From 10/17/2021, 12:37:10 PM till now, @niros_valtos has achieved 583 Karma Points with the contribution count of 81.
Recent @niros_valtos Activity
T-Mobile stated that they don't believe that any sensitive data was stolen. The moment your source code leaks and it has secrets in it, this is a game over!
The problem is not only with the fact that secrets need to be rotated, but the operational impact it can cause if not rotated in all places. Add the time aspect to it and you have a goodie bag.
Can you imagine how many tacos they can buy now? They may get 10x multiples over time
How to Protect Yourself Against GitHub/OAuth Apps Supply Chain Attacks
9 points • 0 comments
Globant should have used Okta to login to all dev tools. It can never be breached. Oh wait… maybe it can?
On a more serious note, their admin 8-lowercase-character passwords are too easy to guess.
It doesn’t matter if you are a startup company, large enterprise, or a malware gang - if your source code has been private from any reason and then leaked, there are businesses implications to it. In this case, a Ukrainian hacker stole the code from a well-known Russian malware gang. It means that their “secret sauce” is exposed and can be used to prevent attacks from them. I wonder if they measure the potential impact to recurring revenue…
Stay tuned for Kaspersky source code leak
3 points • 0 comments
How to survive a state-actor trying to put a backdoor in your code?
20 points • 2 comments
As long as you don’t rubber stamp the PRs, any approach would be good.
Storing PII on GitHub is not wise. It is stored with the history and can be restored even if deleted. As for opening up the repo publicly, it can be achieved with a quick win by triggering alerts on such changes.
Your doubt is right. Here is how repos can be restored: https://docs.github.com/en/repositories/creating-and-managin...
Quote: "Quote: "GitHub is available to developers in all countries, we are continuing to ensure free open source services are available to all, including developers in Russia". " My opinion: This is the right commercial decision for a company in this scale. We need to assume that most Russian developers don't want to harm the companies they work for, but any western company needs only one developer with malicious intent resulted from this situation. Without being too commercial about it, https://arnica.io can solve it.
App SEC vs. Software Supply Chain Security Explained
3 points • 1 comments
Are you concerned by excessive permissions on GitHub Apps?
1 points • 0 comments
Hacking Hacker News for fun and profit
2 points • 1 comments
Do the same for Hacker News and you’ll be a top 500 website
It wasn’t a big thing when it was disabled by default and now it is because the default flipped?! I think this is a big issue regardless - it’s like selling a bike rack with every new car. It doesn’t seem right and enforces the wrong behavior.
Cyberattack on one of Norway’s largest media companies shuts down presses
1 points • 0 comments
This is great! The moment DuckDuckGo will make their accuracy and UX better it will skyrocket. Maybe it is related somehow to their new browser initiative, but we’ll see.
Hackers for Charity, led by Johnny Long (author of Google Hacking)
Ask HN: How do you manage PR approvers in GitHub?
2 points • 0 comments
site design / logo © 2022 Box Piper