Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Agentic Workflows

github.github.io

Post reply on HN
Print view View original

121–130 of 149 posts

Re: GitHub Agentic Workflows

#121

Post by TZubiri »

throwup238 wrote: post #8
TZubiri wrote: post #4

Not confirmed that it's by Github, phishy domain.

Why is it phishy? Github.io has been the domain they use for all GH pages for a long time with subdomains mapping to GH usernames. It’s standard practice to separate user generated content from the main domain so that it doesn’t poison SEO.

Correct.

First of all, any subdomain system domain is already a bit phishy because you need to somehow parse whether github.io is officially part of github.com and not say something like git-hub.xyz by a phisher or whatever new TLD there. These things are used by sysadmin/project pairs that can't budget 1$/month for a domain name, so it's 100% a security/price tradeoff.

Second of all, the actual domain host is publishing as one of these untrusted users on their alternate subdomain, so it could be a phisher using a subdomain of the official alternate domain with malicious material

Thirdly, even if it is all legit, it is still a problem, because it weakens security posture, it trains users to ignore domain names.

I understand if it appears subtle, but I wish that we lived in a world where whoever is responsible for this gets put on a PIP

Re: GitHub Agentic Workflows

#123

Post by throwup238 »

TZubiri wrote: post #121
throwup238 wrote: post #8

Earlier quoted context omitted.

Why is it phishy? Github.io has been the domain they use for all GH pages for a long time with subdomains mapping to GH usernames. It’s standard practice to separate user generated content from the main domain so that it doesn’t poison SEO.

Correct. First of all, any subdomain system domain is already a bit phishy because you need to somehow parse whether github.io is officially part of github.com and not say something like git-hub.xyz by a phisher or whatever new TLD there. These things are used by sysadmin/project pairs that can't budget 1$/month for a domain name, so it's 100% a security/price tradeoff. Second of all, the actual domain host is publis…

I get your general objections, but not in this specific case. Github has been using Github.io for pages since 2013 and it's been the de facto developer platform at least as long (and all other developer tools follow the same pattern when publishing user generated content). Unless GH has a massive vulnerability that hasn't been discovered yet, no one is publishing to *.github.github.io except for the official Github organization. That has been more stable than Linux syscalls and Windows GUI frameworks.

Would it really make a difference if they just added a CNAME from foobar.github.com to point at github.github.io?

Re: GitHub Agentic Workflows

#125

Post by pnvdr »

onionisafruit wrote: post #53

I noticed this unusual line in go.mod and got curious why it is using replace for this (typically you would `go get github.com/Masterminds/semver/v3@v3.4.0` instead). replace github.com/Masterminds/semver/v3 => github.com/Masterminds/semver/v3 v3.4.0 I found this very questionable PR[0]. It appears to have been triggered by dependabot creating an issue for a version upgrade -- which is probably unnecessary to begin w…

Kinda reminds of secure sleep command in GitHub actions

Re: GitHub Agentic Workflows

#126

Post by mcintyre1994 »

CuriouslyC wrote: post #31

Stuffing agents somewhere they don't belong rather than making the system work better with the agents people already use. Obvious marketing driven cash grab.

I keep wondering if this is what kills GitHub. Anthropic have done a pretty good job of making Claude work well with GitHub, and it makes all the GitHub agent stuff feel pointless to me. But they keep adding it in more and more places, and I’m guessing most people just keep ignoring it and using Claude.

Would they think it’s worth introducing restrictions to make it harder to use Claude with GitHub in the hopes that it forces us to use their endless collection of agent stuff instead? I think they probably would choose that tradeoff.

Re: GitHub Agentic Workflows

#127

Post by TZubiri »

hmokiguess wrote: post #15
TZubiri wrote: post #4

Not confirmed that it's by Github, phishy domain.

How is it not confirmed? GitHub cannot use their own product? Them using GitHub pages changes something? I don’t get it

I see a lot of people confused, and it is confusing. Here's my best take at clarifying the issue for you:

It's as if Google sent you an official email from an @gmail address.

Like "gmail-invoices@gmail.com"

Surely it would look suspicious, and if it turns out it is official, it doesn't somehow mean there's no issue, if anything it's worse because it untrains users' security protocols.

Personally I'd ignore anything that comes out of one of these domains, even if it turns out an actual employee pushed it, if you can't publish something on the main domain, you don't have enough authority to speak for the company, may be skunkworking to avoid an internal protocl, I don't know, I don't care, it's not official, don't need to read it.

Re: GitHub Agentic Workflows

#128

Post by jen20 »

embedding-shape wrote: post #13
eddythompson80 wrote: post #12

Earlier quoted context omitted.

Why would that be phishy? They own the GitHub org on GitHub, hence github.github.io. I always thought it was a neat recursive/dogfood type thing even if not really that deep. Like when Reddit had /r/reddit.com or twitter having @twitter

When they launched github.io, they said it was for user-generated content, and official stuff will be on github.com. Seemingly that's changed/they forgot, but users seems to have remembered. Microsoft isn't famous for their consistency, so not unexpected exactly.

When GitHub pages was launched, IIRC it was _on_ GitHub.com and only moved later. User content that is _not_ pages is on githubusercontent.com to this day.

Re: GitHub Agentic Workflows

#129

Post by raxxorraxor »

huevosabio wrote: post #36

Github should focus on getting their core offerings in shape first. I stopped using GH actions when I ran into this issue: https://github.com/orgs/community/discussions/151956#discuss... That was almost a year ago and to this date I still get updates of people falling into the same issue.

I cannot recommend Gitea enough. It is easy to install, can be very well integrated into the usual corporate Microsoft networks (ldap/adfs) and has very simple workers, which just reliably execute the actions defined in the .gitea folder of your repository. Installing workers is an extra step, but you don't really need a PhD to get it running.

You can build a very efficient and reliable CI pipeline this way and you are not dependent on third parties at all. The interface is mostly 1:1 Github. Just the bullshit is ripped out.

Re: GitHub Agentic Workflows

#130

Post by raxxorraxor »

nine_k wrote: post #115
ogig wrote: post #60

What timing. I used the whole weekend building a CI agentic workflow where I can let CC run wild with skip-permissions in isolated vms while working async on a gitea repo. I leave the CC instance with a decent sized mission and it will iterate until CI is green and then create a PR for me to merge. I'm moving from talking synchronously to one Clade Code to manage a small group of collaborating Claudes.

How much does it cost you?

I do it similarly and it only costs me my working time. I do some of these things outside my official working times for free, but that is because I like the topic and like to have a good deployment pipeline. But I doubt it is in any way more significant time investment than administration of Github.

In the end you need to write your deployments scripts yourself anyway, which takes the most time. Otherwise for installation, the most time consuming task is probably ssh key management of your users, if you don't have any fitting infrastructure.

Post reply on HN