Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghrc.io appears to be malicious

bmitch.net

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Ghrc.io appears to be malicious

#51

Post by JdeBP »

missingcolours wrote: post #37
cyral wrote: post #25

Earlier quoted context omitted.

I've noticed this too. Why does amazon have aboutamazon.com and Google have developers.googleblog.com? They literally have their own .google TLD but still choose this weird domain. Same with local governments. They love something really random like proptaxpayment.org instead of treasurer. .gov. It's exactly the kind of domain you are told to watch out for, but actually legit.

A common scenario I've seen in the case of local governments is that a department (e.g. the Assessing Department) contracts with a vendor to run the website and has no idea how DNS works, and the vendor defaults to registering new domains for their clients since that's the easiest when dealing with non-technical clients. Texas alone for example has 254 countries, the vast majority of which are very small and have eff…

Now you too are hearing a voice in your head, as I did, in the classic drawl, saying "Counties, kid. Texas ain't that big.". (-:

Re: Ghrc.io appears to be malicious

#54

Post by michaeljhg »

notsahil wrote: post #22
aussieguy1234 wrote: post #6

There are alot of open source projects using this domain https://github.com/search?q=ghrc.io&type=code

GitHub should a have tool internally to create bulk and send it as a fix

https://github.com/advanced-security/secret-scanning-custom-...

Re: Ghrc.io appears to be malicious

#56

Post by nottorp »

echelon wrote: post #11
nicce wrote: post #9

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

Why do they even need 1420 domain names for one service?

What's wrong with registry.github.com, pages.github.com etc etc?

Too much to type?

Re: Ghrc.io appears to be malicious

#57

Post by wink »

Gigachad wrote: post #14
echelon wrote: post #10

Earlier quoted context omitted.

The problem here is GitHub's terrible domain name. The container registry has a horrible name.

Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.

If you are very old[tm] you might remember that github pages were hosted on USER.github.com and they moved to USER.github.io in 2013, https://github.blog/news-insights/product-news/new-github-pa...

JFTR, I also think they could at least have used a couple of pronouncable domains, or put stuff under a .github.io domain, or at least make it githubrepo.com or something not acronym-y

Re: Ghrc.io appears to be malicious

#58

Post by koakuma-chan »

nottorp wrote: post #56
echelon wrote: post #11

Earlier quoted context omitted.

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

Why do they even need 1420 domain names for one service? What's wrong with registry.github.com, pages.github.com etc etc? Too much to type?

It may be easier to register a new domain than to get people to make a subdomain for you.

Re: Ghrc.io appears to be malicious

#59

Post by lloeki »

thaeli wrote: post #26
nicce wrote: post #9

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558

Are there any additional mitigations folks are using for this? This issue is the only reason we can’t turn classic PATs off entirely. Short lifetime mandatory reauth to enterprise SSO seems to be the best available, but it’s inconvenient for the single Classic PAT we actually need.

Maybe:

- create a GitHub App or something that can generate transient tokens

- implement some CLI that generates a token

- login with that token

- push

See e.g: https://medium.com/@tiwari09abhi/github-app-token-authorizat... https://martin.baillie.id/wrote/ephemeral-github-tokens-via-...

But I'm not even sure because GH auth system is all over the place and downright nuts in some places...

e.g a fine grained token with repo access can't curl a tarball with the usual URL, it has to use the /api which makes tooling that constructs URLs from repo names and versions break with no recourse as soon as you disable classic PATs

Re: Ghrc.io appears to be malicious

#60

Post by nottorp »

koakuma-chan wrote: post #58
nottorp wrote: post #56

Earlier quoted context omitted.

Why do they even need 1420 domain names for one service? What's wrong with registry.github.com, pages.github.com etc etc? Too much to type?

It may be easier to register a new domain than to get people to make a subdomain for you.

Isn't that an official MS service for github?
Post reply on HN