Page 7 - Github Action News Today

Codecovs Bash Uploader script could be verified to check for tampering via a cryptographic checksum, but despite this it was a couple of months before the compromise was detected. The use of the script within GitHub actions was one example where the checksum was not inspected. Following the security incident, GitHub users raised an issue, "Checksum should be run on bash uploader script before execution," with one developer remarking that "the idea to directly and blindly execute a bash script p...

GitHub Reacts to Growing Cryptocurrency Mining Attacks Using GitHub Actions Like by As the market capitalization of cryptocurrency surged from $190 billion in January of 2020 to $2 trillion in April of 2021, its become profitable for bad actors to make a full time job of attacking the free tiers of platform-as-a-service providers. Chartier describes how an attacker can abuse GitHub Actions cron feature to create new commits every hour with the aim to mine cryptocurrencies. Because devel...

Plus: America creates task force to tackle ransomware crims Share Copy In Brief The Homebrew package manager for macOS and Linux has fixed an issue that could have been exploited by miscreants to run malicious code on peoples computers. Specifically, the projects GitHub Actions setup could have been abused to sneak arbitrary Ruby code into its Cask repositories, security researcher RyotaK discovered and disclosed via HackerOne. The infosec bod found it was possible to merge a "malicious...

April 04, 2021 inPython Over the weekend, I wrote a program that tries to identify which DMC threads are used in embroidery hoop images. I didn’t take a computer vision course at university — nor had I used OpenCV before — so it was fun to learn a few things and I hope you learn from my learnings. It all started when my wife wanted to find out what colors were used in a few of the hoops posted to r/embroidery. Thus, I embarked on an over-engineered solution: a Python CLI that guesses and ...

| Compiled code running at near-native speeds in the browser is getting the .NET touch. MLenny / Getty Images It’s not hard to see why Microsoft is investing in WebAssembly. It’s a technology that scratches many different itches. It delivers apps to users, adds rich user interfaces to web applications, and even provides a way to manage and update edge devices. By building on widely distributed web technologies and supporting familiar programming languages, it’s a wa...

Pinch, punch, first day of the month Richard Speed Mon 1 Mar 2021 // 11:32 UTC Share Copy Code automation stalwarts have endured a frustrating start to the week after GitHub Action began tottering this morning, taking a number of carefully crafted workflows down with it. User problems were first reported at 9.44 UTC on 1 March, and a minute before the hour the Microsoft division admitted there was "degraded availability" for GitHub actions. That degraded availability man...