Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Giteabot account was compromised

github.com

Post reply on HN
Print view View original

61–66 of 66 posts

Re: Giteabot account was compromised

#61

Post by Boulth »

aaron_m04 wrote: post #43
mhils wrote: post #29

GitHub's permission system is quite brittle here: Anyone with write access to a repository can silently swap out binaries on the releases page, which are then still listed as "Verified" if the commit is signed. It's a complex problem, but the current approach feels subpar.

Sounds like a good opportunity for integration with GPG, keybase, and other signing tools.

It's not that easy to solve in general. Usually these artifacts are built by CI so it'd have to sign them too (if they are not reproducible the you can't build them locally and check if they are the same). So a person that has admin access in CI can do that too.

Of course current design leaves much to be desired.

Re: Giteabot account was compromised

#62

Post by workinthehead »

feikname wrote: post #56
ljm wrote: post #27

Earlier quoted context omitted.

In the grand scheme of things likely not, it's just a vocal minority that can dominate the perspective on social media and places like Reddit, talking about exodus and betrayal and who knows what. Sadly, it works...and it twists the narrative. The reports from Gitlab that they've had a significant uptick in signups can't be ignored though. Probably people in search of a new underdog since Atlassian and Bitbucket are…

Out of curiosity, why would BitBucket be out of question?

Atlassian's not really an "underdog", presumably. As for me, I would hate to have my source code in the hands of the people responsible for "JIRA".

Re: Giteabot account was compromised

#63

Post by OtterCoder »

briandear wrote: post #41
superflyguy wrote: post #31

Earlier quoted context omitted.

Shitty OSes, naff late to the party phones and music players, convicted monopolists, tend to have arseholes running the company and are now paying 7 billion dollars to buy a company purely for the reputation, and it's people who are leaving GitHub who are not rational?

Does the product still work and provide the advertised service? If yes, then yes, it’s irrational. It isn’t like leaving GitHub is a multi-month process. It could be done in an instant. It’s evacuating a house because there might be a fire in the future.

> It's evacuating a house because there might be a fire in the future.

Which is a perfectly rational thing to do, if the risk is close enough to 1. Even in actual housing, they preemptively condemn and evacuate buildings that have become too unsafe to trust, before a disaster occurrs.

Re: Giteabot account was compromised

#64

Post by tboerger »

the_common_man wrote: post #7
josteink wrote: post #5

Funny to see this news posted on github , after people having suggested gitea as a viable platform to migrate your github projects to ever since the MS buyout. Good thing on them being open about it though, despite it probably costing them some potential traction.

Many projects are ironically this way. Gitea, gogs, yunohost, sandstorm to name a few.

But some (like Gitea) are working on it to start hosting it on their own. Gitea will also get federation features to make contributions between independent Gitea instances possible.

But even when it starts to host, it will get GitHub OAuth2, just to keep the barrier small to receive contributions.

Re: Giteabot account was compromised

#65

Post by _emacsomancer_ »

lsaferite wrote: post #47
_emacsomancer_ wrote: post #45

Earlier quoted context omitted.

Other than what I would consider perfectly rational dislike of Microsoft (they have a long history of making the world a worse place), some people are old enough to remember what has happened to some of Microsoft's other acquisitions†, like Skype (which went from a promising p2p client to a funnel for the NSA which still doesn't work well or reliably). And consider what they've done with Windows 10: ads in the 'free'…

> old enough to remember what has happened to some of Microsoft's other acquisitions†, like Skype But that was only 7 years ago.

That was a touch of sarcasm. But there must be some pretty young people on HN too.

Re: Giteabot account was compromised

#66

Post by Cyberdog »

workinthehead wrote: post #62
feikname wrote: post #56

Earlier quoted context omitted.

Out of curiosity, why would BitBucket be out of question?

Atlassian's not really an "underdog", presumably. As for me, I would hate to have my source code in the hands of the people responsible for "JIRA".

To be fair, Bitbucket is loads more pleasant to use than Jira.
Post reply on HN