Bilingual

Micron CEO says low-price push by customers fueled the memory shortage
20 days ago
- Memory and RAM shortage is driving up smartphone and computer prices, partly due to aggressive price pressure from customers causing reduced manufacturer investment.
- Micron CEO notes that prices dropped to one-third of previous levels in 2023, leading to poor margins and halted industry investments, with shortages potentially lasting beyond 2027.
- AI companies' increased demand for memory chips exacerbates the supply-demand imbalance, resulting in consumer price hikes, including Apple's recent increases on Mac and iPad models.
New Research: A "Verified" GitHub Commit Is Not Unique
14 days ago
- Git uses content hashes to uniquely identify commits, which supply-chain tools rely on as immutable names for signed content.
- A preprint reveals hash chain malleability: an attacker can create a different signed commit with the same tree, metadata, and a valid signature, changing only the hash and affecting subsequent commits.
- The issue stems from signature malleability in GPG-based schemes (ECDSA, RSA, EdDSA) and S/MIME, not from hash function weaknesses like SHA-1 collisions.
- GitHub's server-side verification accepts these malleable signatures without canonicalization, issuing 'Verified' badges for each variant, and retains verification even if keys are later revoked.
- Local tools like git verify-commit show mixed behavior, accepting some malleable signatures but rejecting others that GitHub accepts.
RubyGems Supply Chain Attack
20 hours ago
- A supply chain attack on RubyGems was discovered via a new gem called git_credential_manager that downloaded malicious binaries from a Forgejo instance.
- The gem evolved over four versions in nine hours, starting as a dropper, then silencing output, and finally executing on library load rather than explicit command.
- The malware avoids CI environments by checking for over 30 environment variables, targeting developer laptops.
- The attacker also compromised other gems (Dendreo and fastlane-plugin-run_tests_firebase_testlab) by adding the malicious gem as a dependency or hijacking accounts.
- Two long-dormant maintainer accounts were reactivated to push the malicious code, highlighting the risk of inactive accounts in package registries.
- This marks RubyGems' first major incident of this type, similar to attacks previously seen on npm and PyPI.

Hasty Briefsbeta

#supply chain

Micron CEO says low-price push by customers fueled the memory shortage

New Research: A "Verified" GitHub Commit Is Not Unique

RubyGems Supply Chain Attack