Hacker Newsnew | past | comments | ask | show | jobs | submit | PokestarFan's commentslogin

GitHub already has a program to scan for keys, since publishing Discord tokens by mistake used to get the token immediately revoked and a DM from the system account saying why


I thought there were many first and third party services looking for this kind of thing (AWS, Github, GWS, crypto, etc tokens). Seems weird that a F500 company repo was not receiving the regular, let alone extra deep scanning which could have trivially found these.

There was a recent post from someone who made the realization that most of these scanning services only investigate the main branch. Extra gold in them hills if you also consider development branches.


Yeah I'd hope they were doing this, atleast in repos!

Thought the mechanism was a little unclear in your specific example - did Github revoke Discord tokens?


I've been able to trigger a segfault in zsh with certain plugins, a directory with a lot of files/folders, and globs with a bunch of * characters.


It was obvious Apple was going to bend the knee with that gold plaque.


They mention it's compiled to WASM.


If I had to describe it, Notion is if somehow managed to combine OneNote and Excel. Of interest is the fact that the "database" system stores each row as a page with the column values other than title stored in a special way. Of course, this also means that it doesn't scale at all, but I have seen some crazy use cases (an example is replacing Jira).


You probably want to check before you clear cache


NPM is owned by GitHub and therefore Microsoft, who is too busy putting in Copilot into apps that have 0 reason to have any form of generative AI in them


But Github does loads of things with security, including reporting compromised NPM packages. I didn't know NPM is owned by Microsoft these days though, now that I think about it, Microsoft of all parties should be right on top of this supply chain attack vector - they've been burned hard by security issues for decades, especially in the mid to late 90's, early 2000s as hundreds of millions of devices were connected to the internet, but their OS wasn't ready for it yet.


It's not like NPM pre-Microsoft was a paragon of professional management or engineering...


For those who have forgotten, Microsoft buying npm was basically a community service given npm inc was on the brink of collapsing

https://www.businessinsider.com/npm-ceo-bryan-bogensberger-r...

https://www.businessinsider.com/npm-cofounder-laurie-voss-re...


The difference is in the apparent available resources. You cant get to "professional" without the time and money, and NPM post acquisition, presumably, has more of both. Granted, NPM probably doesn't have a revenue model to speak of, which means Microsoft is probably not paying it much attention.


Good god. Not everything has to be about your opinion on AI.


GitHub was folded into Microsoft's "CoreAI" team. Not very confidence-inspiring.


Actually, they could probably use AI to see if each update to a package looks malicious or obfuscated.


Just write a check.md instruction for copilot to check it for malicious acticity, problem solved


Is it really owned and run by Microsoft? I thought they only provide infrastructure, servers and funding.


I believe that for X-ray mode, the radiation was indirect, so it needed a lot more power. Furthermore, older revisions had hardware locks, and the intent of the Therac-25 was to make it cheaper.


Does Broadcom do anything but get hate for their shitty decisions? They are becoming, if they aren't already, the new Oracle.


Lol get out of the echo chamber

Edit: to make this helpful, look at Broadcomm interconnect, switching technology, copackaged optics


This is because blurays ship their subtitles as a bunch of text images. So pirates have 3 options:

1. Just copy them over from the Bluray. This lacks support in most client players, so you'll either need to download a player that does, or use something like Plex/Jellyfin, which will run FFMpeg to transcode and burn the picture subtitles in before sending it to the client.

2. Run OCR on the Bluray subtitles. Not perfect.

3. Steal subtitles from a streaming service release (or multiple) if it exists.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: