Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attempts to post the latest Trivy security incident have been marked [dead]

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 28 posts

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#11

Post by altairprime »

JoshuaDavid wrote: post #2

Trivy (a very widely-used security scanner) was recently compromised. Anyone who installed the aquasecurity/trivy-action dependency by tag rather than by sha during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GH... 6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am…

I emailed this post to the mods (using the footer contact link) on behalf of OP so they have a chance to assess and reply.

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#12

Post by akerl_ »

mtmail wrote: post #4

Looks like the repository URL was marked [dead] for several years, I can't tell why. Best to email the moderator (link in footer). Big security stories often get republished, one might say reviewed and filtered. For this story I see opensourcemalware.com - https://news.ycombinator.com/item?id=47449498 stepsecurity.io - https://news.ycombinator.com/item?id=47451081 arstechnica.com - https://news.ycombinator.com/item?i…

Yea, this looks like a lingering auto-moderation on the Github repo URL prefix due to past spam attempts.

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#13

Post by Retr0id »

fragmede wrote: post #10
kay_o wrote: post #5

Earlier quoted context omitted.

Looking at https://news.ycombinator.com/from?site=github.com/aquasecuri... around 2024 when the dead started, a spambot ring was repeatedly posting it? ( Make need to turn on "showdead"; to see it in the 2024 they have similar posts .. )

Oh that's clever. Use the spambot ring to promote the story so that the story gets marked dead because of that! Instead of hiding the news, use the botnet to promote it and use the system against itself.

I've noticed some HN posts get a higher-than-average number of replies from LLM bots. I've wondered if this has a downranking effect due to the upvote/comment ratio, and whether people might be using bots to do this intentionally. Alternatively it could just be that the bots "like" certain keywords more than others.

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#15

Post by gzread »

tptacek wrote: post #14

You should just mail hn@ycombinator.com about this stuff. Or: write a short blog post about it, and post that, on your (different) domain.

What if their goal is more to raise awareness about HN moderation practices than to fix the problem quickly?

It's certainly worked. Lots of people have seen this and now have a slightly worse opinion of HN moderation.

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#16

Post by tptacek »

gzread wrote: post #15
tptacek wrote: post #14

You should just mail hn@ycombinator.com about this stuff. Or: write a short blog post about it, and post that, on your (different) domain.

What if their goal is more to raise awareness about HN moderation practices than to fix the problem quickly? It's certainly worked. Lots of people have seen this and now have a slightly worse opinion of HN moderation.

Probably offset by the people whose opinion of HN moderation will improve as a result of this. Six of one, &c.

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#17

Post by tomhow »

gzread wrote: post #15
tptacek wrote: post #14

You should just mail hn@ycombinator.com about this stuff. Or: write a short blog post about it, and post that, on your (different) domain.

What if their goal is more to raise awareness about HN moderation practices than to fix the problem quickly? It's certainly worked. Lots of people have seen this and now have a slightly worse opinion of HN moderation.

> raise awareness about HN moderation practices

What practices?

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#18

Post by tomhow »

JoshuaDavid wrote: post #2

Trivy (a very widely-used security scanner) was recently compromised. Anyone who installed the aquasecurity/trivy-action dependency by tag rather than by sha during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GH... 6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am…

Please just email us (hn@ycombinator.com) when something like this happens.

Moderators didn't see these submissions or if we did, we didn't know why this project or incident was significant or important.

Now we've seen it, we've boosted the first submission of the incident onto the front page, and updated the URL and title to the most up-to-date/complete page about the incident.

The reason the submissions were being killed is that the GitHub account's address had been banned on HN due to previously being submitted by spam bots.

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#19

Post by JoshuaDavid »

tomhow wrote: post #18
JoshuaDavid wrote: post #2

Trivy (a very widely-used security scanner) was recently compromised. Anyone who installed the aquasecurity/trivy-action dependency by tag rather than by sha during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GH... 6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am…

Please just email us (hn@ycombinator.com) when something like this happens. Moderators didn't see these submissions or if we did, we didn't know why this project or incident was significant or important. Now we've seen it, we've boosted the first submission of the incident onto the front page, and updated the URL and title to the most up-to-date/complete page about the incident. The reason the submissions were being…

Noted and sent. Thanks for all your hard work.

Re: Attempts to post the latest Trivy security incident have been marked [dead]

#20

Post by JoshuaDavid »

esafak wrote: post #9
bfung wrote: post #8

[flagged]

I did not see it but I was not affected since I had pinned the tag and used a cool down; practices whose value I reminded my coworkers of with this post.

Pinning the tag will not save you - the tags were force-pushed. The cooldown probably did save you but you should check for the indicators of compromise listed on the security advisory page.
Post reply on HN