If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malware in response to coding questions that generate responses long enough for accidentally malicious parts to hide amongst? Simpler vulnerabilities such as simple injection vectors have often been seen already.

Re: Over 100k Infected Repos Found on GitHub

#66

Post by cqqxo4zV46cp »

dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

This sounds like alarmist journalist talk. What “malware”, even subtle backdoors, are sneaking into the LLM-generated code used in a piece of software that’s actually worth a damn?

Re: Over 100k Infected Repos Found on GitHub

#67

Post by brabel »

silvestrov wrote: post #54

Github is failing the same way usenet failed: everybody could post stuff to usenet just like everybody can create a github repository and there is nothing that sets an official repository apart from a spammers repository. When Amazon has "the everything store" as main strategic goal, they get hit by "90% of everything is junk". So they end up being a store of mostly junk. Github should figure out if their product is…

That's a Java library, so you would download it from Maven Central, not GitHub (unless you're doing something non-default)... And Sonatype requires that you prove ownership of the reversed domain used in the groupId, which in this case is `org.postgresql`. You can see how to do that here: https://central.sonatype.org/faq/how-to-set-txt-record/

For extra piece of mind, you can also check the GPG signatures as all artifacts are signed when published to Maven Central... you need to get the key used by Postgres to sign that somehow independently from Sonatype. That's a downside of this mechanism, you just need to know for each publisher, where to get their GPG keys from. In the case of PG, I couldn't even find it with a quick google search.

Re: Over 100k Infected Repos Found on GitHub

#68

Post by drsim »

cqqxo4zV46cp wrote: post #66
dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

This sounds like alarmist journalist talk. What “malware”, even subtle backdoors, are sneaking into the LLM-generated code used in a piece of software that’s actually worth a damn?

It’s a valid question to posit.

Re: Over 100k Infected Repos Found on GitHub

#69

Post by FuriouslyAdrift »

dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

Self-hosted GitLab.

Re: Over 100k Infected Repos Found on GitHub

#70

Post by BlueTemplar »

jack_pp wrote: post #49
BlueTemplar wrote: post #24

Earlier quoted context omitted.

(Real time) cloud gaming only works with a very low latency internet connection, which requires wiring, which leaves out most of the non-city users (and still some city ones). Not to mention that it's ridiculously wasteful.

I'd say it's rather more wasteful for everyone to have expensive rigs to play games a couple of hours a day when we could share computing resources in the cloud

By definition, everyone doesn't have expensive rigs.

But you're right, one shouldn't automatically assume that streaming is more wasteful than letting the resources sit idle... (one issue here is the assumptions about how fast computers are replaced for consumerist reasons ?)

(And this would still leave the issue of the loss of ownership.)

Post reply on HN