News for hackers. Stuff that matters.

A comment on Microsoft's open source tools were hacked to steal passwords of AI developers. Parent comment

Re:Microsoft's open source tools were hacked to steal passwo... by bilekas on Tuesday June 09, 2026 @05:03AM (#48458532)
Microsoft's open source projects the target of a supply chain attack and they decided to restrict access to understand and limit exposure ? Something a little more 'true' and less targetted?
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by philipwhiuk on Tuesday June 09, 2026 @05:24AM (#48458702)
Azure are able to be targets of supply chain attack because of the supply chain ecosystem that they still own. It's not really a supply chain when it's still yours.
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by bilekas on Tuesday June 09, 2026 @06:05AM (#48458979)
> It's not really a supply chain when it's still yours.

I don't personally buy that, they offer a package manager in the form of nuget for example, if their products there are compromised, they're well withing normal reach to block THEIR packages, but why would they need to block the rest ?

Maybe I'm missing something dumb

[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by philipwhiuk on Tuesday June 09, 2026 @08:58AM (#48460531)
* GitHub [which they own] failed to detect the account was compromised

* GitHub [which they own] allowed the contribution to ignore CI

* GitHub [which they own] failed to detect suspicious content on check-in

* GitHub [which they own] isn't sufficiently integrated into Microsoft security that the compromised token wasn't rolled.

[ Parent | on HN ]