Hasty Briefs - Daily Tech News Brief

Bilingual

GitHub is (again) having issues
9 months ago
- Subscribe to GitHub incident updates via email or SMS.
- SMS notifications available for multiple countries with country codes listed.
- Verification required for SMS updates via OTP; email subscription doesn't require verification.
Help Shape the Future of GitHub
9 months ago
- GitHub invites users to participate in research to improve their platform.
- Participants can sign up and provide information to be matched with relevant studies.
- Studies are mostly online, with possible incentives like swag, gift cards, or charity donations.
- Feedback can involve product experience, workflow, design testing, or surveys.
- Session durations vary (30-60 minutes for appointments, flexible for surveys).
- Research is primarily remote, with occasional in-person sessions in various cities.
- Participants can decline invitations or opt out of future emails.
- Both current users and newcomers to GitHub are welcome.
- All roles in software development teams are encouraged to participate.
- Personal information is kept confidential and accessible only to the research team.
Code Review Can Be Better
8 months ago
- GitHub's code review process is widely criticized, especially for poor support of stacked pull requests and interdiff reviews.
- The author prefers local code review over web interfaces, highlighting benefits like faster performance and personalized workflows.
- git-review was created to store review state in the repository itself, using commits for comments and feedback.
- Despite the promising concept, git-review faced challenges with code modifications and conflicts during reviews.
- Upcoming Git features like Change-Id might offer better solutions for tracking commit revisions and interdiff reviews.
- The article mentions alternative tools and systems (Fossil, Gerrit's NoteDb, git-bug, git-appraise, prr) that store review or issue data in repositories.
- Jane Street's internal code review system is cited as an example of a more effective approach.
Render any Git repo into a single static HTML page for humans or LLMs
8 months ago
- Rendergit flattens GitHub repositories into a single, searchable HTML page.
- Features include syntax highlighting, markdown rendering, and sidebar navigation.
- Supports two view modes: Human View (pretty interface) and LLM View (raw CXML text).
- Includes smart filtering, directory tree overview, and responsive design.
- Easy to install and use with simple commands.
- Apache 2.0 licensed with no intention for long-term maintenance.
Ghrc.io Appears to Be Malicious
8 months ago
- A typo in 'ghcr.io' to 'ghrc.io' can lead to credential theft.
- 'ghcr.io' is a popular OCI-compliant container registry by GitHub.
- 'ghrc.io' mimics a default nginx setup but responds to OCI API calls with authentication prompts.
- The malicious behavior involves the 'www-authenticate' header directing clients to send credentials to 'ghrc.io/token'.
- Credentials are only stolen if users mistakenly log in or configure services for 'ghrc.io'.
- Affected users should change passwords, revoke PATs, and monitor GitHub for suspicious activity.
Nx compromised: malware uses Claude code CLI to explore the filesystem
8 months ago
- At least 1.4k GitHub users have a malicious repository named 's1ngularity-repository' created by a compromised nx build kit post-install command.
- The malware steals sensitive data like wallets and API keys, storing them in a results.b64 file within the repository.
- It checks for Claude Code CLI or Gemini CLI to offload fingerprintable code to a prompt, making detection harder.
- Affected nx versions: 21.5.0 - v21.8.0 and v20.6.0 – v20.12.0, which have been removed from npm.
- Users should check for the malicious repository, update nx to safe versions (e.g., 21.4.1), and rotate all leaked secrets.
- The malware uses nx's post-install hook to run telemetry.js, dumping environment variables and using GitHub CLI to create repositories.
- A novel aspect is leveraging LLMs (like Claude/Gemini CLI) to search for wallet/secret-related files via a detailed prompt.
- Incident timeline shows malicious versions published on 2025-08-26, with npm removing them and org owner actions following reports.
- Official advisory and remediation steps are available on GitHub for affected users.
The GitHub website is slow on Safari
8 months ago
