GitHub Actions update: Helping maintainers combat bad actors

Re:GitHub Actions update: Helping maintainers combat bad actors by pa7ch on Friday April 23, 2021 @12:14AM (#26910924)

CI/CD is RCE as as service. Not opening CI/CD to the public by default seems like a security necessity.

[ Parent | on HN ]

Re:GitHub Actions update: Helping maintainers combat bad actors by Longwelwind on Friday April 23, 2021 @10:46AM (#26915261)

I'm building a project where my service would plug with the (unstrusted) JS code of users.

I first thought it would be easy to sandbox and have something decent running, but after making some research on sandboxing, I realize how hard it is, and the many ways bad actors can exploit a service running untrusted code.

Kudos to GitHub and GitLab for taking the challenge of providing a RCE service with a free plan.

[ Parent | on HN ]

Re:GitHub Actions update: Helping maintainers combat bad actors by PurpleFoxy on Friday April 23, 2021 @04:22AM (#26912370)

Hacker news is spam as a service, not letting the public post is a necessity.

Or we could acknowledge there is a space between complete unmanaged access and no access.

[ Parent | on HN ]

Re:GitHub Actions update: Helping maintainers combat bad actors by rdsubhas on Friday April 23, 2021 @05:51AM (#26912899)

Poor analogy. CI is about automating what a developer does remotely, so yes CI IS automated code execution in a remote environment, as a service. But Hacker news is "spam as a service" – huh?? They don't even compare.

Secondly, parent comment said public by default is bad. Parent didn't say "all public was bad". So there is no necessity to make it into a disagreement.

[ Parent | on HN ]