One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.
Ghrc.io appears to be malicious
41–50 of 78 posts
Re: Ghrc.io appears to be malicious
#42One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.
I couldn't find anything useful - what is a FLA?
Re: Ghrc.io appears to be malicious
#43One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.
I couldn't find anything useful - what is a FLA?
Re: Ghrc.io appears to be malicious
#44Earlier quoted context omitted.
Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.
Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…
What is the alternative for small budget private code projects?
Re: Ghrc.io appears to be malicious
#45Earlier quoted context omitted.
Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.
Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…
Re: Ghrc.io appears to be malicious
#46Earlier quoted context omitted.
Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…
> Don't use ghcr for anything What is the alternative for small budget private code projects?
Re: Ghrc.io appears to be malicious
#47Earlier quoted context omitted.
Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…
Arguably, the best thing to do to "fix" the issue is to be an evil hacker, and do bad things with it, causing damage, stealing people's money, causing Microsoft to be liable, which causes them to get sued, so then they're monetarily incentivized to actually fix the problem. Just, uh, donate the money that was stolen to a charity and not be evil about it.
Is microsoft liable for people typoing a "docker login" command? Is there any chance of a lawsuit?
The fact that there is already someone exploiting it, and it's a big "meh" kinda proves the point perfectly that it's not really a big enough of a deal for the world to fall into chaos.
Re: Ghrc.io appears to be malicious
#48Earlier quoted context omitted.
> Don't use ghcr for anything What is the alternative for small budget private code projects?
Assuming you're not distributing container images to a huge number of people, you can just run your own docker registry with a hard-to typo name. It costs hardly anything to do: https://github.com/cloudflare/serverless-registry
Re: Ghrc.io appears to be malicious
#49Re: Ghrc.io appears to be malicious
#50Wouldn't DNSSEC solve stuff like this?