Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post-mortem of Shai-Hulud attack on November 24th, 2025

posthog.com

Post reply on HN
Print view View original

11–20 of 77 posts

Re: Post-mortem of Shai-Hulud attack on November 24th, 2025

#11

Post by flunhat »

hhh wrote: post #2

I didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.

Curious, I pressed "X" on the blog post. It went away, leaving me with the fake desktop view at "posthog.com". Ok, fine. How do I get back?

I pressed the back button on my browser. The URL updated to be the blog post's URL. A good start. But the UI did not change, leaving me at the desktop view.

Many moments like these if you use Posthog

Re: Post-mortem of Shai-Hulud attack on November 24th, 2025

#14

Post by tomhow »

KomoD wrote: post #12

Wow, I hate this website to be honest. So much of the space is taken up by all these "bars" on my already small screen.

Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

https://news.ycombinator.com/newsguidelines.html

Re: Post-mortem of Shai-Hulud attack on November 24th, 2025

#15

Post by anonymous908213 »

flunhat wrote: post #8

Posthog's website design feels like a joke that went a bit too far

Other than the silly design, the website's cookie banner is actively malicious. It proclaims to be legally required and directly blames the President of the European Commission. If Posthog is being truthful about its cookie usage, the cookie banner is in fact not legally required. Consent banners are only required if you're trying to do individual user tracking or collecting personally identifying data; technical cookies like session storage do not require a banner. That they then chose to include a cookie banner anyways, with explicit blame, is an act of propaganda clearly intended to cause unnecessary consent banner fatigue and weaken support for the GDPR.

Re: Post-mortem of Shai-Hulud attack on November 24th, 2025

#16

Post by [deleted] »

flunhat wrote: post #11
hhh wrote: post #2

I didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.

Curious, I pressed "X" on the blog post. It went away, leaving me with the fake desktop view at "posthog.com". Ok, fine. How do I get back? I pressed the back button on my browser. The URL updated to be the blog post's URL. A good start. But the UI did not change, leaving me at the desktop view. Many moments like these if you use Posthog

[deleted]

Re: Post-mortem of Shai-Hulud attack on November 24th, 2025

#17

Post by zahlman »

hhh wrote: post #2

I didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.

Without JavaScript, all I get is a background image and a top "navigation bar" where the only thing that's actually operable at all is a signup link. Which then goes to a completely blank page.

I still don't know what Posthog is, but I'm now committed to never using it if I can at all help it.

Re: Post-mortem of Shai-Hulud attack on November 24th, 2025

#18

Post by AndrewDucker »

moi2388 wrote: post #5
mrdosija wrote: post #3

So it wasn't phishing attack? Wonder how those bot access tokens got stolen.

They explain how. “ At 5:40PM on November 18th, now-deleted user brwjbowkevj opened a pull request against our posthog repository, including this commit. This PR changed the code of a script executed by a workflow we were running against external contributions, modifying it to send the secrets available during that script's execution to a webhook controlled by the attacker. These secrets included the Github Personal…

Which shows the danger of keeping build scripts in your repos and letting users update them themselves.
Post reply on HN