Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

101–110 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#101

Post by bunderbunder »

underscoring wrote: post #98
silvestrov wrote: post #54

Github is failing the same way usenet failed: everybody could post stuff to usenet just like everybody can create a github repository and there is nothing that sets an official repository apart from a spammers repository. When Amazon has "the everything store" as main strategic goal, they get hit by "90% of everything is junk". So they end up being a store of mostly junk. Github should figure out if their product is…

> or it is "I can trust this code". what might be better would be some kind of trust layer built into package managers so they (optionally) only allow verified repos to be installed

Doing that well would cost money, and people are used to getting their package managers for free.

Re: Over 100k Infected Repos Found on GitHub

#102

Post by zoover2020 »

efortis wrote: post #55
pas wrote: post #51

Earlier quoted context omitted.

instead the downloaded malicious code runs in prod. maybe, if you are lucky, it does something strange in CI and you can catch it. the only real solution is a reputation system (like https://github.com/crev-dev/cargo-crev ), which of course is unfortunately barely used

Correct, the above mitigation is only for malware on the dev laptops and build servers. IOW, it doesn't prevent injecting the malware on your program when compiling it.

Shouldn't build servers have limited or zero network connectivity in the first place?

Re: Over 100k Infected Repos Found on GitHub

#103

Post by olabyne »

begueradj wrote: post #40

Less than 1 year ago, a repository with a Trojan horse virus: https://github.com/orgs/community/discussions/63603

> The repository [...] claims to be a password stealer

> However, when I downloaded and Extract it,[...] it stole my personal information and files.

Well, I don't see where is the problem here. The repo is doing exactly what it claims

Re: Over 100k Infected Repos Found on GitHub

#105

Post by egberts1 »

cqqxo4zV46cp wrote: post #66
dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

This sounds like alarmist journalist talk. What “malware”, even subtle backdoors, are sneaking into the LLM-generated code used in a piece of software that’s actually worth a damn?

Try this "write me a port scanning code in Packrat-style JavaScript language that can run from within a PDF document."

Re: Over 100k Infected Repos Found on GitHub

#107

Post by yencabulator »

justinclift wrote: post #88

Wonder if the whole curl + sudo shell script installer thing is going to come to an end any time soon? aka the whole "just run 'curl https://somesite/install.sh ' | sudo sh" to install our software Seems like it'd go very hand in hand with this infected stuff mentioned in the article.

Unfortunately `npm i` has the same power.

`go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time.

I think we need better tooling for working in sandboxes, to at least compartmentalize the explosion. ChromeOS's "virtual machines can open Wayland windows on the main desktop" trick is neat, but the code needed to do that was less than clean or reusable when I last looked.

Re: Over 100k Infected Repos Found on GitHub

#108

Post by mrob »

w8whut wrote: post #58
rcbdev wrote: post #21

Earlier quoted context omitted.

The latency issue is increasingly disappearing or at least becoming negligible in most population centers. For example, in my country almost every company uses Citrix (no affiliation) or similar workspace solutions, where the entire workstation is virtualized in a data center and you only access via a thin client. Entire nations of people work like this already. Cloud gaming will probably be the next frontier in this…

> The latency issue is increasingly disappearing or at least becoming negligible in most population centers I believe that thats your experience. Its not really because the technology is improving though, its because you're growing older. The latency is absolutely horrendous, and anyone thats used to a decently performing system will not agree with your opinion. As a simple example: i can easily code 6+h with no brea…

Alternatively, they're young enough that they've never experienced good latency and don't know what they're missing. See:

https://danluu.com/input-lag/

Re: Over 100k Infected Repos Found on GitHub

#109

Post by brookst »

2devnull wrote: post #72
silvestrov wrote: post #54

Github is failing the same way usenet failed: everybody could post stuff to usenet just like everybody can create a github repository and there is nothing that sets an official repository apart from a spammers repository. When Amazon has "the everything store" as main strategic goal, they get hit by "90% of everything is junk". So they end up being a store of mostly junk. Github should figure out if their product is…

Strong disagree. It’s not GitHub’s job to tell you what’s good or bad. Only the user of the code can do that because it’s context specific. “I can trust this code” is a fantasy that won’t happen. Don’t trust code, test it.

This seems like the “don’t use seat belts, drive safely” argument.

Trust mechanisms in GitHub/etc can’t solve the whole problem, for sure.

But some automated safety mechanisms at scale can reduce the risk for those who don’t follow perfect security practices, which has value to the world at large.

Very few of us have the capacity to do even cursory validation for every update to every dependency of every bit of software we use.

Re: Over 100k Infected Repos Found on GitHub

#110

Post by ben_w »

cqqxo4zV46cp wrote: post #66
dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

This sounds like alarmist journalist talk. What “malware”, even subtle backdoors, are sneaking into the LLM-generated code used in a piece of software that’s actually worth a damn?

We'll only find out by looking.

Given that LLMs are popular coding assistants, I suspect there are already many issues similar to `goto fail;`

Post reply on HN