GitHub

drahardja,
@drahardja@sfba.social avatar

is under attack.

“The flow of the campaign is simple:

  1. Cloning existing repos (for example: TwitterFollowBot, WhatsappBOT, discord-boost-tool, Twitch-Follow-Bot, and hundreds more)
  2. Infecting them with malware loaders
  3. Uploading them back to GitHub with identical names
  4. Automatically forking each thousands of times
  5. Covertly promoting them across the web via forums, Discord, etc.

“GitHub besieged by millions of malicious repositories in ongoing attack”

https://arstechnica.com/security/2024/02/github-besieged-by-millions-of-malicious-repositories-in-ongoing-attack/

blogdiva,
@blogdiva@mastodon.social avatar

@drahardja a reminder that Github was bought by Microsoft, the makers of Windows, the OG operating system for malware attacks...

the cat from Sabrina The Teenage Witch, filing its claws

aral,
@aral@mastodon.ar.al avatar

@drahardja Man, almost as if we shouldn’t have centralised all open source code at one mega location owned by a trillion-dollar corporation or something. But then again, they need the data for AI, so, swings and roundabouts, I guess.

mariatta,
@mariatta@fosstodon.org avatar

So I usually route my work/day job org notification emails to work emails, and associate my GH commits to the work email address (this is usually required by employer, but not always)

When I leave the job, I lose access to the work email, and the org access. And I often forgot to update the email routing back.

Questions:

  • What happens then? I think GH still sends notifications to the defunct work email?

  • If I delete work email from my GH acct, will I lose commits attributed to it?

villares,
@villares@ciberlandia.pt avatar
Mehrad,
@Mehrad@fosstodon.org avatar

I wish locking issues on was not restricting users to vote on comments. This is bad for one reason from two aspects:

  1. users cannot vote on features they think are essential for the project

  2. maintainers will not see how much such feature is missed and required by their users.

I don't know if @forgejo have mimicked Github or not. I so far I have not find any issues that is locked on @Codeberg to confirm/reject this.

Mehrad,
@Mehrad@fosstodon.org avatar

@Codeberg
If this is being discussed somewhere, can you point me to that conversation? Because people tend to lock the issue to prevent spams (e.g "me too", "+1") or further heated discussion, but they don't close the issue because it is still valid. It makes absolute sense to be available to either interact with the discussion via votes and emojies, or at least some sort of voting mechanism that the moderators can freate to keep collecting votes and at the same time avoid spams.
@forgejo

Codeberg,
@Codeberg@social.anoxinon.de avatar

@Mehrad There are many reasons to lock an issue, you list one of them.

The discussion is potentially scattered, you might want to start a focused conversation in https://codeberg.org/forgejo/discussions/issues/

isAutonomous, German
@isAutonomous@karlsruhe-social.de avatar

Die Angriffe auf die Repositories bei haben inzwischen große Ausmaße angenommen.

Angreifer forken auf GitHub Repositories und verstecken Malware im Code.
Die geforkten Projekte heißen ähnlich wie sie originalen.
Inzwischen sind es über 100.000. Microsoft hat zwar Gegenmaßnahmen aufgesetzt, die erwischen aber nicht alle.

Daher, genau hinschauen, wenn man auf Github ein Repo sucht!

https://winfuture.de/news/141483

YourAnonRiots, Japanese
@YourAnonRiots@mstdn.social avatar

Good news for devs – turned on auto secret scanning push protection by default for all pushes to public repositories.

https://thehackernews.com/2024/03/github-rolls-out-default-secret.html

artfulrobot,
@artfulrobot@fosstodon.org avatar

How clean is your #fork?
#github, the place that #microsoft gets #openSource developers to provide it free #ai training data for use by proprietary products, is being attacked by bots making millions of malicious forks (copies) of projects and adding password stealing code.

