Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

191–200 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#191

Earlier quoted context omitted.

I just moved to Zed (zed.dev). Has everything I need

Except extensions.

In this day and age, and extensión is the thing is ask my local AI to do for me. They are very simple, self contained code that can be crappy as I'll run it locally.

Browser extensions have been a great playground for me.

Re: GitHub is investigating unauthorized access to their internal repositories

#192

That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.

I just moved to Zed (zed.dev). Has everything I need

Ah yeh Zed. The editor that downloads random binaries for LSPs unprompted without asking me. That's not gonna end badly.

The only way I found out is because I run NixOS and it downloaded a dynamically linked binary that failed to start up and it spat out an error

Re: GitHub is investigating unauthorized access to their internal repositories

#193
post #168

Earlier quoted context omitted.

This comment reminds me of a joke where the punchline is that a person is so poor that burglars break in to their house and leave money. Similarly, I could see ransomware groups hacking in and feeling bad for GH so they improve a few things to help them get to at leave nine fives of uptime.

Just in case you are not aware, a joke loses its fun factor if you explain it.

They weren't telling the joke, they were using it as a reference point. They also didn't explain it, they just gave the punchline without any setup.

Re: GitHub is investigating unauthorized access to their internal repositories

#195

That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.

How hard would it be to have one installation step to be to have Claude read through all the code to the extension and strip out anything that looks risky (ie. Calls out to external servers).?

Do that automatically for all code downloaded from the web and run outside a sandbox.

Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.

Re: GitHub is investigating unauthorized access to their internal repositories

#196

That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.

I moved to neovim (stable) with as few extensions as possible, and those I've pinned to some geriatric version.

I don't even know what the plugin upgrade command is, and I don't plan to find out. Recommended.

Re: GitHub is investigating unauthorized access to their internal repositories

#197
post #144

Earlier quoted context omitted.

in my org, devs don’t have access to customer data directly, and sysadmins don’t have access to modify code. It’s a simple rule from a simpler time, to limit the risk of total compromise.

Repos should not contain customer data.

I think this might be more aimed at ensuring that if an attacker gains access to cloud login credentials via a compromised dev machine, those credentials can't then be used to access customer data.

Re: GitHub is investigating unauthorized access to their internal repositories

#198

That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.

How hard would it be to have one installation step to be to have Claude read through all the code to the extension and strip out anything that looks risky (ie. Calls out to external servers).? Do that automatically for all code downloaded from the web and run outside a sandbox. Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.

llms can be gamed

Re: GitHub is investigating unauthorized access to their internal repositories

#199
post #127

Earlier quoted context omitted.

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view…

Who the heck follows Github on Snapchat, TikTok, YouTube, Pinterest, Instagram, Reddit, Facebook, WeChat? Wherever they posted, there’s at this time two articles on the Hacker News front page. Sounds like they have reached their audience.

[deleted]

Re: GitHub is investigating unauthorized access to their internal repositories

#200

That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.

How hard would it be to have one installation step to be to have Claude read through all the code to the extension and strip out anything that looks risky (ie. Calls out to external servers).? Do that automatically for all code downloaded from the web and run outside a sandbox. Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.

VSCode extensions often contain binary blobs, so it won't catch basically anything. It would also be a bit expensive.
Post reply on HN