- GitHub has become increasingly slow on Safari, now reaching an unusable state.
- Performance issues are particularly noticeable with large pull requests or files (1000+ lines).
- Even high-end hardware like a MacBook Pro with M4 Max and 48GB RAM struggles with GitHub on Safari.
- Chrome performs better on the same machine, though still struggles with very large pull requests.
- Users report UI sluggishness, frozen pages, and delays in actions like adding labels or reviewers.
- The issue appears to be Safari-specific, with no immediate fixes available.
- Some speculate the problem might be related to CSS selectors or API actions triggered by the UI.
Malicious versions of Nx and some supporting plugins were published
8 months ago
- Malicious versions of the nx package and supporting plugins were published to npm, containing code to scan file systems and steal credentials.
- Affected versions include nx 21.5.0, 20.9.0, 20.10.0, 21.6.0, 20.11.0, 21.7.0, 21.8.0, and 20.12.0, among others.
- The attack vector was a compromised npm token with publish rights to the affected packages.
- Malicious behavior included scanning for credentials, posting them to GitHub, and modifying system files to include a shutdown command.
- Timeline details the publishing of malicious versions and subsequent removal by npm.
- Immediate actions required include checking for impact, uninstalling malicious versions, and rotating compromised credentials.
- Preventative measures now include enforcing 2FA and using Trusted Publisher mechanisms for npm packages.
Why Collaborate with XAI?
8 months ago
- GitHub users express strong opposition to the inclusion of xAI's Grok in Copilot, citing ethical concerns and Elon Musk's controversial reputation.
- Several users threaten to migrate their repositories to alternative platforms like Codeberg or self-hosted solutions due to this partnership.
- Criticism includes accusations of GitHub/Microsoft abandoning their stated values by collaborating with a figure associated with fascist ideologies.
- Some users provide instructions on how to disable Grok in Copilot settings, encouraging others to do the same as a form of protest.
- A few comments acknowledge Grok's technical capabilities but are overshadowed by the overwhelming negative sentiment towards its association with Musk.
Using GitHub MCP server with Claude code
8 months ago
- GitHub serves as an MCP server for Claude Desktop integration, enabling repository management, workflow automation, and AI-assisted code analysis.
- Integration with Claude Code allows accessing GitHub functionalities directly within Claude Code.
- Setup involves installing GitHub, configuring Claude Code, and verifying the integration through testing.
- Prerequisites include having Claude Code installed and a compatible OS (Windows, macOS, Linux).
- Configuration details are added to the project's CLAUDE.md file for automatic detection by Claude Code.
- Examples and test commands are provided to ensure the setup works correctly.
- Troubleshooting tips address common issues like server not found, configuration not loaded, and GitHub not appearing in Claude Code.
- Next steps encourage exploring GitHub capabilities, joining the MCP community, and contributing to GitHub development.
Show HN: Sometimes GitHub is boring, so I made a CLI tool to fix it
8 months ago
- A modern terminal interface for exploring GitHub profiles, repositories, and activity.
- Built with Charm's Bubbles UI components for a delightful terminal experience.
- Features include Repository List, Table View, Statistics View, and Activity Feed.
- Complete Repository Listing shows all public repositories, not just recent activity.
- Real-time search functionality to filter repositories by name or description.
- Rich metadata display including stars, forks, languages, and update dates.
- Popularity sorting automatically sorts repositories by star count.
- Responsive design that adapts to terminal size.
- Keyboard navigation with Vim-like keybindings (j/k, h/l).
- Quick actions like clone, copy URLs, and open in browser.
- Live data refresh without needing to restart.
- Built-in GitHub API rate limit checking.
- Installation options include downloading binaries, building from source, or using Homebrew.
- Personal Access Token setup for higher rate limits and private repository access.
- Interactive browsing and detailed repository listing commands.
