Page 13 - Github Action News Today : Breaking News, Live Updates & Top Stories | Vimarsana

Codecov's Bash Uploader script could be verified to check for tampering via a cryptographic checksum, but despite this it was a couple of months before the compromise was detected. The use of the script within GitHub actions was one example where the checksum was not inspected. Following the security incident, GitHub users raised an issue, "Checksum should be run on bash uploader script before execution," with one developer remarking that "the idea to directly and blindly execute a bash script pulled from the web is a giant security hole and a ticking bomb for future breaches." Codecov attemp...

GitHub Reacts to Growing Cryptocurrency Mining Attacks Using GitHub Actions Like by As the market capitalization of cryptocurrency surged from $190 billion in January of 2020 to $2 trillion in April of 2021, it's become profitable for bad actors to make a full time job of attacking the free tiers of platform-as-a-service providers. Chartier describes how an attacker can abuse GitHub Actions cron feature to create new commits every hour with the aim to mine cryptocurrencies. Because developers can run arbitrary code on our servers, they often violate our terms of service to run cryptoc...

Plus: America creates task force to tackle ransomware crims Share Copy In Brief The Homebrew package manager for macOS and Linux has fixed an issue that could have been exploited by miscreants to run malicious code on people's computers. Specifically, the project's GitHub Actions setup could have been abused to sneak arbitrary Ruby code into its Cask repositories, security researcher RyotaK discovered and disclosed via HackerOne. The infosec bod found it was possible to merge a "malicious pull request by confusing the library that is used in the automated pull request review script de...

April 04, 2021 inPython Over the weekend, I wrote a program that tries to identify which DMC threads are used in embroidery hoop images. I didn’t take a computer vision course at university — nor had I used OpenCV before — so it was fun to learn a few things and I hope you learn from my learnings. It all started when my wife wanted to find out what colors were used in a few of the hoops posted to r/embroidery. Thus, I embarked on an over-engineered solution: a Python CLI that guesses and then overlays the DMC thread color palette on a given image.

| Compiled code running at near-native speeds in the browser is getting the .NET touch. MLenny / Getty Images It’s not hard to see why Microsoft is investing in WebAssembly. It’s a technology that scratches many different itches. It delivers apps to users, adds rich user interfaces to web applications, and even provides a way to manage and update edge devices. By building on widely distributed web technologies and supporting familiar programming languages, it’s a way to run compiled binaries anywhere that you can run a JavaScript engine. Microsoft has had plenty o...