Giteabot account was compromised • Hacker News Board

Re: Giteabot account was compromised

#31

Post by superflyguy » Thu, Jun 07, 2018, 11:12 PM UTC

anothergoogler wrote: post #15

Cyberdog wrote: post #11

Earlier quoted context omitted.

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

Rational MS hatred?

Shitty OSes, naff late to the party phones and music players, convicted monopolists, tend to have arseholes running the company and are now paying 7 billion dollars to buy a company purely for the reputation, and it's people who are leaving GitHub who are not rational?

Re: Giteabot account was compromised

#32

Post by justinclift » Thu, Jun 07, 2018, 11:15 PM UTC

rightos wrote: post #30

Anyone have the known bad .exe.exe? I'd like to take a shot at analysis on it.

dabbler's HN comment a few below yours has a link to them.

https://github.com/go-gitea/gitea/issues/4167#issuecomment-3...

Re: Giteabot account was compromised

#33

Post by [deleted] » Thu, Jun 07, 2018, 11:32 PM UTC

hk__2 wrote: post #17

tpfour wrote: post #14

Earlier quoted context omitted.

Gitea isn't meant to replace Github... it's meant to be a self-hosted alternative to it. That's subtly different. I use it for as my local git server on Debian 9. Binary is in the /home/me/gitea directory. Run the usual gitea setup, then copy this to /home/me/.config/systemd/user/gitea.service: [Unit] Description=Gitea (Git with a cup of tea) After=syslog.target After=network.target [Service] RestartSec=2s Type=simpl…

> Then visit localhost:3000 and add it to your remotes (git remote add local ...) and you can push your changes to your own gitea instance. Why would you want to run a git server on your personal computer?

[deleted]

Re: Giteabot account was compromised

#34

Post by rmsaksida » Thu, Jun 07, 2018, 11:48 PM UTC

saagarjha wrote: post #2

Has anyone taken a look at the binaries themselves to see what they do and how they differ from the official releases?

The creator of the GitHub issue said the binary contains a cryptocurrency miner.

Re: Giteabot account was compromised

#35

Post by cosmojg » Thu, Jun 07, 2018, 11:53 PM UTC

soulchild37 wrote: post #13

Was thinking to install Gitea earlier and saw this on hackernews, is it safe to install using binary yet?

Yeah, it should be safe now. They re-released the binaries and set up 2FA.

Re: Giteabot account was compromised

#36

Post by behringer » Thu, Jun 07, 2018, 11:54 PM UTC

ljm wrote: post #27

Cyberdog wrote: post #11

Earlier quoted context omitted.

I'm probably out of the loop, but are people really scrambling to migrate away from GitHub? Why? Any reason other than irrational MS hatred?

In the grand scheme of things likely not, it's just a vocal minority that can dominate the perspective on social media and places like Reddit, talking about exodus and betrayal and who knows what. Sadly, it works...and it twists the narrative. The reports from Gitlab that they've had a significant uptick in signups can't be ignored though. Probably people in search of a new underdog since Atlassian and Bitbucket are…

Twist's whose narrative? MS' history is written plainly for all the world to see. https://en.wikipedia.org/wiki/Microsoft_litigation

Re: Giteabot account was compromised

#37

Post by saagarjha » Thu, Jun 07, 2018, 11:56 PM UTC

rmsaksida wrote: post #34

saagarjha wrote: post #2

Has anyone taken a look at the binaries themselves to see what they do and how they differ from the official releases?

The creator of the GitHub issue said the binary contains a cryptocurrency miner.

Where does he say that?

Re: Giteabot account was compromised

#38

Post by rmsaksida » Thu, Jun 07, 2018, 11:57 PM UTC

saagarjha wrote: post #37

rmsaksida wrote: post #34

Earlier quoted context omitted.

The creator of the GitHub issue said the binary contains a cryptocurrency miner.

Where does he say that?

It's in the issue body, first bullet point. https://github.com/go-gitea/gitea/issues/4167#issue-33011407...

> Most of go-gitea organization repositories new release&tag was created with name 0 and added install.exe binary (13KB in size) to that release that was malicious (from our analysis contained crypto currency miner)

Re: Giteabot account was compromised

#39

Post by JetSpiegel » Fri, Jun 08, 2018, 12:05 AM UTC

arwineap wrote: post #20

hk__2 wrote: post #17

Earlier quoted context omitted.

> Then visit localhost:3000 and add it to your remotes (git remote add local ...) and you can push your changes to your own gitea instance. Why would you want to run a git server on your personal computer?

If you have ssh enabled with an accessible git repo; you already do!

Just don't forget to create `--bare` repositories on the server.

Re: Giteabot account was compromised

#40

Post by dabber » Fri, Jun 08, 2018, 12:45 AM UTC

justinclift wrote: post #32

rightos wrote: post #30

Anyone have the known bad .exe.exe? I'd like to take a shot at analysis on it.

dabbler's HN comment a few below yours has a link to them. https://github.com/go-gitea/gitea/issues/4167#issuecomment-3...

Haha, I appreciate your typo in my username. When I created this account a little over two years ago I mistakenly dropped the "l" and didn't realize for a few months (having only copied it from a pw manager.) By that point what was done was done. Years later it makes me a bit happy to think people may actually be reading it as it was intended.