3 ms·

> The attack methodology involved a particularly sophisticated approach. Attackers inserted a base64-encoded payload into an install script, causing secrets fro

> The attack methodology involved a particularly sophisticated approach. Attackers inserted a base64-encoded payload into an install script, causing secrets from affected CI workflows to be exposed in workflow logs. What? How is that sophisticated? Who wrote this? I still don't understand how we got to this point where CI/CD pipelines are built from random shit on the internet. I remember people being worried about packages in the system package manager curated by a (relatively) small set of trusted project maintainers. Now we're pulling in garbage written by who knows, under security guidance of nobody. At least the Arch Repo has a procedure and a trust network. Every time I have to use GitHub actions and it recommends me using some "community" action I can't do it. I just know it's written by some 12-year old on spring break.

edoceo 2y ago
In 2025 sophisticated means someone took two or three steps.
- fads_go 2y ago
  Step 1: ask the LLM Step 3: profit right? Did I leave something out?
  - TheNewsIsHere 2y ago
    Step 2: do the sophisticated needful.
mystified5016 2y ago
My GitLab CI/CD pipelines are 100% code that I personally wrote or that I've personally reviewed and forked into our internal source control. Our entire business depends on this code, so the best possible course of action to me seemed to be 100% control. The idea of just plugging in some black box script written by anyone who can update it at any time seems insane. What kind of idiot would trust something as sensitive as CI/CD with random unverified scripts you have zero control or oversight of? Apparently quite a lot of idiots.
rollcat 2y ago
I agree with your general sentiment. When Github first showed up, I really liked it that (unlike on e.g. SourceForge) the username is right in the project's URL, it suggested that someone's accountable for the project. But there's no such thing as "accountability" when you're relying on unpaid volunteer work, made available for free to the general public - the "NO WARRANTY" is spelled in all caps, right there in the license. So how do you know if you can trust the code you're running? You use your own judgement.

edoceo 2y ago

In 2025 sophisticated means someone took two or three steps.

fads_go 2y ago
Step 1: ask the LLM Step 3: profit right? Did I leave something out?
- TheNewsIsHere 2y ago
  Step 2: do the sophisticated needful.

mystified5016 2y ago

My GitLab CI/CD pipelines are 100% code that I personally wrote or that I've personally reviewed and forked into our internal source control. Our entire business depends on this code, so the best possible course of action to me seemed to be 100% control. The idea of just plugging in some black box script written by anyone who can update it at any time seems insane. What kind of idiot would trust something as sensitive as CI/CD with random unverified scripts you have zero control or oversight of? Apparently quite a lot of idiots.

rollcat 2y ago

I agree with your general sentiment. When Github first showed up, I really liked it that (unlike on e.g. SourceForge) the username is right in the project's URL, it suggested that someone's accountable for the project. But there's no such thing as "accountability" when you're relying on unpaid volunteer work, made available for free to the general public - the "NO WARRANTY" is spelled in all caps, right there in the license. So how do you know if you can trust the code you're running? You use your own judgement.