171–180 of 359 posts
That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.
I just moved to Zed (zed.dev). Has everything I need
Why are half the comments in that thread AI generated? What value do they think they bring?
Money is a small thing to spend for all the fame it brings. Remeber: Value trumps everything, an everyone wants it. From investors to end users. /s
That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.
I just moved to Zed (zed.dev). Has everything I need
Zed was super impressive when I first started it, but I don't know yet how it compares with PHP Storm.
Why did one developer have access, even if read-only, to more than 3,800 internal repos?
Devs not having read access to all code seems like a massive org smell. What’s worse, in many cases not having access doesn’t just prevent you from seeing it it also prevents you from knowing it exists. Now you don’t know what to ask for, who to ask, or what to not implement again. There is no security risk that you could use to convince me that ”devs should only have access to code they need to modify”.
GitHub: " Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far." Oof https://xcancel.com/github/status/2056949169701720157
directionally, how bad is this ?
Earlier quoted context omitted.
This comment reminds me of a joke where the punchline is that a person is so poor that burglars break in to their house and leave money. Similarly, I could see ransomware groups hacking in and feeling bad for GH so they improve a few things to help them get to at leave nine fives of uptime.
Just in case you are not aware, a joke loses its fun factor if you explain it.
Why did one developer have access, even if read-only, to more than 3,800 internal repos?
Earlier quoted context omitted.
Devs not having read access to all code seems like a massive org smell. What’s worse, in many cases not having access doesn’t just prevent you from seeing it it also prevents you from knowing it exists. Now you don’t know what to ask for, who to ask, or what to not implement again. There is no security risk that you could use to convince me that ”devs should only have access to code they need to modify”.
in my org, devs don’t have access to customer data directly, and sysadmins don’t have access to modify code. It’s a simple rule from a simpler time, to limit the risk of total compromise.