Check your sources carefully before you #git clone!

https://arstechnica.com/security/2024/02/github-besieged-by-millions-of-malicious-repositories-in-ongoing-attack/

artfulrobot,
@artfulrobot@fosstodon.org avatar

Readers may also consider

https://sfconservancy.org/GiveUpGitHub/

Try at @Codeberg instead, or host your own

onepict, (edited )
@onepict@chaos.social avatar

@artfulrobot @Codeberg if you have a few repositories to do, this bash script may be handy and it's available on codeberg.

https://codeberg.org/librecast/giveupgithub.sh

jos1264,
@jos1264@social.skynetcloud.site avatar
CleoMenezesJr,
@CleoMenezesJr@floss.social avatar

Discord is a cancer, bruh.

Someone asked a question on Discussions and someone else closed the discussion saying "(...) Questions can be asked through Discord 👍🏻".

For the love of god, stop using as a forum. The questions are undiscoverable.

joy,
@joy@mastodon.social avatar

@CleoMenezesJr

Setting up a Discourse forum early and relentlessly encouraging our users to actually use it has been one of the most worthwhile things we’ve done to build a vibrant community at @zerotier over the past few years.

vintprox,
@vintprox@techhub.social avatar

@j4ck @CleoMenezesJr @codinghorror Moreover, Slack seems to have a subscription model around months ago chat history! Horrendous.

smallcircles,
@smallcircles@social.coop avatar

Beware infected repositories having in them.

https://apiiro.com/blog/malicious-code-campaign-github-repo-confusion-attack

> In order to maximize the chances of infection the malicious actor is flooding GitHub with malicious repos

Like this:

  • Clone existing repos (for example: TwitterFollowBot, WhatsappBOT, discord-boost-tool, Twitch-Follow-Bot)

  • Infect them with malware loaders

  • Upload them back to GitHub with identical names

  • Automatically fork each thousands of times

  • Covertly promote them across the web

jschauma,
@jschauma@mstdn.social avatar

TIL: You can easily download a plain text diff from a pull request by simply adding ".patch" to the base URL of the PR.

So to patch your local tree from an unmerged PR, you can

curl -L -s https://github.com/<org>/<repository>/pull/<num>.patch | patch

nocci,

#followerpower ​:BoostOK:​

privatly hosted git-thingy:

Gitea vs Gitlab

I want to use it just for my personal stuff, because I finally want to leave github.

Which would you prefer and why??

#gitea #gitlab #github #selfhosting

amad, Spanish
@amad@tkz.one avatar

¿Cuál es el proyecto (o repositorio) de más útil que conocen o usan?

outofcontrol,
@outofcontrol@phpc.social avatar

After doing some research online, it appears these two companies are fairly well respected for GitHub repository backups:

GitProtect
Cloudback

Any mastodon recommendations, comments, feedback, or preferences for other backup plans?

Over 150 repositories and growing. Not looking to script our backups, need ISO/IEC 27001 and SOC 2 compliance.

czottmann,
@czottmann@norden.social avatar

I actually enjoy using https://Linear.app, much more than I had expected. It's very streamlined, very fast, has lots of keyboard shortcuts, I can hook it up to Make (née Integromat) for automation if I want. Biggest surprise: The Cycle feature, which I use for planning my dev work for the week.

It basically completely replaced issues for my non-FOSS projects.

Good stuff. Purchased the Standard Yearly plan after two months of testing.

assaf,
@assaf@mas.to avatar

@czottmann I second that. Linear is really good for streamlining the workload.

bram,
@bram@gamedev.lgbt avatar

okay neat! my instance is online ✨ https://git.dingelstad.works/bram :)

no more Finally

bram,
@bram@gamedev.lgbt avatar

the really cool thing is, that @forgejo is planning on making a really cool extension that allows for interaction with the 👀

that's gonna be SO cool :)

denmanrooke,
@denmanrooke@social.coop avatar

@bram @forgejo ooh interesting

mhucka,
@mhucka@fediscience.org avatar

Mac users who write files in Markdown format: a lot of people know this already, but FYI, there's a free and very useful Quick Look plugin for the Finder that will display previews of Markdown files. It's handy when looking at folders in the Finder – just move the cursor to the file and press the space key to pop-up a formatted preview.

https://github.com/sbarex/QLMarkdown

It defaults to emulating the GitHub theme. There are a lot of settings in the control panel.

scy,
@scy@chaos.social avatar

I think it's telling that #GitHub, #GitLab, and even #Forgejo all don't have a workflow for "renew an #OpenPGP key", i.e. extend its validity before (or after) expiry. On all of them, you have to delete and re-add the key. It's as if nobody is following OpenPGP best practices and everyone is using keys without an expiry date.

