3 ms·
> almost certainly from running in CI where such secrets don’t exist. CI usually has the most privileged secrets anywhere in a company lol
by insanitybit 2mo ago
> almost certainly from running in CI where such secrets don’t exist.
CI usually has the most privileged secrets anywhere in a company lol
- TeMPOraL 2mo agoCIs having per-package installs : version ratio > 1 are fundamentally dumb idea in the first place. In a way, this teaches us that there is something as too much reliability in an ecosystem. Specifically, Github is apparently reliable enough that its occasional outages are insufficient to kill all the companies running these dumb CI setups that redownload packages from the Internet every build - so there's no incentive to reduce waste and improve security globally.
- rcxdude 2mo agoRedownloading and automatically updating to the new version are pretty orthogonal. You can have a solution which caches the packages but would still update to a new version or a solution which redownloads the (verifiably) same package each time. Vendoring libraries stops both but it's the automatic updates which are the biggest risk factor.
- cookiengineer 2mo ago> CI usually has the most privileged secrets anywhere in a company lol Literally the reason the stealer of Miasma was focusing on extracting tokens from the CI/CD runner from the start.