Disrupting supply chain attacks on NPM and GitHub Actions
1–10 of 59 posts
Re: Disrupting supply chain attacks on NPM and GitHub Actions
#2[flagged]
Re: Disrupting supply chain attacks on NPM and GitHub Actions
#3[flagged]
> Opting out of toxic ecosystems is a valid option
Quick, everyone break out the pitchforks for a valid analysis of a game! /s
Re: Disrupting supply chain attacks on NPM and GitHub Actions
#4[flagged]
The job can require you to
Re: Disrupting supply chain attacks on NPM and GitHub Actions
#5Re: Disrupting supply chain attacks on NPM and GitHub Actions
#6Re: Disrupting supply chain attacks on NPM and GitHub Actions
#7Re: Disrupting supply chain attacks on NPM and GitHub Actions
#8Earlier quoted context omitted.
The job can require you to
[flagged]
These comments should be removed r from HN, because they in no way actually add to the conversation. They aren’t intelligent, they aren’t insightful, they aren’t actionable, and they don’t invite a genuine reply. All you’re saying is that you happen to not use these technologies yourself – something that I’m sure is only by happenstance – and that you feel superior for it.
This is a blog post by GitHub. what are you suggesting that these employees do? Simply ignore that they exist? Regardless of whether or not you use them, they still exist.
Re: Disrupting supply chain attacks on NPM and GitHub Actions
#9Earlier quoted context omitted.
[flagged]
These comments should be removed r from HN, because they in no way actually add to the conversation. They aren’t intelligent, they aren’t insightful, they aren’t actionable, and they don’t invite a genuine reply. All you’re saying is that you happen to not use these technologies yourself – something that I’m sure is only by happenstance – and that you feel superior for it. This is a blog post by GitHub. what are you…
> This is a blog post by GitHub. what are you suggesting that these employees do? Simply ignore that they exist?
The buggy, insecure feature that is GitHub actions? Yes, preferably so.
Re: Disrupting supply chain attacks on NPM and GitHub Actions
#10>> high-impact npm accounts are now put into a read-only mode for 72 hours when they change their email or use a 2FA recovery code. This delay allows maintainers time to respond and recover the account before their account can be used to start an attack.
'what time shall we put here?'
'what's the longest hangover you ever had?'
'let's put 72 hours'