Supply chain attack on popular #GitHub Action exposes CI/CD secrets

Supply chain attack on popular #GitHub Action exposes CI/CD secrets
Fake-Sicherheitswarnung: Betrüger versuchen Github-Konten zu kapern
Sicherheitsforscher berichten über Angriffsversuche auf rund 12.000 Github-Repositories. Dabei wollen Angreifer die volle Kontrolle über Konten erlangen.
Is there a GDPR-friendly way to set up (self hosted) a free, minimalist Git source code management system without registration (just for me as the admin), possibly including templates for a privacy policy?
I want to move away from Github.
This week's donation went to a developer that goes by flightlessmango. They contribute to Mangohud among other projects. Mangohud is an overlay for monitoring FPS, temperatures, CPU/GPU load and more. It's code is licensed using the MIT license.
Their code can be found on Github:
https://github.com/flightlessmango
if you want to help them financially they accept donations through Github.
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
Link: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
Discussion: https://news.ycombinator.com/item?id=43367987
Popular GitHub Action tj-actions/changed-files is compromised
Link: https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
Discussion: https://news.ycombinator.com/item?id=43368870
AI coding assistant refuses to write code, tells user to learn programming instead - On Saturday, a developer using Cursor AI for a racing game project hit an ... - https://arstechnica.com/ai/2025/03/ai-coding-assistant-refuses-to-write-code-tells-user-to-learn-programming-instead/ #largelanguagemodels #machinelearning #aipaternalism #stackoverflow #programming #airefusals #aicoding #chatgpt #chatgtp #biz #cursor #github #tech #ai
Sicherheitslücken: Gitlab-Entwickler raten zu zügigem Update
Es sind wichtige Sicherheitsupdates für die Softwareentwicklungsplattform Gitlab erschienen.
Hey peeps, if you're still using #GitLab and #GitHub and you're twitching a bit because they're fellating fascists, I want to point to the sign that says you can self-host @forgejo - a project which is also working on decentralisation and federation.
Failing that, @Codeberg also exists, are a European non-profit that also supports the development of Forgejo.
Hope that helps
This week's donation went to the LXQt desktop. It is a lightweight desktop that was born from the merger of LXDE and Razor-qt. It is currently available in around a couple dozen Linux and BSD distros. The code is licensed through a combo of GPLv2.0 and LGPLv2.1.
The project's main website is here:
The source code is available on Github:
The project has a presence on Mastodon:
https://mastodon.social/@ LXQt
If you want to help the project financially they accept donations through their Open Collective:
FOSS roguelike dungeon crawler "Shattered Pixel Dungeon" has been updated to version 3.0.0. This update adds a new playable character, interface changes, bug fixes, and more. The code is licensed using GPLv3.0. It was made using libGDX.
The main website for the project is here:
The source code is available on Github:
https://github.com/00-Evan/shattered-pixel-dungeon
The release notes for this udpate are here:
https://github.com/00-Evan/shattered-pixel-dungeon/releases/tag/v3.0.0
The game can be downlaoded on Itch and Github, as well as purchased on GOG:
https://shattered-pixel.itch.io/shattered-pixel-dungeon
https://www.gog.com/game/shattered_pixel_dungeon
The project has a presence on Mastodon and Lemmy:
https://mastodon.gamedev.place/@ ShatteredPixel
If you wish to help the project financially you can donate through Liberapay, Itch, Patreon and by purchasing on GOG:
Long Read: Lessons from Building Semantic Search for GitHub and Why I Failed
Link: https://tzx.notion.site/What-I-Learned-Building-a-Free-Semantic-Search-Tool-for-GitHub-and-Why-I-Failed-1a09b742c7918033b318f3a5d7dc9751
Discussion: https://news.ycombinator.com/item?id=43299659
Is there shadow banning in github?
I created a new account and from that account opened a ticket on a repo.
For this ticket I have a valid URL. I can see the ticket information when I am logged in the new account. When I use an old account I get a 404 for the tickets URL.
Regardless of which account I use, I don't see the ticket in the repos issues list.
Did anyone else experience something similar?
I just lost access to a substantial amount of issues on one of my #GitHub projects.
I would appreciate if people could help upvote https://github.com/orgs/community/discussions/153161 to get more attention.
GitHub staff won't even tell me how much data they've hidden from me, which is quite discouraging :(
FOSS performance overlay "GOverlay" has been updated to version 1.3. This update adds a App Image version, adds new color themes, adds a dedicated form for blacklist management, and more. The code is licensed using GPLv3.0. GOverlay is an opensource project that aims to create a Graphical UI to help manage Linux overlays. The project can be found in various Linux distro repos.
The source code can be found on Github:
https://github.com/benjamimgois/goverlay
If you wish to help the project financially you can donate to the lead developer Benjamim Góis Ildefonso da silva through Paypal:
"Command & Conquer": Electronic Arts veröffentlicht Quellcode
Electronic Arts hat den Quellcode mehrerer Teile der Spielereihe "Command & Conquer" veröffentlicht. Damit sollen die Titel für Fans spielbar bleiben.
Kaspersky exposes hidden malware on GitHub stealing personal data
Link: https://www.kaspersky.com/about/press-releases/kaspersky-exposes-hidden-malware-on-github-stealing-personal-data-and-485000-in-bitcoin
Discussion: https://news.ycombinator.com/item?id=43206417
Project documentation of #opensource projects on #GitHub should be in…