←back to thread

Ghrc.io appears to be malicious

(bmitch.net)
407 points todsacerdoti | 3 comments | 24 Aug 25 23:27 UTC | HN request time: 0.001s | source
Show context
nicce ◴[24 Aug 25 23:59 UTC] No.45008930[source]▶
GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous.

[1] https://docs.github.com/en/packages/working-with-a-github-pa...

Edit: most relevant issues?

https://github.com/orgs/community/discussions/38467

https://github.com/github/roadmap/issues/558

replies(2): >>45008951 #>>45009250 #
echelon ◴[25 Aug 25 00:03 UTC] No.45008951[source]▶
Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft.

Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

replies(4): >>45008966 #>>45010248 #>>45011719 #>>45017549 #
nottorp ◴[25 Aug 25 08:50 UTC] No.45011719[source]▶
Why do they even need 1420 domain names for one service?

What's wrong with registry.github.com, pages.github.com etc etc?

Too much to type?

replies(1): >>45012333 #
1. koakuma-chan ◴[25 Aug 25 10:28 UTC] No.45012333[source]▶
It may be easier to register a new domain than to get people to make a subdomain for you.
replies(1): >>45012515 #
2. nottorp ◴[25 Aug 25 11:01 UTC] No.45012515[source]▶
Isn't that an official MS service for github?
replies(1): >>45013268 #
3. koakuma-chan ◴[25 Aug 25 12:48 UTC] No.45013268[source]▶
Yeah, and what I'm saying is that it may be hard to get people within your org to do something for you.
replies(1): >>45023659 #