[deleted]
Post-mortem of Shai-Hulud attack on November 24th, 2025
21–30 of 77 posts
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#22Posthog's website design feels like a joke that went a bit too far
Other than the silly design, the website's cookie banner is actively malicious. It proclaims to be legally required and directly blames the President of the European Commission. If Posthog is being truthful about its cookie usage, the cookie banner is in fact not legally required. Consent banners are only required if you're trying to do individual user tracking or collecting personally identifying data; technical coo…
I agree it’s stupid but wouldn’t ascribe intent without more information
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#23I didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.
The site caused my browser to freeze and it reminded me of the 56k modem days.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#24So it wasn't phishing attack? Wonder how those bot access tokens got stolen.
> The PR was opened, the workflow run, and the PR closed within the space of 1 minute (screenshots include timestamps in UTC+2, the author's timezone): It's an unfortunately common problem with GitHub Actions, it's easy to set things up to where any PR that's opened against your repo runs the workflows as defined in the branch. So you fork, make a malicious change to an existing workflow, and open a PR, and your code…
Problem is that you might want to have the tests run before even looking at it.
I think the mistake was to put secrets in there and allow publishing directly from github's CI.
Hilariously the people at pypi advise to use trusted publishers (publishing on pypi from github rather than local upload) as a way to avoid this issue.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#25Posthog's website design feels like a joke that went a bit too far
Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#26I didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.
Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#27Long story short: they messed up the assign-reviewers.yml workflow, allowing external contributors to merge PRs without proper reviews. From this point on, you're fully open to all kinds of bad stuff.
more so in case you actually do the "secrets on github with the right to do meaningful things"
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#28[deleted]
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#29Posthog's website design feels like a joke that went a bit too far
Other than the silly design, the website's cookie banner is actively malicious. It proclaims to be legally required and directly blames the President of the European Commission. If Posthog is being truthful about its cookie usage, the cookie banner is in fact not legally required. Consent banners are only required if you're trying to do individual user tracking or collecting personally identifying data; technical coo…
I don't have a cookie banner on _my_ website for exactly this reason, but I have to admit some people have asked my if it isn't suspicious that I don't. Perhaps that's what they're trying to avoid here? (that would be the positive reading)
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#30I didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.
Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. https://news.ycombinator.com/newsguidelines.html
In this case, I think GP is suggesting this rises above the level of a tangential annoyance.