- Key bindings for navigation, selection, and quick actions.
- Comprehensive analytics about GitHub profiles and repositories.
- Activity insights including push events, issues, PRs, and stars.
- Programming language breakdown and time-based sorting of events.
- Example commands to explore profiles like Andrej Karpathy and Linus Torvalds.
- Environment variables for customization (GITHUB_TOKEN, NO_COLOR, GITACT_CACHE_DIR).
- API response caching to improve performance and reduce rate limit usage.
- Contribution guidelines including forking, feature branches, and pull requests.
- Project is licensed under the MIT License.
- Acknowledgments to Charm, GitHub API, Lip Gloss, and Bubble Tea.
- Made with Go.
Print GitHub Repositories as Books
8 months ago
- Print your favorite Git repositories as PDF for a fun way to explore GitHub.
- Sign in with GitHub to print public or private repositories in an easy-to-read format.
- Currently in beta; users are encouraged to request features or report bugs.
- Created by @pliutau with a personal touch.
GitHub Community Discussions: Past year's top 2 requests are to disable Copilot
8 months ago
- GitHub Discussions covers various topics including CI/CD, GitHub Copilot, Education Benefits, and more.
- Users report issues like payment not reflecting for GitHub Copilot Pro and problems with GitHub Actions.
- There are discussions on tools like Aura-sec for port scanning and feedback on GitHub features.
- Issues with Chinese input methods in GitHub's Issues input box and problems with large file downloads are highlighted.
- Questions about GitHub Actions for automating tasks and repository language inaccuracies are raised.
- Security concerns like devices taken over by rogue MDM and differences between Dependabot alerts and CodeQL analysis are discussed.
Post-quantum security for SSH access on GitHub
8 months ago
- GitHub is introducing post-quantum secure key exchange methods for SSH access to enhance Git data security.
- The new algorithm, sntrup761x25519-sha512, combines Streamlined NTRU Prime with classical Elliptic Curve Diffie-Hellman for quantum-resistant security.
- This update affects SSH access only, not HTTPS, and excludes GitHub Enterprise Cloud in the US region due to FIPS compliance.
- The change aims to protect against 'store now, decrypt later' attacks by quantum computers in the future.
- Rollout begins on September 17, 2025, for GitHub.com and GitHub Enterprise Cloud (except US), and in GitHub Enterprise Server 3.19.
- Most users with OpenSSH 9.0+ will automatically use the new algorithm; older clients will fall back to existing methods.
- Users can test SSH client support for the new algorithm with `ssh -Q kex` and check active algorithms with `ssh -v` commands.
- GitHub will continue monitoring and updating its security offerings as new post-quantum algorithms emerge.
Show HN: Gocd – a lightweight Go-based CI/CD tool that runs on your dev machine
7 months ago
- GoCD is a lightweight, cross-platform continuous deployment service that syncs code from GitHub to development, staging, or production servers.
- Download instructions for Linux (amd64 and arm64), macOS (Intel and Apple Silicon), and Windows are provided.
- Installation involves downloading the binary, setting permissions, and moving it to the appropriate system location.
- GoCD can be installed as a user service, setting up platform-specific services (systemd, LaunchAgent, Scheduled Task).
- Authentication setup includes SSH key instructions for GitHub repositories and interactive token setup for HTTPS URLs.
- Repository monitoring options include specifying branches, trigger types (push, pr, both), and deployment paths.
- Commands for managing repositories: add, list, remove, with options for branch, path, or all instances.
- Service management commands: start, stop, status, and log viewing with real-time follow option.
- Deployment scripts (gocd.sh, gocd.bat, etc.) can be created in the repository root for automatic execution post-pull.
- Environment variables available to deployment scripts include GOCD_REPO_PATH, GOCD_TIMESTAMP, GOCD_VERSION, and Git details.
- SSH and HTTPS authentication methods are detailed, including token generation and setup.
- Building from source requires Go 1.21 or later and Git, with build scripts for all platforms, local builds, and testing.
- Example use cases include monitoring team repositories for development, deploying on PR merges, and production branch pushes.
