Earlier quoted context omitted.
I don't understand what you're trying to say.
Your ideas do not work against people who are trying to be malicious.
Oh. Yes they do.
GitHub is investigating unauthorized access to their internal repositories
281–290 of 359 posts
Re: GitHub is investigating unauthorized access to their internal repositories
#282- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…
The only way to 'harden your github actions' is to not use github actions.
Maybe GitHub being popped for their own insecure by design platform, will cause them to reconsider growth at all costs. I know it's wishful thinking, but the amount of security incidents the past few years because of how actions was designed is wild. It would be great for them to finally recognize this and take ownership.
Re: GitHub is investigating unauthorized access to their internal repositories
#283Re: GitHub is investigating unauthorized access to their internal repositories
#284Is gitea any good?
Quite.
Re: GitHub is investigating unauthorized access to their internal repositories
#285Earlier quoted context omitted.
Much more reasonable to oppose 2026 X as the default platform than it was to oppose 2015 Twitter as the default platform. I mean reasonable both times but you obviously understand why one might have changed their mind in recent years
Asking on behalf of Github’s PR team: what is the suggested alternative to X to post our updates to reach the largest amount of people, companies, as well as promote our brand? I haven’t seen any suggestion in this thread. status.github.com fails many of these criteria.
It bears pointing out: They posted this exclusively on X, and they did not need to do that. They are not "reaching the largest amount of people, companies".
It would be one thing if they could only use one channel. If they could only choose one, that would be email, which every GitHub user has.
They could use email, as well as status.github.com, their blog (which also has an RSS feed https://github.blog/feed/), and post it on their otherwise active BlueSky (which, unlike X, does not require an account to see their posts).
Re: GitHub is investigating unauthorized access to their internal repositories
#286Earlier quoted context omitted.
The only way to 'harden your github actions' is to not use github actions.
Maybe GitHub being popped for their own insecure by design platform, will cause them to reconsider growth at all costs. I know it's wishful thinking, but the amount of security incidents the past few years because of how actions was designed is wild. It would be great for them to finally recognize this and take ownership.
fair point
Re: GitHub is investigating unauthorized access to their internal repositories
#287GitHub: " Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far." Oof https://xcancel.com/github/status/2056949169701720157
directionally, how bad is this ?
Depends which way you look at it
Re: GitHub is investigating unauthorized access to their internal repositories
#288Earlier quoted context omitted.
As a developer or security researcher, you're able to download and run GitHub Enterprise Server. I'm not sure having access to the full source code makes a meaningful difference for most of GitHub's surface area, given it's largely Ruby.
LLMs can't really parse compiled code to find exploits, maybe code in scripting languages (python, js, etc) even if minified. So I don't quite agree with you, having access to the source can definitely help find exploits even in pre-LLM days.
[deleted]
Re: GitHub is investigating unauthorized access to their internal repositories
#289Microsoft’s GitHub was compromised when a Microsoft developer using Microsoft VSCode installed a rogue extension from Microsoft’s VSCode extension library, which is moderated and hosted by Microsoft.
Underrated reply
Re: GitHub is investigating unauthorized access to their internal repositories
#290Earlier quoted context omitted.
Oh. Yes they do.
And your reason for believing this is…
1. We've seen LLMs detect existing supply chain attacks when pointed at malicious install scripts. This is direct, empirical support for my position.
2. We have a long history of using heuristic technologies to detect attacks. We can infer that other heuristic technologies can be combined in a successful manner.
3. Shortcomings of LLMs are directly addressed by removing attacker controlled information from the input, which I specifically called out (using tools like grep for pattern matching + using sub agents to isolate contexts). This has been demonstrated already in a number of ways - feeding the LLM derived facts instead of attacker controlled data is the well worn path to avoiding injection attacks.