5 ms·

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.g

by nicce 1y ago

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558 https://github.com/github/roadmap/issues/558

echelon 1y ago
Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.
- jsheard 1y ago
  Microsoft is paying top dollar for MarkMonitor, aren't they supposed to proactively register obvious typos so this kind of thing doesn't happen to their clients?
  - VoidWhisperer 1y ago
    My guess is that MarkMonitor is mainly used for their brand-relevant domains (microsoft, office 365, github (main site), etc), as opposed to one that a small subset of a small subset of their users of one service will use - I would imagine that microsoft likely owns hundreds of domain names and doesn't pay MarkMonitor to monitor every single one
    - gruez 1y ago
      ghcr.io is registered by markmonitor.
- TheDong 1y ago
  Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3193589914 https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platform or infrastructure team, and there's no chance in hell any email you send to microsoft or github will end up with that team ever. You won't have anyone to transfer the names to, you'll just be holding them and paying for them forever. The best thing you can do if you want to fix this is: 1. Don't make typos. 2. Email github and tell them to reserve typosquat domains, and know it will get ignored, or _maybe_ added to a backlog and ignored for at least the next 15 years 3. Don't make typos. 4. Don't use ghcr for anything, and always mirror public ghcr.io packages using a "bot" github account with only permissions to public repositories to minimize blast radius. Actually, the best bet to get this fixed is to wait for Microsoft to provide "Email Github Copilot support", hope that they hooked it up so the AI is capable of making purchase decisions, and convince it to purchase about 6000 domain names that might be typoes for security reasons.
  - worldsayshi 1y ago
    > Don't use ghcr for anything What is the alternative for small budget private code projects?
    - TheDong 1y ago
      Assuming you're not distributing container images to a huge number of people, you can just run your own docker registry with a hard-to typo name. It costs hardly anything to do: https://github.com/cloudflare/serverless-registry https://github.com/cloudflare/serverless-registry
      - worldsayshi 1y ago
        Yeah I've been thinking about doing this and I probably will. I just have a tendency to scope creep my own projects and I just decided that maybe I should just use ghcr since it's free.
- nottorp 1y ago
  Why do they even need 1420 domain names for one service? What's wrong with registry.github.com, pages.github.com etc etc? Too much to type?
  - koakuma-chan 1y ago
    It may be easier to register a new domain than to get people to make a subdomain for you.
    - nottorp 1y ago
      Isn't that an official MS service for github?
      - koakuma-chan 1y ago
        Yeah, and what I'm saying is that it may be hard to get people within your org to do something for you.
        airtonix 1y ago
        [dead]
- spixy 1y ago
  * GitHub Inc.
thaeli 1y ago
Are there any additional mitigations folks are using for this? This issue is the only reason we can’t turn classic PATs off entirely. Short lifetime mandatory reauth to enterprise SSO seems to be the best available, but it’s inconvenient for the single Classic PAT we actually need.
- lloeki 1y ago
  Maybe: - create a GitHub App or something that can generate transient tokens - implement some CLI that generates a token - login with that token - push See e.g: https://medium.com/@tiwari09abhi/github-app-token-authorization-a-complete-guide-169461f2953f https://medium.com/@tiwari09abhi/github-app-token-authorizat... https://martin.baillie.id/wrote/ephemeral-github-tokens-via-hashicorp-vault/ https://martin.baillie.id/wrote/ephemeral-github-tokens-via-... But I'm not even sure because GH auth system is all over the place and downright nuts in some places... e.g a fine grained token with repo access can't curl a tarball with the usual URL, it has to use the /api which makes tooling that constructs URLs from repo names and versions break with no recourse as soon as you disable classic PATs

by nicce 1y ago

echelon 1y ago

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

jsheard 1y ago
Microsoft is paying top dollar for MarkMonitor, aren't they supposed to proactively register obvious typos so this kind of thing doesn't happen to their clients?
- VoidWhisperer 1y ago
  My guess is that MarkMonitor is mainly used for their brand-relevant domains (microsoft, office 365, github (main site), etc), as opposed to one that a small subset of a small subset of their users of one service will use - I would imagine that microsoft likely owns hundreds of domain names and doesn't pay MarkMonitor to monitor every single one
  - gruez 1y ago
    ghcr.io is registered by markmonitor.
TheDong 1y ago
Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3193589914 https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platform or infrastructure team, and there's no chance in hell any email you send to microsoft or github will end up with that team ever. You won't have anyone to transfer the names to, you'll just be holding them and paying for them forever. The best thing you can do if you want to fix this is: 1. Don't make typos. 2. Email github and tell them to reserve typosquat domains, and know it will get ignored, or _maybe_ added to a backlog and ignored for at least the next 15 years 3. Don't make typos. 4. Don't use ghcr for anything, and always mirror public ghcr.io packages using a "bot" github account with only permissions to public repositories to minimize blast radius. Actually, the best bet to get this fixed is to wait for Microsoft to provide "Email Github Copilot support", hope that they hooked it up so the AI is capable of making purchase decisions, and convince it to purchase about 6000 domain names that might be typoes for security reasons.
- worldsayshi 1y ago
  > Don't use ghcr for anything What is the alternative for small budget private code projects?
  - TheDong 1y ago
    Assuming you're not distributing container images to a huge number of people, you can just run your own docker registry with a hard-to typo name. It costs hardly anything to do: https://github.com/cloudflare/serverless-registry https://github.com/cloudflare/serverless-registry
    - worldsayshi 1y ago
      Yeah I've been thinking about doing this and I probably will. I just have a tendency to scope creep my own projects and I just decided that maybe I should just use ghcr since it's free.
nottorp 1y ago
Why do they even need 1420 domain names for one service? What's wrong with registry.github.com, pages.github.com etc etc? Too much to type?
- koakuma-chan 1y ago
  It may be easier to register a new domain than to get people to make a subdomain for you.
  - nottorp 1y ago
    Isn't that an official MS service for github?
    - koakuma-chan 1y ago
      Yeah, and what I'm saying is that it may be hard to get people within your org to do something for you.
      - airtonix 1y ago
        [dead]
spixy 1y ago
* GitHub Inc.

thaeli 1y ago

Are there any additional mitigations folks are using for this? This issue is the only reason we can’t turn classic PATs off entirely. Short lifetime mandatory reauth to enterprise SSO seems to be the best available, but it’s inconvenient for the single Classic PAT we actually need.

lloeki 1y ago
Maybe: - create a GitHub App or something that can generate transient tokens - implement some CLI that generates a token - login with that token - push See e.g: https://medium.com/@tiwari09abhi/github-app-token-authorization-a-complete-guide-169461f2953f https://medium.com/@tiwari09abhi/github-app-token-authorizat... https://martin.baillie.id/wrote/ephemeral-github-tokens-via-hashicorp-vault/ https://martin.baillie.id/wrote/ephemeral-github-tokens-via-... But I'm not even sure because GH auth system is all over the place and downright nuts in some places... e.g a fine grained token with repo access can't curl a tarball with the usual URL, it has to use the /api which makes tooling that constructs URLs from repo names and versions break with no recourse as soon as you disable classic PATs