- Troubleshooting tips cover checking service status, logs, authentication, and deployment script permissions.
- Contribution guidelines include forking, branching, committing changes, and opening pull requests.
- The project is licensed under the MIT License.
fs-code: PyFilesystems for Gitlab, GitHub, and Git
7 months ago
- PyFilesystems for GitLab, GitHub, and Git.
- Installation options include gitlabfs, githubfs, gitfs, or all.
- Usage examples provided for both FS URL and class methods.
- Demonstrates opening and reading files from GitLab using fs-code.
GitHub's plan for a more secure NPM supply chain
7 months ago
- GitHub is enhancing npm security with stricter authentication and granular tokens to combat package registry attacks.
- The Shai-Hulud attack, a self-replicating worm, compromised npm maintainer accounts, highlighting vulnerabilities in the open source ecosystem.
- GitHub is implementing trusted publishing and removing API tokens from build pipelines to improve security.
- Maintainers are encouraged to adopt trusted publishing and review their security practices to mitigate risks.
- The security of the open source ecosystem is a shared responsibility, requiring collaboration and vigilance from all stakeholders.
Show HN: Why clone GBs when you need KBs? Surgical GitHub downloads
7 months ago
- Download files or folders from GitHub repos using branches, tags, or commits with glob pattern filtering.
- Features include downloading entire repositories or specific files/folders, support for branches, tags, and commits, advanced filtering with glob patterns, rate limiting, concurrent downloads, CLI and Python API interfaces, error handling, logging, and cache support.
- Installation can be done via pip or from source.
- CLI commands include downloading entire repositories, specific branches, with filtering, authentication, and showing repository information.
- Python API usage includes initializing a downloader, downloading entire repositories, specific directories, or files.
- Configuration can be set via environment variables or a .env file.
- Contributions are welcome, with details in the CONTRIBUTING.md guide.
- Licensed under Apache-2.0.
Analysing RubyGems Contribution Data with Homebrew's Tooling
7 months ago
- Mike McQuaid shares contribution data from Homebrew to inform discussions about RubyGems GitHub organization access changes.
- Homebrew uses a command `brew contributions` to evaluate maintainers' contributions, including PRs, commits, and reviews, for access and stipends.
- Contribution data for RubyGems members is analyzed using Homebrew's tooling, showing varied activity levels among members.
- The analysis reveals discrepancies in who was removed or retained in RubyGems, suggesting inconsistencies with the principle of least privilege.
- The post highlights the importance of transparency in open source projects and the potential complications introduced by funding.
Rails Version 8.0.3 Released
7 months ago
- Rails 8.0.3 has been released.
- Summary of changes available in the 8.0.3 CHANGELOG on GitHub.
- Full listing of changes can be viewed via commits on GitHub.
- SHA-256 hashes provided for verifying gem authenticity.
- Checksums for all 8.0.3 gems listed for verification.
- Acknowledgement to contributors for their efforts in this release.

Hasty Briefsbeta

#github

GitHub is (again) having issues

Help Shape the Future of GitHub

Code Review Can Be Better

Render any Git repo into a single static HTML page for humans or LLMs

Ghrc.io Appears to Be Malicious

Nx compromised: malware uses Claude code CLI to explore the filesystem

The GitHub website is slow on Safari

Malicious versions of Nx and some supporting plugins were published

Why Collaborate with XAI?

Using GitHub MCP server with Claude code

Show HN: Sometimes GitHub is boring, so I made a CLI tool to fix it

Print GitHub Repositories as Books

GitHub Community Discussions: Past year's top 2 requests are to disable Copilot

Post-quantum security for SSH access on GitHub

Show HN: Gocd – a lightweight Go-based CI/CD tool that runs on your dev machine

fs-code: PyFilesystems for Gitlab, GitHub, and Git

GitHub's plan for a more secure NPM supply chain

Show HN: Why clone GBs when you need KBs? Surgical GitHub downloads

Analysing RubyGems Contribution Data with Homebrew's Tooling

Rails Version 8.0.3 Released