frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Why is choral music harder to appreciate?

https://marginalrevolution.com/marginalrevolution/2025/08/why-is-choral-music-harder-to-appreciat...
11•surprisetalk•2d ago•2 comments

Git-Annex

https://git-annex.branchable.com/
5•keepamovin•54m ago•0 comments

Show HN: Sping – An HTTP/TCP latency tool that's easy on the eye

https://dseltzer.gitlab.io/sping/docs/
81•zorlack•5h ago•5 comments

Busy beaver hunters reach numbers that overwhelm ordinary math

https://www.quantamagazine.org/busy-beaver-hunters-reach-numbers-that-overwhelm-ordinary-math-202...
70•defrost•2d ago•13 comments

From Hackathon to YC

https://www.producthunt.com/p/april-yc-s25/from-hackathon-to-yc
12•rmason•7h ago•9 comments

The two versions of Parquet

https://www.jeronimo.dev/the-two-versions-of-parquet/
147•tanelpoder•3d ago•34 comments

We put a coding agent in a while loop

https://github.com/repomirrorhq/repomirror/blob/main/repomirror.md
168•sfarshid•12h ago•114 comments

Is 4chan the perfect Pirate Bay poster child to justify wider UK site-blocking?

https://torrentfreak.com/uk-govt-finds-ideal-pirate-bay-poster-boy-to-sell-blocking-of-non-pirate...
199•gloxkiqcza•12h ago•174 comments

German contest to live in depopulated Soviet-era city proves global hit

https://www.theguardian.com/world/2025/aug/21/german-contest-to-live-in-depopulated-soviet-era-ci...
37•c420•3d ago•36 comments

Y Combinator files brief supporting Epic Games, says store fees stifle startups

https://www.macrumors.com/2025/08/21/y-combinator-epic-games-amicus-brief/
128•greenburger•3d ago•114 comments

The Unix-Haters Handbook (1994) [pdf]

https://simson.net/ref/ugh.pdf
15•oliverkwebb•4h ago•2 comments

Ghrc.io appears to be malicious

https://bmitch.net/blog/2025-08-22-ghrc-appears-malicious/
280•todsacerdoti•5h ago•36 comments

Trees on city streets cope with drought by drinking from leaky pipes

https://www.newscientist.com/article/2487804-trees-on-city-streets-cope-with-drought-by-drinking-...
160•bookofjoe•2d ago•85 comments

Burner Phone 101

https://rebeccawilliams.info/burner-phone-101/
308•CharlesW•4d ago•124 comments

Making games in Go: 3 months without LLMs vs. 3 days with LLMs

https://marianogappa.github.io/software/2025/08/24/i-made-two-card-games-in-go/
270•maloga•14h ago•190 comments

Uncle Sam shouldn't own Intel stock

https://www.wsj.com/opinion/uncle-sam-shouldnt-own-intel-stock-ccd6986d
103•aspenmayer•7h ago•111 comments

A Brilliant and Nearby One-off Fast Radio Burst Localized to 13 pc Precision

https://iopscience.iop.org/article/10.3847/2041-8213/adf62f
55•gnabgib•9h ago•8 comments

Show HN: Decentralized Bitcoin Incentives via QR Codes

https://github.com/DT7QR/Bitcoin-Rewards-System-Proposal
8•Yodan2025•3h ago•0 comments

Everything I know about good API design

https://www.seangoedecke.com/good-api-design/
229•ahamez•10h ago•84 comments

Bash Strict Mode (2014)

http://redsymbol.net/articles/unofficial-bash-strict-mode/
32•dcminter•2d ago•26 comments

Cloudflare incident on August 21, 2025

https://blog.cloudflare.com/cloudflare-incident-on-august-21-2025/
154•achalshah•3d ago•32 comments

Show HN: Clearcam – Add AI object detection to your IP CCTV cameras

https://github.com/roryclear/clearcam
170•roryclear•17h ago•47 comments

How many paths of length K are there between A and B? (2021)

https://horace.io/walks
22•jxmorris12•9h ago•4 comments

Halt and Catch Fire Syllabus (2021)

https://bits.ashleyblewer.com/halt-and-catch-fire-syllabus/
121•Kye•8h ago•34 comments

