We Executed a Critical Supply Chain Attack on PyTorch

Re:We Executed a Critical Supply Chain Attack on PyTorch by adnanthekhan on Sunday January 14, 2024 @09:49PM (#38996929)

This is more subtle, but there is an “author_association”field within Actions event contexts that can be one of:

NONE, CONTRIBUTOR, COLLABORATOR, MEMBER, OWNER

There are some cases where people use checks for that as part of gating for workflows that run on pull_request_target/issue_comment, but might confuse contributor and collaborator (which requires explicitly adding someone to the repository). Ultimately this is a misconfiguration on part of the maintainer but another example where fixing a typo can play a part in an attack.

[ Parent | on HN ]

Re:We Executed a Critical Supply Chain Attack on PyTorch by schemescape on Sunday January 14, 2024 @10:49PM (#38997259)

Thanks, that makes more sense than automatically granting privileges. It definitely seems easy to mix up those two terms, however!

[ Parent | on HN ]