Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

141–150 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#141

Post by fsflover »

prmoustache wrote: post #53
fsflover wrote: post #15

Earlier quoted context omitted.

Sounds like a good reason to use Qubes OS, where everything runs in VMs by default (my daily driver).

My experience with Qubes OS had been so so last time I've tried it. Have they managed to get rid of Xorg and the terrible screen tearing issue that should be a thing of the past in 2023? I remember there was a project named SpectrumOS that tried to do something similar to QubesOS but with nixos, crosVM and wayland. AFAIK the project stalled. I am using a sort of middle ground between traditionnal desktop and QubesOS.…

Are you using an Nvidia GPU?

https://github.com/QubesOS/qubes-issues/issues/5104

https://github.com/QubesOS/qubes-issues/issues/7591

If not, try this: https://github.com/QubesOS/qubes-issues/issues/6880#issuecom...

There is no tearing on my Librem laptops.

Re: Over 100k Infected Repos Found on GitHub

#142

Post by keepamovin »

boringg wrote: post #106

Stupid question here -- whats the most efficient way to evaluate for vulnerabilities (i.e. remove the low level risk like 95% of the cases)? Is it trust the package manager or is there another quick way?

Like 0ther folks say elsewhere in these threads, the most efficient way is not to eval for vulns, but to assume compromise.

So, folks adopt the (admittedly ridiculous, but, in the strict sense, necessary) 0-trust step of running everything in QubesOS, then in a VM, and maybe then in Docker.

Essentially each application gets its own fresh OS to fuck up or not...as it goes.

I get this (but I don't condone it). It's not practical for dev purposes, only if you are endlessly testing the waters for each little thing. But, prolly, eventually we will be wowed by a shiny-thing that achieves infinity-virtualization with bare metal performance but perfect isolation so we can easiily run

  infinvm run github.com/malware/repo
And all will be right with the world.

We ain't there yet tho. Hahaha :)

Re: Over 100k Infected Repos Found on GitHub

#143

Post by prmoustache »

fsflover wrote: post #141
prmoustache wrote: post #53

Earlier quoted context omitted.

My experience with Qubes OS had been so so last time I've tried it. Have they managed to get rid of Xorg and the terrible screen tearing issue that should be a thing of the past in 2023? I remember there was a project named SpectrumOS that tried to do something similar to QubesOS but with nixos, crosVM and wayland. AFAIK the project stalled. I am using a sort of middle ground between traditionnal desktop and QubesOS.…

Are you using an Nvidia GPU? https://github.com/QubesOS/qubes-issues/issues/5104 https://github.com/QubesOS/qubes-issues/issues/7591 If not, try this: https://github.com/QubesOS/qubes-issues/issues/6880#issuecom... There is no tearing on my Librem laptops.

Nope, but regarldess of drivers, xorg has never been pixel perfect and tearing do happens. You are just probably used to it but it is obvious once you have started using wayland how smoother your desktop becomes.

It is the first time I hear about that Tearfree option and I am wondering. If it exists and it isn't the default behavior, it means there must be some annoying drawbacks right?

Re: Over 100k Infected Repos Found on GitHub

#144

Post by lolbullshit »

dns_snek wrote: post #86
dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

I'm less worried about backdoors accidentally appearing in LLM output and more worried about backdoors being placed into LLM output by 3 letter agencies. Maybe not today, but certainly in a few years time.

the government doesnt need to produce viruses anymore. They have escrow services and remote access to radios, processors, firmware chips. All that technology is leased to private investigators who are private entities and then they go after people using the tools. It allows distance between the government and spying, lower salaies and infrastructure costs.

The greatest danger from LLMs is people who beleive they are receiveing data that hasnt been tampered with when we already know that LLMs are filtered before public use for terms. Imagine a day where kids and adults ask a LLM what the meaning of life is, should they go outside, what happened in WW2, etc.

People could be programmed in a more tailopred fashion than todays facebook shorts and youtube can deliver.

Re: Over 100k Infected Repos Found on GitHub

#145

Post by avgcorrection »

simonjgreen wrote: post #23
sigmoid10 wrote: post #2

I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. I hate to call it out, but, isn’t that table stakes? Blending work and personal environments should be an obvious no. Are employers out there ok with this?

OK Drone.

Re: Over 100k Infected Repos Found on GitHub

#146

Post by pfarrell »

pjc50 wrote: post #73
dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

I'd expect it to accidentally invent vulnerabilities of its own as well as pasting existing ones from the input set. AI provides no guarantees at all about correctness.

Makes me think about Dijkstra being horrified to learn that the US was sending astronauts into space using unproven computer code [0]. Eventually, we'll have programmers trusting the AI generated code as much as we trust compiler generated code. Sometimes I think this will be the evolution of programming (like binary to assembler to compiled to interpreted to generated)... Other times I think about how we've grown used to buggier and buggier code and yet we press on.

0: https://pncnmnp.github.io/blogs/translating-dijakstra.html

Re: Over 100k Infected Repos Found on GitHub

#147

Post by avgcorrection »

sigmoid10 wrote: post #6
Ringz wrote: post #3

Earlier quoted context omitted.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. The complexity of digital life takes on dimensions that make me doubt whether it can continue in the long term.

I think this is just another opportunity to create new services. I've seriously considered moving all my stuff (except gaming) into something like apache guacamole. I'm already used to remote dev-ing over ssh and once you can easily get your desktop anywhere without even needing a client, there's no real reason to run everything on the one system you happen to be sitting at. And if internet connectivity is still an i…

> I think this is just another opportunity to create new services.

So maybe cool for people with itches or startup aspirations, more hassle for everyone else.

Re: Over 100k Infected Repos Found on GitHub

#148

Post by jbverschoor »

AlienRobot wrote: post #38
jbverschoor wrote: post #9

Earlier quoted context omitted.

Check out container-shell [1] it is one of the use cases. Not a VM but a docker container. Chroot a directory in a container, and does some automatic house keeping etc [1] https://github.com/jrz/container-shell

A link to a github repo? How do I know it's not infected?

It's a single bash script

Re: Over 100k Infected Repos Found on GitHub

#149

Post by remram »

yencabulator wrote: post #135
remram wrote: post #123

Earlier quoted context omitted.

What's the point? You're going to ship that code to your users, or run it against your production database. If you think it might be malicious, protecting the dev laptop shouldn't be the priority.

I run production services that don't even talk to a database, or that have minimal read-only access. And even for the ones with a lot of write access, having the database stolen/nuked (to be restored from backup) is quite different from handing over all of my browser cookies, or my gcloud/aws/k8s ambient authority credentials that are just sitting in a file (seriously, why is big cloud client security worse than SSH)…

Fair enough, some organizations might have devs with limited access, but you're right I can see a lot of situations where the dev laptop has strictly larger blast area.

Re: Over 100k Infected Repos Found on GitHub

#150

Post by fl0ki »

Ah yes, the latest post about a marginal security concern leading neatly into an advertisement to give money to an LLM startup to address it only partially and at best probabilistically.

If you're a potential customer for something like this, you quickly have to ask: why not have another 1000 contracts to separate tiny startups that each do the bare minimum to paper over an unknown portion of just one security gap? What other costs will you incur integrating with each of them in turn? How many of them will even still be in business a year later?

There would be several hundred with more ROI than this one, so why start here? Even if you undertake this costly and tedious journey, how far down the list would you have to go before you get anywhere close to this one?

Post reply on HN