Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

Post reply on HN
Print view View original

121–130 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#121

Post by nativeit »

tyre wrote: post #54
doe88 wrote: post #40

0-days-vibes-vulns ? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

I still use them frequently. On iOS you just tap the hyphen twice, and it inserts an em dash—sorta like that.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#123

Post by sellmesoap »

grayhatter wrote: post #44

> At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. I do this so to allure people into the field, and I've always found this is the most efficient way. I've been a skiddy, he would have believed this. Thankfully, I've grown a bit, and can see this for the transparent, "I'm angry and want to hurt others so I will feel a little less alon…

User/admin discretion for software they use should be a big factor, sometimes getting burned is how you learn to play with fire. Or decide that having your data/participation disrespected means you need to set harder boundaries. My solution is to try things in isolation, run very few services, try to avoid becoming dependent on the online, appreciate the offline and local first.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#124

Post by DANmode »

grayhatter wrote: post #112
esikich wrote: post #94

Earlier quoted context omitted.

How bad are your security practices that these tiny obscure things matter? None of these findings that show up here on HN should even make you flinch. The alarmist takes on this stuff is fucking exhausting and I'm tired of security teams bugging me about it. Do your job and this shit doesn't matter AT ALL.

I said "doesn't matter" to someone once... the resulting lesson came in the form of a reply from the whitehat researcher ( waves , hi brian!) a 16step exploit chain resulting in a one click full account takeover. I'm equally annoyed and over the alarmist takes. But I don't think it's fair to group mine into it. I'm annoyed at seeing discard respect for others into the same void everyone is happy to toss quality. Do t…

That’s a whole lot of “we” to not mention which company you’re at that supposedly plays well with security researchers/has a proper bug bounty.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#125

Post by speedgoose »

nubg wrote: post #72
speedgoose wrote: post #37

Earlier quoted context omitted.

Banks are kinda useful to avoid getting robbed all your money, on a regular basis. Many French people with crypto money experienced that the hard way recently.

do you have links about the french people?

Sure, here are a few links. Use your favourite translator.

In short, it's a very active and growing activity. Many data leaks helped people to identify wealthy targets. Some just brag about having crypto.

https://www.lemonde.fr/societe/article/2026/04/24/enlevement...

https://www.franceinfo.fr/faits-divers/cryptomonnaies-la-vag...

https://www.lemonde.fr/societe/article/2025/08/19/l-ascensio... (paywall)

https://www.slate.fr/societe/enlevements-lies-cryptomonnaies...

Some random recent ones we know about:

https://france3-regions.franceinfo.fr/grand-est/haut-rhin/mu...

https://www.leparisien.fr/faits-divers/renseignes-par-des-ha...

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#126

Post by Wowfunhappy »

rogerrogerr wrote: post #86
tyre wrote: post #54

Earlier quoted context omitted.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

I used to be an em-dash user, but now my opinion is that I’d rather be perceived as someone who does not want to be confused with an LLM. So I’ve changed my writing style.

My feeling is that my writing doesn't sound anything like an LLM, so if someone thinks I'm an LLM because I used an em-dash, that's on them. That, or I royally screwed up and need to do a better job as a writer. At least with today's LLMs.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#127

Post by timcobb »

tyre wrote: post #54
doe88 wrote: post #40

0-days-vibes-vulns ? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

The question is whether the m-dashes are surrounded by spaces or not. The spaces are utterly maddening. But yeah, RIP the mdash, who would have thought.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#128

Post by b112 »

firefax wrote: post #96
Retr0id wrote: post #64

Earlier quoted context omitted.

You don't need to be pissed off to decide that immediate public disclosure is the best option.

Ok, I don't know their emotional state. Fair point. Maybe I'm projecting my own biases ;-)

Meanwhile, some dude was just playing with claude and accidentally made his repo public.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#129

Post by deadbabe »

sva_ wrote: post #102
tyre wrote: post #54

Earlier quoted context omitted.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

I propose that humans use Unicode U+2E3B three em dash ⸻ it is an impressively long character.

let’s market it as “human dash”

And if it ever catches on with LLMs ⸻⸻ we just make it longer

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#130

Post by Scaled »

woodruffw wrote: post #88
Retr0id wrote: post #17

I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…

The Gitea one looks marginally interesting, but is probably not exploitable in practice (unless Gitea or whoever else isn’t properly isolating jobs on dedicated VMs). I suspect GitHub Actions has similar behavior and is not considered exploitable because the user is assumed to already have local, non-namespaced root access.

Gitea action runner has a bunch of different ways to setup and doing the isolation properly looks tricky. The documentation doesn't provide any isolation tests to administrators, either.

The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. Not flawless security, but it's something...

Post reply on HN