Anyone know what extension was compromised?
GitHub is investigating unauthorized access to their internal repositories
231–240 of 359 posts
Re: GitHub is investigating unauthorized access to their internal repositories
#232Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/
I don't mind them using it as a channel per se (although the userbase isn't what it once was) but it certainly shouldn't be the only channel.
For example: Twitter/X, along with Nitter mirrors like XCancel, are all blocked at the client I'm currently working with so although they can see this discussion, they're excluded from some of the most important details.
(Like many former twitter users, I don't have an X account these days so I'm guessing wouldn't be able to see the full original thread - glad of XCancel, that's for sure.)
Re: GitHub is investigating unauthorized access to their internal repositories
#233Do they know what the attackers were after? Maybe they were just trying to help fix the availability problems.
This comment reminds me of a joke where the punchline is that a person is so poor that burglars break in to their house and leave money. Similarly, I could see ransomware groups hacking in and feeling bad for GH so they improve a few things to help them get to at leave nine fives of uptime.
This reminds me of a joke my neighbor used to tell:
If catch a burglar in my house, I will ask them what they are doing. If they respond with "I'm searching for money!", I'll suggest "Let's search together, and whatever we find, we split 50/50"
Re: GitHub is investigating unauthorized access to their internal repositories
#234> I think one key detail is that all malicious extensions were masquerading as "themes". Creating a permission system would mitigate that, where a theme should only have permission to change visual attributes of VsCode. upvote here: https://github.com/microsoft/vscode/issues/52116#issuecommen... VsCode and other IDEs have basically no permission system (spoiler alert: Browser Extension permission system is also weak)…
PS: People would be best to run your IDE Extensions in devcontainers only ... also better put VSCode in a VM as well.
The problem with all these permissions ideas: VSCode in most cases is expected to be able to push to a git repo. Many developers these days use it over the CLI for pushes and pulls.
So if it has a "minimal" set of access, it has access to a Github key. That's enough.. to do this sort of damage.
Re: GitHub is investigating unauthorized access to their internal repositories
#235Is it just me or is this happening way more frequently in the last 4 or 5 months? Coincidently around the same time the models got a lot more capable?
There is a cascading effect when malware targets developers and uses stolen credentials to push more infected packages. And not everyone is even aware they were affected, so there are going to be additional data leaks discovered some time after initial infection wave.
Re: GitHub is investigating unauthorized access to their internal repositories
#236- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…
Thanks for making me aware of zizmor, just ran and fixed all issues on our core repos.
few more tips here: https://github.com/bodadotsh/npm-security-best-practices
Re: GitHub is investigating unauthorized access to their internal repositories
#237Earlier quoted context omitted.
On hn, a joke increases its fun factor by being over-explained in excruciating detail with several digressions into related jokes and the history and philosophy of joking, and someone ends up showing a site they made with all the possible variations of that joke and something about the scrolljacking css annoys one of the commenters enough that they break in and fix it.
A variation of that joke is used in Zen Buddhism as a teaching story. A famous monk, who lived in voluntary poverty in a mountain hut, wakes up in the middle of the night because a robber had broken in - except the robber couldn't find anything of value. So the monk listened to the rummaging sound for a while, and feeling bad for the robber's family, offers his blanket. The robber is so surprised by the kindness of t…
A famous monk, who maintained empty website to make a point about Zen, wakes up in the middle of the night because LLM crawler had broken in past captcha -- except the crawler couldn't find anything of value on his website. So the monk listened to the futile rummaging sounds of HDD's head for a while, and feeling bad for the crawler's company, put his lifetime worth of manuscripts on the website. The crawler was so surprised by the kindness of the monk that it started to crawl his website 100 per second, DDoSing it out of existence.
Re: GitHub is investigating unauthorized access to their internal repositories
#238That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.
How hard would it be to have one installation step to be to have Claude read through all the code to the extension and strip out anything that looks risky (ie. Calls out to external servers).? Do that automatically for all code downloaded from the web and run outside a sandbox. Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.
What's the term for brainrot but when it's for LLMs instead of memes? Cause you suffer from it.
Re: GitHub is investigating unauthorized access to their internal repositories
#239I have a hard time believing this because there was never enough GitHub uptime to carry out the attack.
that's why it took so long for the attacker to exfil 3800 forks of ruby on rails.
Re: GitHub is investigating unauthorized access to their internal repositories
#240Will they revisit the decision to not add a permission model to VSCode extensions? https://news.ycombinator.com/item?id=43181789
how would that be enforced? unless extensions now be required to be WASM blobs, or otherwise using some very simple runtime. (ie. not JS/Node) I think we learned this with the JVM (applets) and the Flash player.