My ZIP isn't your ZIP: Identifying and exploiting semantic gaps between parsers

https://www.usenix.org/conference/usenixsecurity25/presentation/you
48•layer8•3d ago•19 comments

Claim: GPT-5-pro can prove new interesting mathematics

https://twitter.com/SebastienBubeck/status/1958198661139009862
129•marcuschong•4d ago•86 comments

How to check if your Apple Silicon Mac is booting securely

https://eclecticlight.co/2025/08/21/how-to-check-if-your-apple-silicon-mac-is-booting-securely/
63•shorden•5h ago•13 comments

Show HN: I Built a XSLT Blog Framework

https://vgr.land/content/posts/20250821.xml
41•vgr-land•11h ago•16 comments

Comet AI browser can get prompt injected from any site, drain your bank account

https://twitter.com/zack_overflow/status/1959308058200551721
506•helloplanets•13h ago•177 comments

NASA's Juno mission leaves legacy of science at Jupiter

https://www.scientificamerican.com/article/how-nasas-juno-probe-changed-everything-we-know-about-...
68•apress•3d ago•29 comments
Open in hackernews

Ghrc.io appears to be malicious

https://bmitch.net/blog/2025-08-22-ghrc-appears-malicious/
280•todsacerdoti•5h ago

Comments

arjvik•5h ago
Took the article pointing out that the c and r were transposed for me to even notice there was a problem!
SoftTalker•5h ago
Yep this is the sort of typo error I make probably 10 times a day.
javchz•2h ago
What it's funny it's that because tokenization there is a non zero chance a LLM audit may not see anything wrong here, similar to the strawberry problem.
echelon•5h ago
The problem here is GitHub's terrible domain name.

The container registry has a horrible name.

Gigachad•5h ago
Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.
zx8080•4h ago
Probably, it's cool, and honored inside an org to operate a separate domain service vs go ask for a permission for a subdomain to another team.
JdeBP•4h ago
Interestingly, the GitHub doco says outright that it superseded docker.pkg.github.com. ; so it was a conscious choice to go with this domain naming scheme instead of that one.

* https://docs.github.com/en/packages/working-with-a-github-pa...

rconti•4h ago
insecurity through obscurity
dcrazy•4h ago
It’s best security practice to host user-generated content on a separate domain to opt into browsers’ cross-domain security policies. Hence ghcr.io, githubusercontent.com, fbimg.com, etc.

https://www.reddit.com/r/webdev/comments/lg9xnm/why_do_some_...

usr1106•59m ago
Not a web programmer, so know cross-domain only for hearsay :(

It does not seem to hinder e.g. Google using google.com, youtube.com, gmail.com, and several (many?) others to collect your data. Do you say security and privacy work differently here?

missingcolours•45m ago
In those cases, the company controls all of the code running on those sites, so it's desirable for them to share data and cookies in particular. (e.g. any google.com site can read your login cookie)

In the case of user data domains, intentionally in the design of the service or via a security hole, users may be able to execute code and read cookies (e.g. in JavaScript on a page hosted on githubusercontent.com) and that's undesirable.

usr1106•15m ago
Sure, I see why as a company you don't want user data in your domain.

But if the different domain name gives good protection / isolation, why does Google still use completely different domains for different services with content controlled by them. I cannot believe they are interested in protecting users from data collection.

cyral•4h ago
I've noticed this too. Why does amazon have aboutamazon.com and Google have developers.googleblog.com? They literally have their own .google TLD but still choose this weird domain.

Same with local governments. They love something really random like <countyname>proptaxpayment.org instead of treasurer.<countyname>.gov. It's exactly the kind of domain you are told to watch out for, but actually legit.

missingcolours•39m ago
A common scenario I've seen in the case of local governments is that a department (e.g. the Assessing Department) contracts with a vendor to run the website and has no idea how DNS works, and the vendor defaults to registering new domains for their clients since that's the easiest when dealing with non-technical clients. Texas alone for example has 254 countries, the vast majority of which are very small and have effectively no full time IT department, so when these vendors are engaging new clients, low IT expertise is the norm by volume.

The local government itself may have an IT department, but they may not know how to create a subdomain, or even be aware this contract is being made and the site is being set up until after it's announced to the public.

Atreiden•5h ago
Fairly compelling attack vector because it took several readings for me to even see the problem with the domain.
JdeBP•4h ago
You and many others. Including people who retry multiple times, and even reboot their machines.

