2 ms·
> The decision from sircmpwn was, at the end, to charge money for the service. Frankly, I'm shocked the other major free providers (GitHub/Lab) haven't done th
by Qub3d 5y ago
> The decision from sircmpwn was, at the end, to charge money for the service.
Frankly, I'm shocked the other major free providers (GitHub/Lab) haven't done this by default. GitHub's current default is free for public branches, and a small fee for private.
I could see a flipped setup working: by default a very small fee (1-5 cents per x number of batches) that most companies wouldn't notice, and a path for FOSS projects to apply for credits.
I can't find the direct link, but I remember someone on HN pointing out that because CI tools are turing complete, GitHub actions is the cheapest serverless cloud product in the world right now -- you just need to figure out how to game the system.
I'm sure they've built very sophisticated filtering tools, but imagine someone slips through the cracks and gets a cryptominer working. Get that action registered in enough projects (by, say embedding it in an Actions library or generator tool) and that could be significant.
- shakna 5y ago> I'm sure they've built very sophisticated filtering tools, but imagine someone slips through the cracks and gets a cryptominer working. It's been done, multiple times. Here's a handful (96) of documented cases which are somewhat recent. [0][1] It seems to be surprisingly easy to abuse the process, and GitHub are continually playing catch up. [0] https://dev.to/thibaultduponchelle/the-github-action-mining-attack-through-pull-request-2lmc https://dev.to/thibaultduponchelle/the-github-action-mining-... [1] https://www.bleepingcomputer.com/news/security/github-actions-being-actively-abused-to-mine-cryptocurrency-on-github-servers/ https://www.bleepingcomputer.com/news/security/github-action...