Live data from Hacker News

Ghrc.io appears to be malicious

bmitch.net

41–50 of 78 posts

Re: Ghrc.io appears to be malicious

#41
post #34

One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.

I couldn't find anything useful - what is a FLA?

Re: Ghrc.io appears to be malicious

#42
post #41
post #34

One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.

I couldn't find anything useful - what is a FLA?

Four Letter Acronym probably. https://slang.net/meaning/fla

Re: Ghrc.io appears to be malicious

#43
post #41
post #34

One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.

I couldn't find anything useful - what is a FLA?

FLA is an unusual way of writing XTLA (Extended Three Letter Acronym).

Re: Ghrc.io appears to be malicious

#44
post #38
post #11

Earlier quoted context omitted.

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…

> Don't use ghcr for anything

What is the alternative for small budget private code projects?

Re: Ghrc.io appears to be malicious

#45
post #38
post #11

Earlier quoted context omitted.

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…

Arguably, the best thing to do to "fix" the issue is to be an evil hacker, and do bad things with it, causing damage, stealing people's money, causing Microsoft to be liable, which causes them to get sued, so then they're monetarily incentivized to actually fix the problem. Just, uh, donate the money that was stolen to a charity and not be evil about it.

Re: Ghrc.io appears to be malicious

#46
post #38

Earlier quoted context omitted.

Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…

> Don't use ghcr for anything What is the alternative for small budget private code projects?

Assuming you're not distributing container images to a huge number of people, you can just run your own docker registry with a hard-to typo name. It costs hardly anything to do: https://github.com/cloudflare/serverless-registry

Re: Ghrc.io appears to be malicious

#47
post #38

Earlier quoted context omitted.

Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…

Arguably, the best thing to do to "fix" the issue is to be an evil hacker, and do bad things with it, causing damage, stealing people's money, causing Microsoft to be liable, which causes them to get sued, so then they're monetarily incentivized to actually fix the problem. Just, uh, donate the money that was stolen to a charity and not be evil about it.

Someone already is "being an evil hacker" i.e. running ghrc.io

Is microsoft liable for people typoing a "docker login" command? Is there any chance of a lawsuit?

The fact that there is already someone exploiting it, and it's a big "meh" kinda proves the point perfectly that it's not really a big enough of a deal for the world to fall into chaos.

Re: Ghrc.io appears to be malicious

#48
post #46

Earlier quoted context omitted.

> Don't use ghcr for anything What is the alternative for small budget private code projects?

Assuming you're not distributing container images to a huge number of people, you can just run your own docker registry with a hard-to typo name. It costs hardly anything to do: https://github.com/cloudflare/serverless-registry

Yeah I've been thinking about doing this and I probably will. I just have a tendency to scope creep my own projects and I just decided that maybe I should just use ghcr since it's free.
Post reply on HN