* https://stackoverflow.com/a/66985424/340790 (Spot the answerer's account name!)

* https://forums.docker.com/t/docker-unable-to-push-to-ghrc-io...

a1o•5h ago
Damn, this can pick a typo from a CI job and do mean things.
aussieguy1234•5h ago
There are alot of open source projects using this domain https://github.com/search?q=ghrc.io&type=code
notsahil•4h ago
GitHub should a have tool internally to create bulk and send it as a fix
aussieguy1234•2h ago
they probably do, they already have one that identified credentials posted to github repos by accident.
lathiat•3h ago
That's a fairly impressively sized list.
engcoach•5h ago
Is the danger here token replay? It's using Bearer tokens, so it's not sending a password over:

<https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Aut...>

Threats section for Bearer tokens: <https://datatracker.ietf.org/doc/html/rfc6750#section-5.2>

Does OAuth reuse tokens across domains? If not, doesn't this just mean it is requesting an auth token for ghrc (the "fake" domain) but it can't access any auth tokens for ghcr (the real domain)?

bmitch3020•4h ago
Blog author (and OCI maintainer) here. The request to get a bearer token sends the password or PAT using the basic auth header, base64 encoded, but otherwise clear-text. That's the request the www-authenticate header is triggering. Once the token is received, the registry uses that to verify access, and that eventually expires. But the attacker isn't getting the token, they are requesting the credentials that would be used to acquire a bearer auth token.
iojcde•5h ago
https://github.com/search?q=ghrc.io&type=code
nicce•5h ago
GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous.

[1] https://docs.github.com/en/packages/working-with-a-github-pa...

Edit: most relevant issues?

https://github.com/orgs/community/discussions/38467

https://github.com/github/roadmap/issues/558

echelon•5h ago
Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft.

Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

jsheard•5h ago
Microsoft is paying top dollar for MarkMonitor, aren't they supposed to proactively register obvious typos so this kind of thing doesn't happen to their clients?
VoidWhisperer•4h ago
My guess is that MarkMonitor is mainly used for their brand-relevant domains (microsoft, office 365, github (main site), etc), as opposed to one that a small subset of a small subset of their users of one service will use - I would imagine that microsoft likely owns hundreds of domain names and doesn't pay MarkMonitor to monitor every single one
TheDong•35m ago
Good luck with that.

People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3...

That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention.

I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platform or infrastructure team, and there's no chance in hell any email you send to microsoft or github will end up with that team ever.

You won't have anyone to transfer the names to, you'll just be holding them and paying for them forever.

The best thing you can do if you want to fix this is:

1. Don't make typos.

2. Email github and tell them to reserve typosquat domains, and know it will get ignored, or _maybe_ added to a backlog and ignored for at least the next 15 years

3. Don't make typos.

4. Don't use ghcr for anything, and always mirror public ghcr.io packages using a "bot" github account with only permissions to public repositories to minimize blast radius.

Actually, the best bet to get this fixed is to wait for Microsoft to provide "Email Github Copilot support", hope that they hooked it up so the AI is capable of making purchase decisions, and convince it to purchase about 6000 domain names that might be typoes for security reasons.

thaeli•4h ago
Are there any additional mitigations folks are using for this? This issue is the only reason we can’t turn classic PATs off entirely.

Short lifetime mandatory reauth to enterprise SSO seems to be the best available, but it’s inconvenient for the single Classic PAT we actually need.

JdeBP•5h ago
Previously on Hacker News at https://news.ycombinator.com/item?id=44974240 .
TZubiri•4h ago
Reminder not to use goofy TLDs, being cute is not worth it when compared to security. There's no guarantees that the process for taking down a malicious domain will be as smooth as a .com.

I'd rather deal with US verisign rather than the British Indian Ocean territory or colombia or anguila

bragr•3h ago
The .io TLD is administered by Afilias which is an American corporation.
nicce•2h ago
Afilias was sold to Ethos Capital and the whole domain is a mess:

https://en.m.wikipedia.org/wiki/.io

gruez•3h ago
whois says it's registered by dynadot, so it's probably worth contacting their abuse email: abuse@dynadot.com
usr1106•1h ago
One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped.

Root cause a stupid FLA of course. For several months I thought it means Google whatever register.