Hacker News Reader

> almost certainly from running in CI where such secrets don’t exist.

CI usually has the most privileged secrets anywhere in a company lol

CIs having per-package installs : version ratio > 1 are fundamentally dumb idea in the first place.

In a way, this teaches us that there is something as too much reliability in an ecosystem. Specifically, Github is apparently reliable enough that its occasional outages are insufficient to kill all the companies running these dumb CI setups that redownload packages from the Internet every build - so there's no incentive to reduce waste and improve security globally.

Redownloading and automatically updating to the new version are pretty orthogonal. You can have a solution which caches the packages but would still update to a new version or a solution which redownloads the (verifiably) same package each time. Vendoring libraries stops both but it's the automatic updates which are the biggest risk factor.

> CI usually has the most privileged secrets anywhere in a company lol

Literally the reason the stealer of Miasma was focusing on extracting tokens from the CI/CD runner from the start.

Reply on news.ycombinator.com