News for hackers. Stuff that matters.

A comment on We Executed a Critical Supply Chain Attack on PyTorch. Parent comment

Re:We Executed a Critical Supply Chain Attack on PyTorch by mlazos on Sunday January 14, 2024 @05:28PM (#38995075)
If they use the same runners, couldn’t the attacker just wait? The runners would need to be sequestered too
[ Parent | on HN ]
Re:We Executed a Critical Supply Chain Attack on PyTorch by kevin_nisbet on Sunday January 14, 2024 @05:57PM (#38995308)
Absolutely. The real difficulty is tests on PR are by definition remote code execution by an untrusted source, so a full risk analysis and hardening needs to be done.

Here's a similar mistake on an OSS repo a company I worked for made: https://goteleport.com/blog/hack-via-pull-request/

[ Parent | on HN ]