#GPG #GnuPG

chrysn,
@chrysn@chaos.social avatar

@scy Do they even bother with expiry? I distincly remember having uploaded mine there way before the last lifetime extension, and while I've run into all sorts of trouble with expired PGP keys, there were none with the forges 🤔

scy,
@scy@chaos.social avatar

@chrysn Yeah, they care little about it. Sometimes it's shown at least on the page where you manage your keys, and I think I've even seen some kind of indication next to a commit that it's signed, but the key has expired. Not 100% sure though.

serpentroots,
@serpentroots@hachyderm.io avatar

Today I learned you can add .atom to the end of most URLs (releases, discussions, etc) and get an content feed.

I'm not sure why this isn't a feature in the web interface. It's very useful.

mhucka,
@mhucka@fediscience.org avatar

GitHub users: do you put screenshots in your README files (or other documentation files)? Did you discover to your dismay that the results look wrong when viewed in dark mode (or in light mode, if your default is dark mode)?

Turns out that GitHub has a feature letting you specify the use of alternative images for light and dark modes:

https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#specifying-the-theme-an-image-is-shown-to

dazfuller,
@dazfuller@mstdn.social avatar

In case anyone else is fed up of seeing the "Code 55% faster with Github Copilot" message on Github, the following filter works a treat with uBlock Origin

github.com##button[data-testid="copilot-popover-button"]

#GitHub #Copilot #ublock

jamescooke,
@jamescooke@fosstodon.org avatar

@dazfuller Nice one - yes I hate seeing these adverts. Will try this tomorrow.

kushal,
@kushal@toots.dgplug.org avatar

Is there anyway to get access to action docker container on ? Need to debug a segfault only on GitHub CI.

jezdez,
@jezdez@publicidentity.net avatar

@kushal https://github.com/mxschmitt/action-tmate is your friend (until gh bans you)

StewartLynch,
@StewartLynch@iosdev.space avatar

All 7 videos in the with series are done. The entire playlist is available for free on YouTube,
Xcode has come a long way in the last few years and can handle most of your routine source control tasks. Let me show you how it’s done.
https://youtube.com/playlist?list=PLBn01m5Vbs4B1tAyGNkiXCQKQiO9SaFGp&si=bKQQSnbM-OO1Xm_P

jdeimund,
@jdeimund@iosdev.space avatar

@StewartLynch Such a great series, thank you for putting those together!

wervice,
@wervice@fosstodon.org avatar

Did you ever wonder who GitHub repositories add these small badges on the top, showing stars, downloads and the latest release? I looked around the internet a bit, and I think here they all come from: https://shields.io/

binarydigit,
@binarydigit@social.lol avatar

Moving my Hugo Website to Neocities and Deploying with GitHub Actions

https://binarydigit.cafe/notes/neocities-github-actions/

phranck,
@phranck@chaos.social avatar

Years ago, I found a tool (on ?) that I could throw a project at, and then it created a video from the Git history. You could see how branches and developers were added and disappeared and how it grew.

Does anyone happen to know the name?
Do you know what I mean?

pty,
@pty@chaos.social avatar
phranck,
@phranck@chaos.social avatar

@pty Yap, that's it! Thanks.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • github
  • ngwrru68w68
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • thenastyranch
  • magazineikmin
  • megavids
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • anitta
  • Leos
  • tester
  • provamag3
  • JUstTest
  • All magazines